java - 如何使用 spring-boot 1.3.0.RC1 为 oauth2 提供自定义安全配置

Question

随着 spring-cloud Angel.SR3 版本的发布，我遵循 https://github.com/spring-cloud-samples/sso 中的示例使用 spring-boot 1.2.6.RELEASE 一切正常。

但是，在 spring-boot 1.3.0.RC1 中，oauth2 内容已移至 spring-boot 本身，并且下面的代码无法编译，因为类 OAuth2SsoConfigurerAdapter 不再存在。

spring-boot 创建等效配置的唯一方法是什么？

public static void main(String[] args) {
    SpringApplication.run(MainAppApplication.class, args);
}

...

@Component
public static class LoginConfigurer extends OAuth2SsoConfigurerAdapter  {

    @Override
    public void match(RequestMatchers matchers) {
        matchers.antMatchers("/dashboard/**");
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/dashboard/**").authorizeRequests().anyRequest()
        .authenticated().and().csrf()
        .csrfTokenRepository(csrfTokenRepository()).and()
        .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
    }

    private Filter csrfHeaderFilter() {
        return new OncePerRequestFilter() {
    ...
        };
    }

    ...

}

Answer 1

您只需使用org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter并小心使用此注释org.springframework.boot.autoconfigure.security.oauth2。 client.EnableOAuth2Sso

我仔细地写了，因为它的行为取决于您添加它的位置。正如 javadoc 中所述:

Enable OAuth2 Single Sign On (SSO). If there is an existing WebSecurityConfigurerAdapter provided by the user and annotated with @EnableOAuth2Sso, it is enhanced by adding an authentication filter and an authentication entry point. If the user only has @EnableOAuth2Sso but not on a WebSecurityConfigurerAdapter then one is added with all paths secured and with an order that puts it ahead of the default HTTP Basic security chain in Spring Boot.

希望有帮助!