gpt4 book ai didi

java - Spring Security Oauth2 自定义 token 端点 url

转载 作者:行者123 更新时间:2023-11-29 10:11:52 27 4
gpt4 key购买 nike

您好,我必须在我的项目中集成 spring security oauth2。所以我添加了配置相关部分并且它工作正常。但问题是第一个 token 请求转到 "/oauth/token",我想将其更改为 "api/v1/token"。我搜索了它并找到了一些解决方案,例如在 oauth:authorization-server 中添加 token-endpoint-url 还添加了将覆盖 ClientCredentialsTokenEndpointFilter 的自定义过滤器类> 并将 url 传递给构造函数。但是这些都没有用。我收到以下请求“api/v1/token”的错误-

An Authentication object was not found in the SecurityContext

我的配置主要是基于xml的。spring-security.xml 文件-

<http pattern="/api/v1/token" create-session="stateless"
authentication-manager-ref="authenticationManager"
xmlns="http://www.springframework.org/schema/security" >
<intercept-url pattern="/api/v1/token" access="IS_AUTHENTICATED_FULLY" />
<anonymous enabled="false" />
<http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
<custom-filter ref="customClientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<http pattern="/test/**" create-session="never"
entry-point-ref="oauthAuthenticationEntryPoint"
xmlns="http://www.springframework.org/schema/security">
<anonymous enabled="false" />
<intercept-url pattern="/test/**" access="ROLE_USER" />
<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<beans:bean id="oauthAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
</beans:bean>
<beans:bean id="oauthAccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler">
</beans:bean>
<beans:bean id="clientAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
<beans:property name="realmName" value="springsec/client" />
<beans:property name="typeName" value="Basic" />
</beans:bean>


<beans:bean id="customClientCredentialsTokenEndpointFilter"
class="com.walletdoc.oauth.web.security.CustomClientCredentialsTokenEndpointFilter">
<beans:property name="authenticationManager" ref="authenticationManager" />
</beans:bean>

<authentication-manager alias="authenticationManager"
xmlns="http://www.springframework.org/schema/security">
<authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>
<beans:bean id="clientDetails" class="com.walletdoc.oauth.web.security.SpringSecurityClientService">
<beans:property name="id" value="mysupplycompany" />
<beans:property name="secretKey" value="mycompanykey" />
<beans:property name="authorities" value="ROLE_CLIENT" />
</beans:bean>
<beans:bean id="clientDetailsUserService"
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<beans:constructor-arg ref="clientDetails"/>
</beans:bean>



<authentication-manager id="userAuthenticationManager"
xmlns="http://www.springframework.org/schema/security">
<authentication-provider ref="customUserAuthenticationProvider">
</authentication-provider>
</authentication-manager>

<beans:bean id="customUserAuthenticationProvider"
class="com.walletdoc.oauth.web.security.ClientAuthenticationProvider">
</beans:bean>

<oauth:authorization-server
client-details-service-ref="clientDetails" token-services-ref="tokenServices" token-endpoint-url="/api/v1/token">
<oauth:authorization-code />
<oauth:implicit/>
<oauth:refresh-token/>
<oauth:client-credentials />
<oauth:password authentication-manager-ref="userAuthenticationManager" />
</oauth:authorization-server>

<oauth:resource-server id="resourceServerFilter"
resource-id="springsec" token-services-ref="tokenServices" />

<beans:bean id="tokenStore"
class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" />

<beans:bean id="tokenServices"
class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
<beans:property name="tokenStore" ref="tokenStore" />
<beans:property name="supportRefreshToken" value="true" />
<beans:property name="accessTokenValiditySeconds" value="3600"></beans:property>
<beans:property name="clientDetailsService" ref="clientDetails" />
</beans:bean>

过去 2 天我一直在尝试解决这个问题,因此我们将不胜感激。

最佳答案

路径“/oauth/token”不是一种事实上的标准吗?

不幸的是,我没有 XML 配置的确切答案,但也许这个 Java 配置可以给你提示。

当您扩展 AuthorizationServerConfigurerAdapter 时以下方法使您可以访问 Builder,从而访问授权服务器配置:

@Override
public void configure(AuthorizationServerEndpointsConfigurer oauthServer) throws Exception {
oauthServer

// Here you can override the default endpoints mappings
.pathMapping("/oauth/authorize", "/api/v1/authorize")
.pathMapping("/oauth/token", "/api/v1/token")

// .. rest of the authorization server customization
.authenticationManager(authenticationManager)
.tokenStore(tokenStore);
}

这有点奇怪,因为您通过 Map 覆盖映射,您必须知道要覆盖的每个路径,并且 AuthorizationServerEndpointsConfigurer 中实际上没有任何提示或文档。类。

最后它起作用了,当授权服务器启动时日志显示:

...
.s.o.p.e.FrameworkEndpointHandlerMapping : Mapped "{[/api/v1/authorize],methods=[],params=[],headers=[],consumes=[],produces=[],custom=[]}" onto ...
.s.o.p.e.FrameworkEndpointHandlerMapping : Mapped "{[/api/v1/token],methods=[POST],params=[],headers=[],consumes=[],produces=[],custom=[]}" onto ...

...

我想在 XML 中它应该转换为 <oauth:authorization-server> 中的某个元素喜欢:

<oauth:authorization-server>
<!-- ... -->
<pathMappings>
<!-- key/value here -->
</pathMappings>
</oauth:authorization-server>

编辑:检查 XML schema 后, 你一开始可能做对了,因为 token-endpoint-url元素应该根据评论完成数学计算:

        <xs:attribute name="token-endpoint-url" type="xs:string">
<xs:annotation>
<xs:documentation>
The URL at which a request for an access token
will be serviced.
Default value: "/oauth/token"
</xs:documentation>
</xs:annotation>
</xs:attribute>

也许您应该在 spring-security-oauth issue tracker 中提交问题?

关于java - Spring Security Oauth2 自定义 token 端点 url,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/30774206/

27 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com