spring security oauth2（2.0.8）获取InMemory令牌库使用的无效访问令牌

2 回答

• 0

  从资源API看起来，您在请求参数中传递access_token . 您必须在请求标头中传递access_token，如下所示：

  Authorization: Bearer <access_token>

  cURL example :

  curl -X GET -H "Authorization: Bearer 89af6541-f87f-4c63-be6d-6012426bb745" -H "Cache-Control: no-cache" "http://localhost:8080/xapp/data/product/api/index"

  回复于 2024-04-27T15:49:08+08:00
• 1

  要解决无效访问令牌：

  • 我们将存储类型从InMemory更改为数据库存储（JdbcTokenStore） .

  为所有http标签添加了rememberMeServices，其中spring security URL应该在applicationContext-security.xml中受到保护 .

  <remember-me key="xAppWebClient" services-ref="rememberMeServices" />
  <custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
  

  applicationContext-security.xml更改：

  <?xml version="1.0" encoding="UTF-8"?>
  <beans:beans 
     xmlns="http://www.springframework.org/schema/security" 
     xmlns:beans="http://www.springframework.org/schema/beans"
     xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                         http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd 
                         http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2.xsd">
  
        <http pattern="/Index" security="none" />
  
      <!--This is where we tells spring security what URL should be protected 
          and what roles have access to them -->
  
      <http pattern="/data/**" entry-point-ref="oauthAuthenticationEntryPoint"
          create-session="never" xmlns="http://www.springframework.org/schema/security"
          use-expressions="true">
          <anonymous enabled="false" />       
          <access-denied-handler ref="oauthAccessDeniedHandler" />    
          <intercept-url pattern="/data/**" access="isAuthenticated()" />         
          <remember-me key="XappWebClient" services-ref="rememberMeServices" />
          <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
        <custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
      </http> 
  
      <http pattern="/oauth/token" create-session="stateless"
          use-expressions="true" authentication-manager-ref="authenticationManager">
          <intercept-url pattern="/oauth/token" access="isAuthenticated()" />
          <anonymous enabled="false" />
          <custom-filter ref="clientCredentialsTokenEndpointFilter"
              before="BASIC_AUTH_FILTER" />
          <access-denied-handler ref="oauthAccessDeniedHandler" />
          <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
          <remember-me key="XappWebClient" services-ref="rememberMeServices" />
        <custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
      </http>
  
     <http use-expressions="true" disable-url-rewriting="true" entry-point-ref="authenticationChooser">
        <!-- /servlets -->      
        <intercept-url pattern="/**" access="isAuthenticated()" />
        <intercept-url pattern="/" access="isAuthenticated()" />
        <form-login login-page="/login" authentication-failure-url="/login?login_error=1" authentication-success-handler-ref="authSuccessHandler"/>
        <logout logout-url="/logout" logout-success-url="/login" />
        <remember-me key="XappWebClient" services-ref="rememberMeServices" />
        <custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
     </http>
  
      <beans:bean id="oauthAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
          <beans:property name="realmName" value="Xapp" />
      </beans:bean>
  
      <beans:bean id="clientAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">      
          <beans:property name="typeName" value="Basic" />
      </beans:bean>
  
      <beans:bean id="oauthAccessDeniedHandler"
          class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
  
      <beans:bean id="clientCredentialsTokenEndpointFilter"
          class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
          <beans:property name="authenticationManager" ref="authenticationManager" />
      </beans:bean>   
  
      <beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
            xmlns="http://www.springframework.org/schema/beans">
          <beans:constructor-arg>
              <beans:list>
                  <beans:bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/>
                  <beans:bean class="org.springframework.security.access.vote.RoleVoter"/>
                  <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
              </beans:list>
          </beans:constructor-arg>
      </beans:bean>
  
      <beans:bean id="clientDetailsUserService"
          class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
          <beans:constructor-arg ref="clientDetails" />
      </beans:bean>
  
      <!-- This defined token store, we have used JdbcTokenStore insted of inmemory tokenstore-->
      <beans:bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
          <beans:constructor-arg name="dataSource" ref="dataSource" />
      </beans:bean>
  
      <beans:bean id="dataSource" class="org.springframework.jndi.JndiObjectFactoryBean">
          <beans:property name="jndiName">
              <beans:value>jdbc/XappDS</beans:value>
          </beans:property>
      </beans:bean>
  
      <!-- This is where we defined token based configurations, token validity 
          and other things -->  
      <beans:bean id="tokenServices"
          class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
          <beans:property name="tokenStore" ref="tokenStore" />
          <beans:property name="supportRefreshToken" value="true" />
          <beans:property name="clientDetailsService" ref="clientDetails" />
      </beans:bean>
  
      <beans:bean id="userApprovalHandler"
          class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
          <beans:property name="tokenStore" ref="tokenStore" />
          <beans:property name="requestFactory" ref="oAuth2RequestFactory" />
      </beans:bean>
  
      <beans:bean id="oAuth2RequestFactory"
          class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
          <beans:constructor-arg ref="clientDetails" />
      </beans:bean>
  
      <beans:bean id="approvalStore" class="org.springframework.security.oauth2.provider.approval.TokenApprovalStore">
          <beans:property name="tokenStore" ref="tokenStore"/>
      </beans:bean>
  
         <!-- OAuth2 Authorization Server -->
      <oauth:authorization-server client-details-service-ref="clientDetails"
                                  token-services-ref="tokenServices"
                                  user-approval-handler-ref="userApprovalHandler">
          <oauth:authorization-code/>
          <oauth:implicit/>
          <oauth:refresh-token/>
          <oauth:client-credentials/>
          <oauth:password authentication-manager-ref="authenticationManager"/>
      </oauth:authorization-server>
  
      <oauth:resource-server id="resourceServerFilter"
           token-services-ref="tokenServices" />
  
      <oauth:client-details-service id="clientDetails">
          <oauth:client client-id="Xapp"
              authorized-grant-types="password,authorization_code,refresh_token,implicit"
              secret="Xapp" scope="read,write,trust" authorities="Administrator" access-token-validity="300" refresh-token-validity="600"/>   
      </oauth:client-details-service>
  
      <authentication-manager  alias="authenticationManager">
      <authentication-provider ref="jaasAuthenticationProvider" />
      <authentication-provider user-service-ref="clientDetailsUserService"/>
      </authentication-manager>
  
     <beans:bean id="rememberMeServices"
        class="com.Xapp.Xapp.web.authentication.rememberme.RememberMeServices">
        <beans:property name="userDetailsService" ref="userDetailsService" />
        <beans:property name="key" value="XappWebClient" />
     </beans:bean>
  
     <beans:bean id="jaasNameCallBackHandler" 
        class="com.Xapp.Xapp.web.authentication.XappNameCallbackHandler">
        <beans:property name="userDetailsService" ref="userDetailsService" />
        <beans:property name="callbackHandler">
           <beans:bean class="org.springframework.security.authentication.jaas.JaasNameCallbackHandler"/>
        </beans:property>
     </beans:bean>
  
     <beans:bean id="jaasAuthenticationProvider" 
        class="org.springframework.security.authentication.jaas.JaasAuthenticationProvider">
        <beans:property name="refreshConfigurationOnStartup" value="false"/> 
        <beans:property name="loginConfig" value="/WEB-INF/login.conf" />
        <beans:property name="loginContextName" value="Xapp" />
        <beans:property name="callbackHandlers">
           <beans:list>
              <beans:ref bean="jaasNameCallBackHandler" />
              <beans:bean class="org.springframework.security.authentication.jaas.JaasPasswordCallbackHandler" />
           </beans:list>
        </beans:property>
        <beans:property name="authorityGranters">
           <beans:list>
              <beans:bean class="com.Xapp.Xapp.web.authentication.XappAuthorityGranter" />
           </beans:list>
        </beans:property>
     </beans:bean>
  
     <beans:bean id="userDetailsService" class="com.Xapp.Xapp.web.authentication.XappUserDetailsService">
     </beans:bean>
  
     <beans:bean id="jbossSecurityFilter" class="com.Xapp.Xapp.web.authentication.JBossSecurityFilter">
        <beans:property name="clientLoginDomain" value="client-login" />
        <beans:property name="callbackHandler">
           <beans:bean class="com.Xapp.Xapp.web.authentication.SecurityContextHolderAwareCallbackHandler" />
        </beans:property>
     </beans:bean>
  
     <beans:bean id="authSuccessHandler"
        class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
        <beans:property name="redirectStrategy" ref="XappRedirectStrategy"></beans:property>
     </beans:bean>
  
     <beans:bean id="XappRedirectStrategy"
        class="com.Xapp.Xapp.web.authentication.XappRedirectStrategy">
     </beans:bean>
  
     <beans:bean id="formAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <beans:property name="loginFormUrl" value="/login" />
     </beans:bean>
  
     <beans:bean id="authenticationChooser" class="org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint">
        <beans:constructor-arg>
           <beans:map>
               <beans:entry key="#{new com.Xapp.Xapp.web.authentication.DataRequestMatcher()}" value-ref="oauthAuthenticationEntryPoint" />
           </beans:map>
        </beans:constructor-arg>
        <beans:property name="defaultEntryPoint" ref="formAuthenticationEntryPoint" />
     </beans:bean>
  </beans:beans>
  

  • 我们尝试的另一种方式是使用JwtTokenStore，它是内存的绝佳替代品 . 像xml一样配置：

  <http pattern="/login*" security="none" />
    <http pattern="/*.html" security="none" />
    <http pattern="/*.pdf" security="none" />
    <http pattern="/Index" security="none" />
  
  <!-- This is where we tells spring security what URL should be protected 
      and what roles have access to them -->
  <http pattern="/restdata/**" entry-point-ref="oauthAuthenticationEntryPoint"
      create-session="stateless" xmlns="http://www.springframework.org/schema/security"
      use-expressions="true">
      <anonymous enabled="false" />
      <access-denied-handler ref="oauthAccessDeniedHandler" />
      <intercept-url pattern="/restdata/**" access="isAuthenticated()" />
      <remember-me key="XappWebClient" services-ref="rememberMeServices" />
      <custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
      <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
  </http>
  
  <http pattern="/oauth/token" create-session="stateless"
      use-expressions="true" authentication-manager-ref="authenticationManager">
      <intercept-url pattern="/oauth/token" access="isAuthenticated()" />
      <anonymous enabled="false" />
      <custom-filter ref="clientCredentialsTokenEndpointFilter"
          before="BASIC_AUTH_FILTER" />
      <access-denied-handler ref="oauthAccessDeniedHandler" />
      <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
      <remember-me key="XappWebClient" services-ref="rememberMeServices" />
      <custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
  </http>
  
  <http use-expressions="true" disable-url-rewriting="true"
      entry-point-ref="authenticationChooser">
      <intercept-url pattern="/**" access="isAuthenticated()" />
      <intercept-url pattern="/" access="isAuthenticated()" />
      <form-login login-page="/login" authentication-failure-url="/login?login_error=1"
          authentication-success-handler-ref="authSuccessHandler" />
      <logout logout-url="/logout" logout-success-url="/login" />
      <remember-me key="XappWebClient" services-ref="rememberMeServices" />
      <custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
      <custom-filter ref="myFilter" position="PRE_AUTH_FILTER" /> <!--Custom filter intercepts the login request from web client and authorize the user using oauth token request-->
  </http>
  
  <beans:bean id="myFilter"
      class="com.Xapp.Xapp.web.authentication.XappPreAuthenticationFilter">
      <beans:property name="authenticationManager" ref="authenticationManager" />
  </beans:bean>
  
  <beans:bean id="oauthAuthenticationEntryPoint"
      class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
      <beans:property name="realmName" value="Xapp" />
  </beans:bean>
  
  <beans:bean id="clientAuthenticationEntryPoint"
      class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
      <!--  <beans:property name="realmName" value="Xapp" /> -->
      <beans:property name="typeName" value="Basic" />
  </beans:bean>
  
  <beans:bean id="oauthAccessDeniedHandler"
      class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
  
  <beans:bean id="clientCredentialsTokenEndpointFilter"
      class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
      <beans:property name="authenticationManager" ref="authenticationManager" />
  </beans:bean>   
  
  <beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
        xmlns="http://www.springframework.org/schema/beans">
      <beans:constructor-arg>
          <beans:list>
              <beans:bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/>
              <beans:bean class="org.springframework.security.access.vote.RoleVoter"/>
              <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
          </beans:list>
      </beans:constructor-arg>
  </beans:bean>
  
  <beans:bean id="clientDetailsUserService"
      class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
      <beans:constructor-arg ref="clientDetails" />
  </beans:bean>
  
  <beans:bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JwtTokenStore">
      <beans:constructor-arg ref="jwtTokenEnhancer" />
  </beans:bean>
  
  <beans:bean id="jwtTokenEnhancer" class="org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter">
      <beans:property name="signingKey" value="Xapp" />
      <beans:property name="accessTokenConverter" ref="tokenConverter" />
  </beans:bean>   
  
  <!-- define token based configurations, token validity and other things -->  
  <beans:bean id="tokenServices"
      class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
      <beans:property name="tokenStore" ref="tokenStore" />
      <beans:property name="supportRefreshToken" value="true" />
      <beans:property name="clientDetailsService" ref="clientDetails" />
      <beans:property name="tokenEnhancer" ref="jwtTokenEnhancer" />
  </beans:bean>
  
  <beans:bean id="userApprovalHandler"
      class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
      <beans:property name="tokenStore" ref="tokenStore" />
      <beans:property name="requestFactory" ref="oAuth2RequestFactory" />
  </beans:bean>
  
  <beans:bean id="oAuth2RequestFactory"
      class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
      <beans:constructor-arg ref="clientDetails" />
  </beans:bean>
  
  <beans:bean id="approvalStore" class="org.springframework.security.oauth2.provider.approval.TokenApprovalStore">
      <beans:property name="tokenStore" ref="tokenStore"/>
  </beans:bean>
  
     <!-- OAuth2 Authorization Server -->
  <oauth:authorization-server client-details-service-ref="clientDetails"
                              token-services-ref="tokenServices"
                              user-approval-handler-ref="userApprovalHandler">
      <oauth:authorization-code/>
      <oauth:implicit/>
      <oauth:refresh-token/>
      <oauth:client-credentials/>
      <oauth:password authentication-manager-ref="authenticationManager"/>
  </oauth:authorization-server>
  
  <oauth:resource-server id="resourceServerFilter"
       token-services-ref="tokenServices" />
  
  <oauth:client-details-service id="clientDetails">
      <!-- client -->
      <oauth:client client-id="Xapp"
          authorized-grant-types="password,authorization_code,refresh_token"
          secret="Xapp" scope="read,write,trust" authorities="Administrator"/>
  </oauth:client-details-service>
  
  <global-method-security
      pre-post-annotations="enabled" proxy-target-class="true">
      <expression-handler ref="oauthExpressionHandler" />
  </global-method-security>
  
  <oauth:expression-handler id="oauthExpressionHandler" />
  <oauth:web-expression-handler id="oauthWebExpressionHandler" />
  
  <authentication-manager  alias="authenticationManager">
      <authentication-provider ref="jaasAuthenticationProvider" />
      <authentication-provider user-service-ref="clientDetailsUserService"/>
  </authentication-manager>
  

  回复于 2024-04-27T15:49:08+08:00