![](/img/trans.png)
[英]Refresh token call fails using spring security an oauth2 with error: UserDetailsService is required
[英]Spring security OAuth2 Refresh Token - IllegalStateException, UserDetailsService is required
我是 Spring 安全和开发具有 OAuth2 身份验证和授权的 Spring REST API 的新手。 一切正常,但是当我请求刷新令牌时,我收到错误说明 -
org.springframework.security.oauth2.provider.endpoint.TokenEndpoint handleException IllegalStateException, UserDetailsService 是必需的。
注意:我正在使用自定义身份验证提供程序来验证数据库中的用户凭据。
这是我的代码:
Web 安全配置适配器:
@Configuration
@EnableWebSecurity
public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
private ClientDetailsService clientDetailsService;
@Autowired
private CustomAuthenticationProvider authProvider;
@Override
protected void configure(
AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authProvider);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.anonymous().disable()
.authorizeRequests()
.antMatchers("/oauth/token").permitAll();
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
@Bean
@Autowired
public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
handler.setTokenStore(tokenStore);
handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
handler.setClientDetailsService(clientDetailsService);
return handler;
}
@Bean
@Autowired
public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
TokenApprovalStore store = new TokenApprovalStore();
store.setTokenStore(tokenStore);
return store;
}
}
自定义身份验证提供程序
@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
String username = authentication.getName();
String password = authentication.getCredentials().toString();
Ss_admin_service ss_admin_service = new Ss_admin_service();
Ss_admin ss_admin = new Ss_admin();
ss_admin.setA_password(password);
ss_admin.setA_username(username);
ss_admin_service.doLogin(ss_admin);
if(!ss_admin_service.doLogin(ss_admin)) {
throw new BadCredentialsException("Invalid username/password");
}
return new UsernamePasswordAuthenticationToken(username, password, (Collection<? extends GrantedAuthority>) new ArrayList<>());
}
@Override
public boolean supports(Class<?> authentication) {
return authentication.equals(UsernamePasswordAuthenticationToken.class);
}
}
授权服务器配置
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
private static String REALM="MY_OAUTH_REALM";
@Autowired
private TokenStore tokenStore;
@Autowired
private UserApprovalHandler userApprovalHandler;
@Autowired
@Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory()
.withClient("my-trusted-client")
.authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
.authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
.scopes("read", "write", "trust")
.secret("secret")
.accessTokenValiditySeconds(10).//Access token is only valid for 10 sec for testing.
refreshTokenValiditySeconds(10);//Refresh token is only valid for 10 sec for testing.
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
.authenticationManager(authenticationManager);
}
@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
oauthServer.realm(REALM+"/client");
}
}
资源服务器配置
@Configuration
@EnableResourceServer
public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter {
private static final String RESOURCE_ID = "SPRING_REST_API";
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.resourceId(RESOURCE_ID).stateless(false);
}
@Override
public void configure(HttpSecurity http) throws Exception {
http
.anonymous().disable()
.requestMatchers().antMatchers("/admin/**")
.and().authorizeRequests()
.antMatchers("/admin/**").access("hasRole('ADMIN')")
.and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
}
}
在 AuthorizationServerConfigurerAdapter 中注入 UserDetailsService:
@Autowired
private UserDetailsService userDetailsService;
然后在这个配置方法上配置它:
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints
...
.userDetailsService(userDetailsService);
}
我已经使用endpoints.tokenServices()
解决了这个问题。
另请参阅:使用 spring 安全性和 oauth2 刷新令牌调用失败并出现错误:需要 UserDetailsService
您可以尝试将 ClientDetailsService 注入授权服务器配置并配置如下;
授权服务器配置
.....
@Autowired
private ClientDetailsService clientDetailsService;
......
......
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.withClientDetails(clientDetailsService);
}
就我而言, Nelio Alves 的回答几乎成功了,但它开始为每个请求返回“访问此资源需要完全身份验证”。 相反,我不得不对WebSecurityConfigurerAdapter
进行注入,大致基于Vijay Nandwana 对另一个类似问题的回答。
这是我的代码,供参考:
public class MyWebSecurityConfigurer extends WebSecurityConfigurerAdapter {
@Autowired
private AtsUserDetailsService userDetailsService;
(...)
@Override
protected void configure(HttpSecurity http) throws Exception {
this.endpoints.getEndpointsConfigurer().userDetailsService(this.userDetailsService);
http.csrf().disable()
.authorizeRequests()
.antMatchers(HttpMethod.POST, "/oauth/token").permitAll()
.anyRequest().fullyAuthenticated();
}
(...)
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.