Spring oauth 安全用户名或密码错误 401 未经授权

Question

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{

   @Override protected void configure(HttpSecurity http) throws Exception
   {
      http.formLogin();
      http.authorizeRequests().anyRequest().authenticated();
   }

   @Bean
   public UserDetailsService userDetailsService()
   {
      UserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
      UserDetails user = User.withUsername("emoleumassi")
                             .password("today").authorities("write")
                             .build();
      userDetailsManager.createUser(user);
      return userDetailsManager;
   }

   @Bean
   public PasswordEncoder passwordEncoder()
   {
      return NoOpPasswordEncoder.getInstance();
   }

   @Bean
   @Override
   public AuthenticationManager authenticationManagerBean() throws Exception
   {
      return super.authenticationManagerBean();
   }
}

授权服务器

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter
{
   @Autowired private AuthenticationManager authenticationManager;

   @Override
   public void configure(ClientDetailsServiceConfigurer clients) throws Exception
   {
      clients.inMemory().withClient("client").secret("secret").scopes("write").authorizedGrantTypes("password");
   }

   @Override
   public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception
   {
      endpoints.authenticationManager(authenticationManager);
   }
}

我的依赖：

 SPRING_BOOT_VERSION = "2.6.6"
 implementation "org.springframework.boot:spring-boot-starter-web:${SPRING_BOOT_VERSION}"
 implementation 'org.springframework.boot:spring-boot-starter-security:2.6.6'
 implementation 'org.springframework.security.oauth:spring-security-oauth2:2.5.1.RELEASE'

我收到401 Unauthorized

Answer 1

您需要允许 oauth URL。 我认为：

   @Override protected void configure(HttpSecurity http) throws Exception
  {
    http.formLogin();
    http.authorizeRequests().anyRequest().authenticated();
    http. oauth2Login() // <-- this here
  }

应该这样做。 否则

.antMatchers("/oauth/**).permitAll()

可能是替代方案。