java - 如何设置 PreAuthenticatedAuthenticationProvider？

Question

我一直在尝试让 OAuth 2 适用于我的应用程序，但我仍然遇到与配置相关的错误，特别是涉及身份验证 token 的错误。该应用程序被设置为充当授权服务器和资源服务器。我已成功将其配置为使用密码授予类型和内存中 token 存储来颁发 token 。但是，每次我尝试发送对受限资源的请求时，都会收到错误消息:

org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken

因此，我尝试在我的配置中设置 PreAuthenticationAuthenticationProvider:

@Autowired
private UserDetailsManager userManager;

@Bean
public AuthenticationProvider preAuthenticationAuthenticationProvider() {
    PreAuthenticatedAuthenticationProvider authenticationProvider =
        new PreAuthenticatedAuthenticationProvider();
    UserDetailsByNameServiceWrapper userDetailsWrapper = new UserDetailsByNameServiceWrapper(userManager);
    authenticationProvider.setPreAuthenticatedUserDetailsService(userDetailsWrapper);
    return authenticationProvider;
}

但是，我在奇怪的地方遇到了 NullPointerException，例如:

java.lang.NullPointerException: null
    at org.springframework.security.authentication.AccountStatusUserDetailsChecker.check(AccountStatusUserDetailsChecker.java:17) ~[spring-security-core-4.0.3.RELEASE.jar!/:4.0.3.RELEASE]

我想知道最简单的配置是什么，为什么我首先需要它？是因为我有@PreAuthorize注释吗？

以下是我设置资源服务器的方法:

@Configuration
protected static class ResourceServer extends ResourceServerConfigurerAdapter {

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.tokenStore(tokenStore).authenticationManager(authenticationManager);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        //http configuration
    }

}

TokenStore 只是 InMemoryTokenStore 的一个实例，AuthenticationManager 的设置方式如下:

@Configuration
protected static class WebSecurity extends WebSecurityConfigurerAdapter {

    @Autowired
    protected UserDetailsManager userManager;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(preAuthenticationAuthenticationProvider())
                .userDetailsService(userManager).passwordEncoder(PASSWORD_ENCODER);
    }

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }

    @Bean
    protected AuthenticationProvider preAuthenticationAuthenticationProvider() {
        PreAuthenticatedAuthenticationProvider authenticationProvider =
                new PreAuthenticatedAuthenticationProvider();
        UserDetailsByNameServiceWrapper userDetailsWrapper = new UserDetailsByNameServiceWrapper(userManager);
        authenticationProvider.setPreAuthenticatedUserDetailsService(userDetailsWrapper);
        return authenticationProvider;
    }

}

Answer 1

我缺少的是AuthorizationServiceTokenServices和ResourceServerTokenServices。这两个接口(interface)都是由 Spring 的 DefaultTokenServices 实现的。

@Bean
public DefaultTokenServices tokenServices() {
    DefaultTokenServices tokenServices = new DefaultTokenServices();
    tokenServices.setTokenStore(tokenStore());
    tokenServices.setAuthenticationManager(authenticationManager);
    return tokenServices;
}

在授权服务器配置 (AuthorizationServiceConfigurerAdapter) 中，我进行了以下设置:

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    endpoints.tokenServices(tokenServices()).authenticationManager(authenticationManager);
}

在资源服务器配置中(ResourceServerConfigurerAdapter):

@Autowired
private DefaultTokenServices tokenServices;

@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
    resources.tokenServices(tokenServices);
}

使用所有这些组件，我的应用程序无需定义任何 PreAuthenticationAuthenticationProvider bean 即可运行。