春季启动oauth2“/ auth/oauth/token”禁止

我正在设置一个基本的oauth2授权服务器。这是我的应用程序配置。春季启动oauth2“/ auth/oauth/token”禁止

@SpringBootApplication 
@RestController 
@EnableResourceServer 
@EnableAuthorizationServer 
public class Application { 

    @RequestMapping(value = { "/user" }, produces = "application/json") 
    public Map<String, Object> user(OAuth2Authentication user) { 
     Map<String, Object> userInfo = new HashMap<>(); 
     userInfo.put("user", user.getUserAuthentication().getPrincipal()); 
     userInfo.put("authorities", AuthorityUtils.authorityListToSet(user.getUserAuthentication().getAuthorities())); 
     return userInfo; 
    } 


    public static void main(String[] args) { 
     SpringApplication.run(Application.class, args); 
    } 


}

WebSecurityConfigurer

import org.springframework.context.annotation.Bean; 
import org.springframework.context.annotation.Configuration; 
import org.springframework.security.authentication.AuthenticationManager; 
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; 
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; 
import org.springframework.security.core.userdetails.UserDetailsService; 


    @Configuration 
    public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter { 
     @Override 
     @Bean 
     public AuthenticationManager authenticationManagerBean() throws Exception { 
      return super.authenticationManagerBean(); 
     } 

     @Override 
     @Bean 
     public UserDetailsService userDetailsServiceBean() throws Exception { 
      return super.userDetailsServiceBean(); 
     } 


     @Override 
     protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
      auth 
        .inMemoryAuthentication() 
        .withUser("john.carnell").password("password1").roles("USER") 
        .and() 
        .withUser("william.woodward").password("password2").roles("USER", "ADMIN"); 
     } 
    }

和我Oauth2Config

@Configuration 
public class OAuth2Config extends AuthorizationServerConfigurerAdapter { 

    @Autowired 
    private AuthenticationManager authenticationManager; 

    @Autowired 
    private UserDetailsService userDetailsService; 

    @Override 
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
     clients.inMemory() 
       .withClient("eagleeye") 
       .secret("thisissecret") 
       .authorizedGrantTypes("refresh_token", "password", "client_credentials") 
       .scopes("webclient", "mobileclient"); 
    } 

    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { 
     endpoints 
       .authenticationManager(authenticationManager) 
       .userDetailsService(userDetailsService); 
    } 
}

我正在尝试从本地主机令牌：8080/auth /中的OAuth /令牌使用邮递员，但它只是抛出这个错误。

{ 
    "error": "unauthorized", 
    "error_description": "Full authentication is required to access this resource" 
}

，这里是我从邮递员

来源

2017-04-05 user962206

也许您缺少对http调用的身份验证？如果添加了@Override protected void configure（HttpSecurity http）会引发异常http.authorizeRequests（）。anyRequest（）。authenticated（）。和（） .httpBasic（）; }'到'WebSecurityConfigurer'？（很难说没有日志，我想'@ EnableResourceServer'已经为你做了这个） – ninj

将client_id和grant_type添加到postman中的post请求的URL中。如：.../oauth/token？client_id = eagleeye＆grant_type = password。 – Johna

我能够访问端点传递价值，但它返回一个错误，不过这是另外一个问题。我只是将网址从localhost:8080/auth/oauth/toke更改为localhost:8080/oauth/token

来源

2017-04-05 22:57:39 user962206

春季启动oauth2“/ auth/oauth/token”禁止

回答

相关问题