我的 Spring 授权服务器dependency:-
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-authorization-server</artifactId>
<version>1.0.0</version>
</dependency>
授权服务器的SecurityConfig类:-
public class Uncategorized {
@Autowired
private JwtAuthenticationEntryPoint authenticationEntryPoint;
@Bean
@Order(1)
public SecurityFilterChain asSecurityFilterChain(HttpSecurity http) throws Exception {
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
.authorizationEndpoint(a -> a.authenticationProviders(getAuthorizationEndPoints()))
.oidc(Customizer.withDefaults());
http.exceptionHandling(exception -> exception
.authenticationEntryPoint(authenticationEntryPoint));
return http.build();
}
@Bean
@Order(2)
public SecurityFilterChain appSecurityFilterChain(HttpSecurity http) throws Exception {
http.csrf().disable();
http.cors(c -> c.configurationSource(
request -> {
CorsConfiguration config = new CorsConfiguration();
config.addAllowedOrigin(request.getHeader("Origin"));
config.setAllowedMethods(List.of("GET", "POST", "DELETE", "LINK", "UNLINK", "PATCH", "PUT", "OPTIONS"));
config.setAllowedHeaders(List.of("Content-Type, Accept, X-Requested-With, remember-me"));
config.setAllowCredentials(true);
config.setExposedHeaders(List.of("Authorization"));
config.setMaxAge(3600L);
return config;
}
));
http
.httpBasic().disable()
.formLogin().disable()
.authorizeHttpRequests()
.requestMatchers("/authenticate").permitAll()
.anyRequest().authenticated();
return http.build();
}
}
问题:-
1.当我调用下面的API http://localhost:7171/oauth2/authorize?response_type=code&client_id=client&scope=openid&redirect_uri=http://localhost:3000
它抛出
2023-05-16T15:31:51.127+05:30 TRACE 63279 --- [nio-7171-exec-4] o.s.s.w.a.ExceptionTranslationFilter:由于访问被拒绝,正在向身份验证入口点发送AnonymousAuthenticationToken [Principal=anonymousUser,Credentials=[PROTETED],Authenticated=true,Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1,SessionId=null],Granted Authorities=[ROLE_ANONYMOUS]]
org.springframework.security.access.AccessDeniedException:Access Denied at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:98)~[spring-security-web-6.0.3.jar:6.0.3]
1.当我使用formlogin()时,它用于重定向到HTTP://localhost:7171/login并要求用户名和密码,并返回authorization_code,需要在下面输入“http://localhost:7171/oauth2/token”,这给出了OAuth2令牌。如何与UI整合
1.如何编写自定义身份验证来进行身份验证,并且它将给予oauth2令牌?
简而言之,我在没有spring-cloud-gateway的情况下应用它,只是使用授权服务器的简单实现,当客户端应用程序通过API(如http://localhost:7171/oauth2/authorize?response_type=code&client_id=client&scope=openid&redirect_uri=http://localhost:3000
这将重定向到授权服务器登录页面。
如何配置授权服务器,使其能够进行身份验证并向客户端提供authorization_code,以便客户端可以应用http://localhost:7171/oauth2/token来获取auth token?这就是要求
1条答案
按热度按时间hfsqlsce1#
您的授权服务器应该配置为使用form-login(它负责对用户进行身份验证),并且您的体系结构中的OAuth2客户端应该使用
Authorization code
流(使用PKCE)在涉及用户时获取令牌。您的前端不应该访问用户凭据(包含登录和密码的表单)。出于安全原因,
password
和implicit
流都已弃用。OAuth2客户端应该使用一个库来存储令牌,并处理您正在处理的所有重定向。
目前至少有两个选项可以定义什么是OAuth2客户端:
Bearer
访问令牌的Authorization
报头替换会话cookie第二个选项现在经常被首选,因为:
HttpOnly
)spring-cloud-gateway
可以配置为BFF:使用spring-boot-starter-oauth2-client
和TokenRelay
滤波器。我写了一个教程there。