Spring auth 服务器代码授权通过 Postman 为端点 /oauth2/authorize 返回 401 未授权

Question

Using the spring auth server dependency 0.3.0:

<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-oauth2-authorization-server</artifactId>
  <version>0.3.0</version>
</dependency>

I got these two config files:

@Configuration
@ComponentScan(basePackageClasses = AuthorizationServerConfig.class)
@Import(OAuth2AuthorizationServerConfiguration.class)
public class AuthorizationServerConfig {

  private final RegisteredClientProvider registeredClientProvider;

  @Autowired
  public AuthorizationServerConfig(RegisteredClientProvider registeredClientProvider) {
    this.registeredClientProvider = registeredClientProvider;
  }

  @Bean
  @Order(Ordered.HIGHEST_PRECEDENCE)
  public SecurityFilterChain authServerSecurityFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
    return http.formLogin(Customizer.withDefaults()).build();
  }

  @Bean
  @ConditionalOnMissingBean
  public RegisteredClientRepository registeredClientRepository() {

    RegisteredClient codeClient = RegisteredClient.withId(UUID.randomUUID().toString())
    .clientId("code-auth-client")
    .clientSecret("{noop}secret")
    .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
    .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
    .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
    .redirectUri("http://127.0.0.1:8080/redirect/")
    .scope("read-access")
    .build();

    return new InMemoryRegisteredClientRepository(codeClient);
  }

}

__

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableWebSecurity
public class SpringSecurityConfiguration {

  @Bean
  public InMemoryUserDetailsManager userDetailsService() {
    UserDetails user = User.withDefaultPasswordEncoder()
        .username("user")
        .password("password")
        .roles("USER")
        .build();
    return new InMemoryUserDetailsManager(user);
  }

  @Bean
  SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
    http.authorizeRequests(authorizeRequests ->
            authorizeRequests.anyRequest().authenticated()
        )
        .formLogin(withDefaults());
    return http.build();
  }

}

I use the folloing parameters to fetch the authorization code in order to trade it for the token itself:

Unfortunately the application responses with 401 unauthorized:

GET http://localhost:9000/oauth2/authorize?response_type=code&state=&client_id=code-auth-client&scope=read-access&redirect_uri=http%3A%2F%2F127.0.0.1%3A8080%2Fredirect%2F 401

I tried to fix it in the SecurityFilterChain beans but I couldn't fix it so far. Basically I am using this example https://www.baeldung.com/spring-security-oauth-auth-server (without the clients tho).

EDIT: I've noticed that the parameter "grant_type=authorization_code" was missing. Appending that parameter did not work tho.

Answer 1

删除@Import(OAuth2AuthorizationServerConfiguration.class)解决了这个问题。