春季引导。 无法使用令牌进行身份验证

Question

我正在实现OAuth2 授权授予流程。 通过“登录”页面登录时，用户可以接收访问令牌。 但是，当我通过访问令牌来调用需要身份验证的端点时，它将触发异常。

以下是一些日志：

 |2017-08-05 22:37:54.102  INFO 18809 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Creating filter
 chain:
 org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfiguration$NotOAuthRequestMatcher@7efa3f63,
 [
 org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@7134b8a7,
 org.springframework.security.web.context.SecurityContextPersistenceFilter@3ff54f3d,
 org.springframework.security.web.header.HeaderWriterFilter@7b61bf11,
 org.springframework.security.web.authentication.logout.LogoutFilter@18b74ea,
 org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter@1665fa54,
 org.springframework.security.web.savedrequest.RequestCacheAwareFilter@14c93774,
 org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@62a68bcb,
 org.springframework.security.web.authentication.AnonymousAuthenticationFilter@2262d6d5,
 org.springframework.security.web.session.SessionManagementFilter@40247d48,
 org.springframework.security.web.access.ExceptionTranslationFilter@315105f,
 org.springframework.security.web.access.intercept.FilterSecurityInterceptor@70025b99]

如您所见，链中有一个OAuth2AuthenticationProcessingFilter 。

但是，当我调用端点时，会收到以下日志：

.808 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2017-08-05 23:14:24.808 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2017-08-05 23:14:24.808 DEBUG 19570 --- [nio-8080-exec-3] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
2017-08-05 23:14:24.808 DEBUG 19570 --- [nio-8080-exec-3] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
2017-08-05 23:14:24.808 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2017-08-05 23:14:24.809 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@7091e577
2017-08-05 23:14:24.809 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 4 of 11 in additional filter chain; firing Filter: 'CsrfFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 5 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users' doesn't match 'POST /logout
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 6 of 11 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users' doesn't match 'POST /login
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 7 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 8 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.session.SessionManagementFilter  : Requested session ID 82C8AE1B7613B93D9F52F5A09CA5D114 is invalid.
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /users at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2017-08-05 23:14:24.811 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /users' doesn't match 'POST /logout
2017-08-05 23:14:24.811 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/users'; against '/resources/**'
2017-08-05 23:14:24.811 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /users; Attributes: [authenticated]
2017-08-05 23:14:24.814 DEBUG 19570 --- [nio-8080-exec-3] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Sat Aug 05 23:14:24 CEST 2017, principal=<unknown>, type=AUTHENTICATION_FAILURE, data={type=org.springframework.security.authentication.AuthenticationCredentialsNotFoundException, message=An Authentication object was not found in the SecurityContext}]
2017-08-05 23:14:24.817 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.a.ExceptionTranslationFilter     : Authentication exception occurred; redirecting to authentication entry point

正如您在第二个日志中看到的那样，它没有通过OAuth2AuthenticationProcessingFilter 。

这是我的安全配置：

public class SecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/resources/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .permitAll()
                .and().anonymous().disable();
   }
}

有人知道原因吗？ 谢谢！

更新1

这是我的配置： https : //gist.github.com/osgafarov/ef432de739f0e8dd2eb595c0c75aff1d

这是我如何称呼端点：

curl -H "Authorization: bearer eaee916e-fdf1-4e80-808e-cfd9b2944539" localhost:8080/users

更新2

我发现如果我设置

security.oauth2.resource.filter-order = 3

那么上面的命令将起作用，但是当我调用/oauth/authorize时使用此设置，会收到以下错误：“访问此资源需要完全认证。未经授权”。

Answer 1

我遇到了类似的问题并解决了以下问题，您需要配置资源服务器：

@Configuration
@EnableResourceServer
protected static class ResourceServer extends ResourceServerConfigurerAdapter {

    @Autowired
    private TokenStore tokenStore;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .antMatcher("/api/**", "/secured_area/**")
                // etc. add more matchers
                .authorizeRequests()
                .anyRequest().authenticated();
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.tokenStore(tokenStore).resourceId("myapp");
    }

}

另外，我相信从Spring Boot 1.5.1+起，安全过滤器的顺序已更改，您可能希望覆盖该顺序：

 @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
 public class SecurityConfigurerAdapter extends WebSecurityConfigurerAdapter { ..... }