应用程序有一个通过WebSecurity配置全局配置的用户详细信息服务。它用于资源的所有者身份验证。

我已将授权服务器配置为使用内存存储对客户端进行身份验证,如下所示:

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory()
        .withClient("devglan-client")
        .secret("$2a$04$e/c1/RfsWuThaWFCrcCuJeoyvwCV0URN/6Pn9ZFlrtIWaU/vj/BfG")
        .authorizedGrantTypes("implicit","refresh_token", "password", "authorization_code")
        .scopes("read write trust");

}

问题是:

当我尝试使用get authorize端点获取授权代码时,Spring安全性将尝试使用用户详细信息服务对应用程序客户端进行身份验证。

我在请求中包含一个HTTP授权头和包含cliend_id:client_secret凭据的Basic选项。

GET /oauth/authorize? 
response_type=code&client_id=bpclient&scope=read HTTP/1.1
Host: localhost:8080
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Authorization: Basic ZGV2Z2xhbi1jbGllbnQ6MTIzNDU2
Cache-Control: no-cache
Postman-Token: 77dd0129-bb86-d039-d252-8e7d483092f2

问题

为什么Spring OAuth使用用户详细信息服务来验证OAuth授权流中的应用程序客户端,而不是内存中的配置?

Pom.xml文件

<dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
</dependency>

<dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-data-rest</artifactId>
</dependency>

<dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<dependency>
     <groupId>org.springframework.security.oauth.boot</groupId>
     <artifactId>spring-security-oauth2-autoconfigure</artifactId>
     <version>2.0.4.RELEASE</version>
 </dependency>

  <dependency>
         <groupId>org.springframework.security</groupId>
          <artifactId>spring-security-oauth2-client</artifactId>
   </dependency>

   <dependency>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-oauth2-jose</artifactId>
   </dependency>

主应用程序

@SpringBootApplication()
@EnableAutoConfiguration
public class Application extends RepositoryRestConfigurerAdapter{

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
} 

授权服务器配置:

@Configuration
@EnableAuthorizationServer
public class ServidorAutorizacaoOAuthConfiguracao extends AuthorizationServerConfigurerAdapter  {

    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("devglan-client")
                .secret("$2a$04$e/c1/RfsWuThaWFCrcCuJeoyvwCV0URN/6Pn9ZFlrtIWaU/vj/BfG")
                 .authorizedGrantTypes("implicit","refresh_token", "password", "authorization_code")
                .scopes("read write trust");

    }

} 

Web安全配置:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class SegurancaConfiguracao extends WebSecurityConfigurerAdapter{

    @Autowired
    private UsuarioServico usuarioServico;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(this.usuarioServico).passwordEncoder(encoder());
    }


    public PasswordEncoder encoder() {
        return new BCryptPasswordEncoder();
    }   

资源服务器配置:

@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ServidorRecursoOAuthConfiguracao extends 
ResourceServerConfigurerAdapter  {

 public void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests()
               .antMatchers("/api/**").authenticated()
               .antMatchers("/oauth2/authorization/google", "/login/oauth2/code/google", "/login").permitAll()
               .antMatchers("/oauth/authorize").permitAll()
               .anyRequest().permitAll()
            .and()
                .formLogin()
            .and()
                .oauth2Login()
            .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

}