java-在Spring Security Oauth2中使用RemoteTokenServices配置资源服务器
内容导读
互联网集市收集整理的这篇技术教程文章主要介绍了java-在Spring Security Oauth2中使用RemoteTokenServices配置资源服务器,小编现在分享给大家,供广大互联网技能从业者学习和参考。文章包含4800字,纯文字阅读大概需要7分钟。
内容图文
我正在尝试使用spring security oauth2实现授权服务器和资源服务器.到目前为止,我已经成功设置了授权服务器,并且由于我不想共享jdbc令牌存储,因此我试图使用remoteTokenService来验证我的令牌@资源服务器.但是,每次尝试访问资源REST方法时,我都会收到401错误.
由于项目的性质,我使用xml配置来设置spring安全性.我已经尝试了另一个使用Javaconfig的示例项目,并且它的工作正常.
这是我在资源服务器中的配置.
web.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0" metadata-complete="true">
<display-name>rest-project</display-name>
<description>rest project Implementation</description>
<!--
- Location of the XML file that defines the root application context.
- Applied by ContextLoaderListener.
-->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring/*.xml</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!--
- Servlet that dispatches request to registered handlers (Controller implementations).
-->
<servlet>
<servlet-name>dispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring/mvc-core-config.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>dispatcher</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
</web-app>
这是我的security-config.xml
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:oauth2="http://www.springframework.org/schema/security/oauth2"
xmlns:p="http://www.springframework.org/schema/p"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd">
<http pattern="/cards/**" use-expressions="true" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint">
<anonymous enabled="false"/>
<intercept-url pattern="/cards/**" access="isAuthenticated()" requires-channel="https"/>
<access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>
<oauth2:resource-server id="resourceServerFilter" resource-id="connector-bus" token-services-ref="tokenServices"/>
<beans:bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.RemoteTokenServices">
<beans:property name="checkTokenEndpointUrl" value="https://localhost:8443/auth-server/api/oauth/check_token"/>
<beans:property name="clientId" value="123456" />
<beans:property name="clientSecret" value="456"/>
</beans:bean>
<authentication-manager>
<authentication-provider>
<user-service>
<user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
</user-service>
</authentication-provider>
</authentication-manager>
<beans:bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"/>
<beans:bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
</beans:beans>
请指出我在这里想念的东西.
提前致谢.
解决方法:
由于某种原因,我无法使xml配置有效地远程验证访问令牌.但是我能够使用java config设置oauth2资源服务器,它解决了该问题.请在下面找到代码.
@Configuration
@EnableWebSecurity
@EnableResourceServer
public class Oauth2ResesourceServerConfiguration extends ResourceServerConfigurerAdapter{
@Override
public void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers(HttpMethod.GET,"/api/**").access("#oauth2.hasScope('read')");
}
@Primary
@Bean
public RemoteTokenServices tokenService() {
RemoteTokenServices tokenService = new RemoteTokenServices();
tokenService.setCheckTokenEndpointUrl(
"https://localhost:8443/auth-server/oauth/check_token");
tokenService.setClientId("client-id");
tokenService.setClientSecret("client-secret");
return tokenService;
}
}
内容总结
以上是互联网集市为您收集整理的java-在Spring Security Oauth2中使用RemoteTokenServices配置资源服务器全部内容,希望文章能够帮你解决java-在Spring Security Oauth2中使用RemoteTokenServices配置资源服务器所遇到的程序开发问题。 如果觉得互联网集市技术教程内容还不错,欢迎将互联网集市网站推荐给程序员好友。
内容备注
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 gblab@vip.qq.com 举报,一经查实,本站将立刻删除。
内容手机端
扫描二维码推送至手机访问。