spring-boot - Spring Boot 2.0.0 + OAuth2

Question

Spring Boot 2 + Sping Security OAuth2 是否仍然支持 @AuthorizationServer注解？通过阅读发行说明，有些事情还没有被移植:

Oauth2 Support

这是我的build.grade的相关部分:

认证服务器

// security
compile "org.springframework.boot:spring-boot-starter-security:${springBootVersion}"
// oauth
// https://mvnrepository.com/artifact/org.springframework.security.oauth/spring-security-oauth2
compile "org.springframework.security.oauth:spring-security-oauth2:2.2.1.RELEASE"

客户端服务器

// support for Oauth2 user token services not yet migrated into Spring Boot 2.0
compile "org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure:2.0.1.BUILD-SNAPSHOT"

现在，当我尝试将客户端 ID 和客户端 secret 作为 Basic Authentication 传递时，我的授权服务器 Oauth2 端点仅返回 401。至 /oauth/token .传入用户名和密码会给出不同的代码路径。所以看起来 OAuth 过滤器并没有完全排列好。

我也发现了这个: Spring Boot 2 OAuth2 starter changes .

是否有配置更新，或者我是否需要一组不同的 gradle 依赖项来将授权服务器恢复到以前的状态？

谢谢!

更新

我想结束这个问题的循环。除了加密客户端 secret 。从 Spring OAuth 2.3.2 开始，RedisTokenStore 问题也已解决: Spring OAuth 2.3.2

Answer 1

Spring Security 5 使用现代化的密码存储，参见 OAuth2 Autoconfig :

If you use your own authorization server configuration to configure the list of valid clients through an instance of ClientDetailsServiceConfigurer as shown below, take note that the passwords you configure here are subject to the modernized password storage that came with Spring Security 5.

要解决您的问题，请参阅 Spring Security Reference :

Troubleshooting

The following error occurs when one of the passwords that are stored has no id as described in the section called “Password Storage Format”.

java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id "null"
     at org.springframework.security.crypto.password.DelegatingPasswordEncoder$UnmappedIdPasswordEncoder.matches(DelegatingPasswordEncoder.java:233)
     at org.springframework.security.crypto.password.DelegatingPasswordEncoder.matches(DelegatingPasswordEncoder.java:196)

The easiest way to resolve the error is to switch to explicitly provide the PasswordEncoder that you passwords are encoded with. The easiest way to resolve it is to figure out how your passwords are currently being stored and explicitly provide the correct PasswordEncoder. If you are migrating from Spring Security 4.2.x you can revert to the previous behavior by exposing a NoOpPasswordEncoder bean. For example, if you are using Java Configuration, you can create a configuration that looks like:

Reverting to NoOpPasswordEncoder is not considered to be secure. You should instead migrate to using DelegatingPasswordEncoder to support secure password encoding.

@Bean
public static NoOpPasswordEncoder passwordEncoder() {
    return NoOpPasswordEncoder.getInstance();
}

if you are using XML configuration, you can expose a PasswordEncoder with the id passwordEncoder:

<b:bean id="passwordEncoder"
   class="org.springframework.security.crypto.NoOpPasswordEncoder" factory-method="getInstance"/>

Alternatively, you can prefix all of your passwords with the correct id and continue to use DelegatingPasswordEncoder. For example, if you are using BCrypt, you would migrate your password from something like:

$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG

to

{bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG