使用Postman访问受Spring Boot 2和OAuth 2保护的REST API

Question

我正在使用Spring Boot 2和Spring Security 5构建REST API服务器。我正在使用基于OAuth2的IDP，该IDP在远程服务器上运行，我可以将OAuth2客户端配置为使用IDP，并且当我尝试访问任何URL时从网络浏览器显示出来的是Spring生成的UI。 https://imgur.com/3x98x5A.png

我能够完成身份验证流程，并且能够从Web浏览器访问受保护的资源。

现在，我尝试使用Postman执行相同的操作，在其中生成访问令牌，并要求Postman使用请求标头将令牌传递到我的API服务器（资源服务器），如下所示： https : //imgur.com/z4OvUu4巴纽

但是，当我对我的API进行GET请求时，它会返回spring生成的登录页面的HTML :(

我的spring boot application.properties文件如下：

spring.security.oauth2.client.registration.wso2.client-id=<removed>
spring.security.oauth2.client.registration.wso2.client-secret=<removed>
spring.security.oauth2.client.registration.wso2.client-authentication-method=basic
spring.security.oauth2.client.registration.wso2.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.wso2.redirect-uri-template={baseUrl}/login/oauth2/code/{registrationId}
spring.security.oauth2.client.registration.wso2.scope = openid, profile
spring.security.oauth2.client.registration.wso2.client-name=WSO2 ID Provider

spring.security.oauth2.client.provider.wso2.authorization-uri=https://localidpserver:9443/oauth2/authorize
spring.security.oauth2.client.provider.wso2.token-uri=https://localidpserver:9443/oauth2/token
spring.security.oauth2.client.provider.wso2.user-info-uri=https://localidpserver:9443/oauth2/userinfo
spring.security.oauth2.client.provider.wso2.jwk-set-uri=https://localidpserver:9443/oauth2/jwks

我的POM文件如下：

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.okta.developer</groupId>
    <artifactId>oidc</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>oidc</name>
    <description>Demo project for Spring Boot</description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.2.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webflux</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-config</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-oauth2-client</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-oauth2-jose</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.projectreactor</groupId>
            <artifactId>reactor-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>


</project>

我非常感谢您的回应:)

Answer 1

待确认，但是Spring Security Oauth与基于Spring Boot 2.0的Webflux实现不兼容，这是由于基于Servlet framwework的spring安全实现。

您需要移至2.1.0.M1和Spring安全性5.1.0.M1，检查

• 微服务弹簧引导-2-的OAuth
• oauth2login-webflux
• oauth2resourceserver-webflux