如何正确地将Oauth2服务器设置为Spring现有的API？

Question

我正在实现一个Oauth2服务器到现有的REST api中，以增加它的某些部分的安全性。 问题是：如果我没有在主类中声明ResourceServer和AuthorizationServer的@configuration，那么spring安全性不会加载配置，所以我无法访问API。

我想把这个配置放在一个外部类中的不同包中，但我对Spring很新，而且我找不到适当的方法。

所以我的外部配置文件，如果他的内容是主类内，但如果没有一个外部文件的作品：

SecurityConf.java

@RestController 
@Configuration 
public class Security { 

@RequestMapping("/") 
public String home() { 
    return "Hello World"; 
} 

@Configuration 
@EnableResourceServer 
protected static class ResourceServer extends ResourceServerConfigurerAdapter { 

    @Override 
    public void configure(HttpSecurity http) throws Exception { 
     // @formatter:off 
     http 

      .authorizeRequests() 
          .antMatchers("/features/**").permitAll() 
          .antMatchers("/itineraries/**").permitAll() 



      .anyRequest().access("#oauth2.hasScope('read')"); //This makes all other petitions under authorization 

    } 

    @Override 
    public void configure(ResourceServerSecurityConfigurer resources) 
      throws Exception { 
     resources.resourceId("sparklr"); 
    } 

} 

@Configuration 
@EnableAuthorizationServer 
protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter { 

    @Autowired 
    private AuthenticationManager authenticationManager; 

    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) 
      throws Exception { 
     endpoints.authenticationManager(authenticationManager); 
    } 

    @Override 
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
     // @formatter:off 
     clients.inMemory().withClient("my-trusted-client") 
       .authorizedGrantTypes("password", "authorization_code", 
         "refresh_token", "implicit") 
       .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT") 
       .scopes("read", "write", "trust").resourceIds("sparklr") 
       .accessTokenValiditySeconds(60).and() 
       .withClient("my-client-with-registered-redirect") 
       .authorizedGrantTypes("authorization_code").authorities("ROLE_CLIENT") 
       .scopes("read", "trust").resourceIds("sparklr") 
       .redirectUris("http://anywhere?key=value").and() 
       .withClient("my-client-with-secret") 
       .authorizedGrantTypes("client_credentials", "password") 
       .authorities("ROLE_CLIENT").scopes("read").resourceIds("sparklr") 
       .secret("secret"); 
     // @formatter:on 
    } 

} 

} 

和主类，

Application.java

@Configuration 
@EnableConfigurationProperties 
@ComponentScan(basePackageClasses = SimpleCORSFilter.class) 
@EnableAutoConfiguration 
@EntityScan(basePackages = "com.pace.things.model") 
public class Application { 
    @Bean 
    public FilterRegistrationBean filterRegistrationBean() { 
     FilterRegistrationBean registrationBean = new FilterRegistrationBean(); 
     CharacterEncodingFilter characterEncodingFilter = new CharacterEncodingFilter(); 
     registrationBean.setFilter(characterEncodingFilter); 
     characterEncodingFilter.setEncoding("UTF-8"); 
     characterEncodingFilter.setForceEncoding(true); 
     registrationBean.setOrder(Integer.MIN_VALUE); 
     registrationBean.addUrlPatterns("/*"); 
     return registrationBean; 
}  


    public static void main(String[] args) { 
      SpringApplication application = new SpringApplication(Application.class); 
    SpringApplication.run(Application.class, args); 
    } 
} 

那么我忘记了什么？提前

感谢

Answer 1

Referenced thread：

我需要的WebSecurityConfig添加到应用程序上下文中添加此行的主要类声明：

... 
@Import(WebSecurityConfig.class) 
public class Application { 
... 

我做的另一件事是升级SpringBoot到1.4.3.RELEASE并将主应用程序放到根文件夹中：

<parent> 
     <groupId>org.springframework.boot</groupId> 
     <artifactId>spring-boot-starter-parent</artifactId> 
     <version>1.4.3.RELEASE</version> 
     <relativePath/> <!-- lookup parent from repository --> 
    </parent> 

树会，例如：

└── com 
└── app 
    ├── Application.java 
    └── config 
     └── WebSecurityConfig.java 

这会自动加载所有@Configuration在儿子的文件夹。