Spring Security 5 OAuth2 客户端密码授予类型

Question

我有 2 个应用程序:

Spring Application 1 是客户端和资源服务器。

Spring Application 2 是授权服务器。

用户将能够登录应用程序 1 并访问其资源。
我想实现以下流程:

用户在登录表单中输入他的凭据 -> 应用程序 1 将使用用户凭据及其 clientId 从应用程序 2 获取 token 使用密码授予类型 -> 使用 token 访问应用程序 1 的资源。

问题是 Spring Security 5 是否支持客户端的密码授予类型？我在 Spring Security 5 实现中找到了所有剩余授权类型，但没有找到密码。

Answer 1

Spring Security 5.1.x 不支持，见 Spring Security Reference :

6.6 OAuth 2.0 Client

The OAuth 2.0 Client features provide support for the Client role as defined in the OAuth 2.0 Authorization Framework.

The following main features are available:

• Authorization Code Grant
• Client Credentials Grant
• WebClient extension for Servlet Environments (for making protected resource requests)

HttpSecurity.oauth2Client() provides a number of configuration options for customizing OAuth 2.0 Client.

但是，您可以使用 Spring Security OAuth2，参见 OAuth 2 Developers Guide :

Accessing Protected Resources

As a general rule, a web application should not use password grants, so avoid using ResourceOwnerPasswordResourceDetails if you can in favour of AuthorizationCodeResourceDetails. If you desparately need password grants to work from a Java client, then use the same mechanism to configure your OAuth2RestTemplate and add the credentials to the AccessTokenRequest (which is a Map and is ephemeral) not the ResourceOwnerPasswordResourceDetails (which is shared between all access tokens).

或者你可以更新到 Spring Security 5.2.x，见 Spring Security Reference :

11.2 OAuth 2.0 Client

The OAuth 2.0 Client features provide support for the Client role as defined in the OAuth 2.0 Authorization Framework.

At a high-level, the core features available are:

Authorization Grant support

• Authorization Code
• Refresh Token
• Client Credentials
• Resource Owner Password Credentials