java - Oauth "An Authentication object was not found in the SecurityContext"

Question

我正在使用 Spring Server 设置 Oauth 安全配置，使用 this code作为指南。我已将 ResourceServerConfigurationAdapter 修改为如下所示，主要是添加一个类以允许匿名访问我的 API 路径。

protected static class ResourceServer extends
        ResourceServerConfigurerAdapter {

    // This method configures the OAuth scopes required by clients to access
    // all of the paths in the video service.
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();

        http.authorizeRequests()
            .antMatchers("/oauth/token").anonymous();

        http.authorizeRequests()
            .antMatchers(HttpMethod.GET,"/gift/**").anonymous();

        //Other additions will be made that require username/password combinations, but I want to start simple first
    }

我通过网络浏览器进入服务器的 /gift 文件夹，看到这个错误:

<oauth>
    <error_description>
        An Authentication object was not found in the SecurityContext
    </error_description>
    <error>unauthorized</error>
</oauth>

我的服务器控制台日志显示:

2014-10-24 16:48:32.895  WARN 8908 --- [io-8443-exec-10] o.s.c.s.ResourceBundleMessageSource      : ResourceBundle [messages] not found for MessageSource: Can't find bundle for base name messages, locale en_US
2014-10-24 16:48:32.895  INFO 8908 --- [io-8443-exec-10] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Fri Oct 24 16:48:32 EDT 2014, principal=<unknown>, type=AUTHENTICATION_FAILURE, data={message=An Authentication object was not found in the SecurityContext, type=org.springframework.security.authentication.AuthenticationCredentialsNotFoundException}]

谷歌搜索错误导致 this site ，它说

This is a another debug level message which occurs the first time an anonymous user attempts to access a protected resource, but when you do not have an AnonymousAuthenticationFilter in your filter chain configuration.

但是，由于我永远无法建立连接，所以似乎有什么根本性的错误。此外，我完全不知道在我的过滤器链配置中放置 AnonymousAuthenticationFilter 的位置，因为我什至不知道在哪里包含过滤器链配置。我该怎么办？

Answer 1

你可以试试这段代码:

    @Override
public void configure(HttpSecurity http) throws Exception {
    http.csrf().disable()
        .anonymous().and()
        .authorizeRequests()
        .antMatchers("/oauth/token").permitAll()
        .antMatchers(HttpMethod.GET,"/gift/**").permitAll();
}