如何在Spring Boot Security OAuth2应用程序中仅对某些类启用OAuth2？

Question

I followed this guide to add OAuth2

https://spring.io/guides/tutorials/bookmarks/#_securing_a_rest_service

But now it's requiring authentication for every single page!

$ curl -s http://localhost:8080/login 
{"error":"unauthorized","error_description":"Full authentication is required to access this resource"}

I only want to use OAuth2 on the API in one specific class. I tried reading the reference for Spring Boot

https://docs.spring.io/spring-boot/docs/1.5.14.BUILD-SNAPSHOT/reference/htmlsingle/#boot-features-security

But it wasn't helpful at all! It gave 0 examples.

To customize it you normally use external properties and beans of type WebSecurityConfigurerAdapter (eg to add form-based login).
All of the above can be switched on and off or modified using external properties (security.*). To override the access rules without changing any other auto-configured features add a @Bean of type WebSecurityConfigurerAdapter with @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) and configure it to meet your needs.

How do you customize it?! Which properties?! How do you configure to meet your needs?!

I tried setting application.properties

security.basic.enabled = false
security.ignored = /login

But it still requires OAuth2 authentication. I want to only enable OAuth2 for the class IShortUrlApiInteface and disable it for all other @Controllers .

Answer 1

Create a new class, extend ResourceServerConfigurerAdapter , and override method configure(HttpSecurity) .

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    String [] ignoredPaths = new String[]{
            "/robots.txt", "/error", "/login", "/doLogut", "/home", "/pageNotFound", 
            "/css/**", "/js/**", "/fonts/**", "/img/**", ...
    };

    @Override
    public void configure(HttpSecurity http) throws Exception{

        http.authorizeRequests()
            .antMatchers(ignoredPaths).permitAll()
            .anyRequest().authenticated()
        .and()
            .httpBasic();   
    }

Answer 2

In your case, you need to set the permission for login URI. If you are in micro service architecture, you need create resource configuration in every project/service.

• security.oauth2.resource.user-info-uri defines authorization service URI
• clientId defines ur actual client id

• In oauth For every resource server need to create unique resource-id Below is the example for resource server.

  @Configuration @EnableResourceServer
  public class ResourceConfig extends ResourceServerConfigurerAdapter { @Value("${security.oauth2.resource.user-info-uri}") private String userInfoUri;

   @Value("${client-id}") private String clientId; @Override public void configure(final ResourceServerSecurityConfigurer resources) throws Exception { resources.resourceId("ig-user"); } @Override public void configure(final HttpSecurity http) throws Exception { http.authorizeRequests().antMatchers("/api/v1/user/activate/**").permitAll()// .antMatchers("/api/v1/user/access/check/**").permitAll()// .antMatchers("/api/v1/profile/exists/**").permitAll()// .antMatchers("/api/v1/user/sign-up/**").permitAll()// .antMatchers("/download/**").permitAll()// .anyRequest().authenticated(); } @Primary @Bean public UserInfoTokenServices tokenService() { final UserInfoTokenServices tokenService = new UserInfoTokenServices(userInfoUri, clientId); return tokenService; } 

  }