Spring / OAuth2錯誤 - InsufficientAuthenticationException，沒有客戶端身份驗證。嘗試添加適當的身份驗證篩選器

Question

我已經被困了幾個小時試圖弄清楚這個Spring Security OAuth2實現在世界上出了什么問題。

當我去命中/oauth/token端點時發生錯誤：

本地主機：8080 /我-OAuth的實踐應用/的OAuth /令牌

錯誤 ： InsufficientAuthenticationException, There is no client authentication. Try adding an appropriate authentication filter. InsufficientAuthenticationException, There is no client authentication. Try adding an appropriate authentication filter.

授權服務器配置

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {


    @Autowired
    @Qualifier("authenticationManagerBean")
    AuthenticationManager authenticationManager;

    @Autowired
    DefaultTokenServices tokenServices;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        super.configure(endpoints);
        endpoints.tokenServices(this.tokenServices).authenticationManager(this.authenticationManager);

    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        super.configure(security);
        security.tokenKeyAccess("permitAll()");
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("clientid").secret("clientpass").authorizedGrantTypes("password").scopes("read").autoApprove(true);
    }


}

資源服務器配置

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Autowired
    DefaultTokenServices tokenServices;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        super.configure(resources);
        resources.tokenServices(this.tokenServices);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests().anyRequest().hasRole("USER");
    }

}

一般網絡安全配置

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Primary
    @Bean
    DefaultTokenServices tokenServices() {
        DefaultTokenServices d = new DefaultTokenServices();
        d.setAccessTokenValiditySeconds(600);
        d.setRefreshTokenValiditySeconds(1000);
        d.setTokenStore(new InMemoryTokenStore());
        return d;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/**").hasRole("USER");
    }


    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

}

Answer 1

您應該檢查WebSecurityConfigurerAdapter方法，如下所示：

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/webjars/**", "/oauth/**");
}

刪除“/ oauth / **”路徑。 除此以外

TokenEndpoint.postAccessToken(Principal principal, @RequestParam Map<String, String> parameters)

principal將為null。