春季安全性Oauth2令牌错误：“缺少授权类型”

Question

I've secured an endpoint with OAuth2 and JWT but when attempting to authenticate, I'm keep getting the error: "Missing grant type". I've tryed to add the Content-Type header as suggested in other topics but it was useless. Here is my curl command:

curl -vu aClient:aSecret -X POST --header "Content-Type:application/x-www-form-urlencoded" 'http://localhost:9000/oauth/token?username=mauricio.coder&password=123&grant_type=password'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 9000 (#0)
* Server auth using Basic with user 'aClient'
> POST /oauth/token?username=mauricio.coder&password=123&grant_type=password HTTP/1.1
> Host: localhost:9000
> Authorization: Basic YUNsaWVudDphU2VjcmV0
> User-Agent: curl/7.52.1
> Accept: */*
> Content-Type:application/x-www-form-urlencoded
> 
< HTTP/1.1 400 
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< X-Frame-Options: DENY
< X-Application-Context: application:9000
< Cache-Control: no-store
< Pragma: no-cache
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Mon, 20 Nov 2017 12:34:10 GMT
< Connection: close
< 
* Curl_http_done: called premature == 0
* Closing connection 0
{"error":"invalid_request","error_description":"Missing grant type"}

Is there anything wrong?

Answer 1

You need to pass data as form data instead of url parameters. Your command should be ..

curl -u aClient:aSecret --data "grant_type=password&username=mauricio.coder&password=123" -X POST -H "Content-Type:application/x-www-form-urlencoded" http://localhost:9000/oauth/token

UPDATE FOR ADDITIONAL QUESTIONS IN COMMENTS BELOW:

As per spring oauth2 documentation

password grants are switched on by injecting an AuthenticationManager.

Ref - http://projects.spring.io/spring-security-oauth/docs/oauth2.html for more details.

So, if your configuration is like below it should work fine for password grant flow.

@Configuration
@EnableAuthorizationServer
protected static class OAuth2AuthorizationConfig extends
            AuthorizationServerConfigurerAdapter {

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                    .withClient("myclient")
                    .secret("myclientsecret")
                    .authorizedGrantTypes("authorization_code", "refresh_token", "password")
            ...
    }

}