我正在尝试使用 spring boot 和 spring security 创建一个 Rest API。 以下是我为获取授权 token 所做的代码更改的详细信息:-
1]授权服务器配置
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private TokenStore tokenStore;
@Autowired
private UserApprovalHandler userApprovalHandler;
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
.authenticationManager(authenticationManager);
}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory().withClient("my-trusted-client")
.authorizedGrantTypes("client_credentials", "password", "refresh_token" )
.authorities("ROLE_CLIENT").scopes("read","write","trust")
.secret("secret")
.accessTokenValiditySeconds(5000)
.refreshTokenValiditySeconds(6000).autoApprove(true);
}
@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
security.checkTokenAccess("isAuthenticated()");
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
@Bean
@Autowired
public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
handler.setTokenStore(tokenStore);
handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
handler.setClientDetailsService(clientDetailsService);
return handler;
}
@Bean
@Autowired
public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
TokenApprovalStore store = new TokenApprovalStore();
store.setTokenStore(tokenStore);
return store;
}
}
2]资源服务器配置
@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
private static final String RESOURCE_ID = "my_rest_api";
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.resourceId(RESOURCE_ID).stateless(false);
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.headers().frameOptions().disable().and()
.authorizeRequests()
.antMatchers("/register").permitAll()
.antMatchers("/ex/**").authenticated();
}
}
3]方法安全配置
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
@SuppressWarnings("unused")
@Autowired
private OAuth2SecurityConfiguration securityConfig;
@Override
protected MethodSecurityExpressionHandler createExpressionHandler() {
return new OAuth2MethodSecurityExpressionHandler();
}
}
当我通过 postman 发出请求时,会返回以下响应:-
请求网址:-
http://localhost:8090/oauth/token?grant_type=client_credentials&username=sr7&password=aA$gm12
收到的回复:-
{
"access_token": "6e55f38f-4aad-4e84-97d2-24b30d39bf5e",
"token_type": "bearer",
"expires_in": 4999,
"scope": "read write trust"
}
请帮助我找出我在这里做错了什么,这导致我无法获得刷新 token 和响应。
提前致谢。
最佳答案
As per the specification在“客户端凭据”授予类型的情况下,您通常(“不应该”,使用规范术语)没有刷新 token 。引用this answer by @chenrui :
client_credentials OAuth grant servers the need of machine-to-machine authentication, so there is no need to refresh the token.
As result, in Spring Security OAuth's
ClientCredentialsAccessTokenProvider
,supportsRefresh
returnsfalse
andrefreshToken
methods returnsnull
.
在“客户端凭据”中,裸客户端凭据用于获取访问 token 。
推荐阅读:
关于java - spring的oauth/token响应中不返回刷新 token ,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/46232331/