Spring OAuth2 ClientId 作为密码授予类型的用户名传入

Question

我正在尝试 Spring OAuth2 库的非常基本的实现；但是，当我向服务器发送请求时，我收到以下错误:

{
"error": "invalid_client",
"error_description": "Bad client credentials"
}

在进行进一步调试时，我注意到由于某种原因，clientId 在资源所有者流程中作为用户名传入。

我已经包含了我的 XML 配置，并且很好奇是否有人可以告诉我是否有任何问题本质上是错误的或者是否有人有任何建议。

<bean id="tokenStore"
    class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore" />

<bean id="tokenServices"
    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <property name="tokenStore" ref="tokenStore" />
    <property name="supportRefreshToken" value="true" />
    <property name="clientDetailsService" ref="clientDetailsService" />
</bean>

<bean id="oauthAccessDeniedHandler"
    class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

<bean id="clientCredentialsTokenEndpointFilter"
    class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <property name="authenticationManager" ref="authenticationManager" />
</bean>

<bean id="clientAuthenticationEntryPoint"
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <property name="realmName" value="test/client" />
    <property name="typeName" value="Basic" />
</bean>

<security:http pattern="/oauth/token" create-session="stateless"
    authentication-manager-ref="authenticationManager">
    <security:intercept-url pattern="/oauth/token" access="isAuthenticated()" />
    <security:anonymous enabled="false" />
    <security:http-basic entry-point-ref="clientAuthenticationEntryPoint" />
    <!-- include this only if you need to authenticate clients via request 
        parameters -->
    <security:custom-filter ref="clientCredentialsTokenEndpointFilter"
        after="BASIC_AUTH_FILTER" />
    <security:access-denied-handler ref="oauthAccessDeniedHandler" />
    <security:csrf disabled="true"/>
</security:http>

<authorization-server client-details-service-ref="clientDetailsService"
    xmlns="http://www.springframework.org/schema/security/oauth2" token-services-ref="tokenServices" >
    <authorization-code />
    <implicit />
    <refresh-token />
    <client-credentials />
    <password authentication-manager-ref="authenticationManager" />
</authorization-server>

<oauth:resource-server id="resourceFilter" token-services-ref="tokenServices" authentication-manager-ref="authenticationManager" />

<security:authentication-manager id="authenticationManager">
    <security:authentication-provider>
        <security:user-service id="userDetailsService">
            <security:user name="user" password="password" authorities="ROLE_USER" />
        </security:user-service>
    </security:authentication-provider>
</security:authentication-manager>

<client-details-service id="clientDetailsService"
    xmlns="http://www.springframework.org/schema/security/oauth2">
    <oauth:client client-id="my-trusted-client"
        authorized-grant-types="password,authorization_code,refresh_token,implicit"
        scope="read,write,trust" resource-ids="oauth2-resource"
        access-token-validity="60" authorities="ROLE_CLIENT,ROLE_TRUSTED_CLIENT"
        redirect-uri="http://anywhere" />
    <oauth:client client-id="my-client-with-registered-redirect"
        authorized-grant-types="authorization_code" scope="read,trust"
        resource-ids="oauth2-resource" authorities="ROLE_CLIENT"
        redirect-uri="http://anywhere?key=value" />
    <oauth:client client-id="my-client-with-secret" secret="secret"
        authorized-grant-types="password,client_credentials" scope="read"
        resource-ids="oauth2-resource" access-token-validity="60"
        authorities="ROLE_CLIENT" />
</client-details-service>

贝娄也是我发送到服务器的请求，它被编码为“x-www-form-urlencoded”

grant_type:password
client_id:my-client-with-secret
client_secret:secret
username:user
password:password
scope:read write

Answer 1

问题出在这儿:

<bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <property name="authenticationManager" ref="authenticationManager" />
</bean>

我正在传递用户身份验证管理器而不是客户端详细信息身份验证管理器。必须创建一个 ClientDetailsAuthenticationManager 类型的附加 bean 并在 ref 中传递它。