如何在自定義 Web 安全配置中使用 Spring OAuth2 客戶端身份驗證過濾器

Question

我有基本的Web和OAuth2 Client Spring 啟動應用程序。 只需將以下內容添加到application.yml Google SignIn 即可。

spring:
    security:
        oauth2:
            client:
                registration:
                    google:
                        clientId: 1135813....
                        clientSecret: esdf...

但是當添加自定義WebSecurityConfigurerAdapter時，OAuth2 身份驗證不再有效。

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser(User.withUsername("user").password("123").roles("USER"));
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests() //
                .antMatchers("/").permitAll() //
                .antMatchers("/login/social").permitAll() //
                .antMatchers("/login/social/google").permitAll() //
                .anyRequest().authenticated();
    }
}

我想在 OAuth2 身份驗證處理默認重定向 URL ( /login/oauth2/code/google ) 時保留基本身份驗證。 我如何實現這一目標？

Answer 1

下面是關於@EnableResourceServer 的演示

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;



@Configuration
@EnableResourceServer
public class ResServerConfig extends ResourceServerConfigurerAdapter{


    @Override
    public void configure(HttpSecurity http) throws Exception {
        final String[] urlPattern = {"/api/**"}; //eg.,  url protected by oauth2
        http
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) // or SessionCreationPolicy.IF_REQUIRED for your required
            .and()
            .requestMatchers().antMatchers(urlPattern)
            .and()
            .authorizeRequests()
            .antMatchers(urlPattern)
            authenticated()
        ;

    }



}