Oauth 2.0與Spring Security的配置衝突

我試圖用Spring Security配置一個Oauth2。但是我的Oauth配置與Spring Security配置衝突。Oauth 2.0與Spring Security的配置衝突

似乎資源服務器配置不僅限於/api/v0/.*，而是覆蓋所有安全配置。資源服務器運行良好。但是使用Spring Security的基於表單的身份驗證不起作用 - 它會返回HTTP 404錯誤。

我在WebSecurityConfigurerAdapter下面的代碼

@Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
       .authorizeRequests() 
       .antMatchers("/admin/**").access("hasRole('ADMINISTRATOR')") 
       .antMatchers("/1/admin/**").access("hasRole('ADMINISTRATOR')") 
       .antMatchers("/profile**").authenticated() 
       .antMatchers("/oauth/authorize").authenticated() 

       .and() 
       .formLogin() 
       .loginPage("/login") 
       .failureUrl("/login?error=1") 
       .loginProcessingUrl("/login-attempt") 
       .defaultSuccessUrl("/", false) 

       .and() 
       .csrf(); 
    }

這是ResourceServerConfigurerAdapter我的配置

@Override 
     public void configure(HttpSecurity http) throws Exception { 
      http 
        .authorizeRequests() 
        .regexMatchers("/api/v0/.*").authenticated(); 

     }

日誌

AntPathRequestMatcher:151 - Checking match of request : '/login-attempt'; against '/html/**' 
AntPathRequestMatcher:151 - Checking match of request : '/login-attempt'; against '/webapi/**' 
OrRequestMatcher:65 - Trying to match using Ant [pattern='/oauth/token'] 
AntPathRequestMatcher:151 - Checking match of request : '/login-attempt'; against '/oauth/token' 
OrRequestMatcher:65 - Trying to match using Ant [pattern='/oauth/token_key'] 
AntPathRequestMatcher:151 - Checking match of request : '/login-attempt'; against '/oauth/token_key' 
OrRequestMatcher:65 - Trying to match using Ant [pattern='/oauth/check_token'] 
AntPathRequestMatcher:151 - Checking match of request : '/login-attempt'; against '/oauth/check_token' 
OrRequestMatcher:72 - No matches found 
FilterChainProxy:324 - /login-attempt at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' 
FilterChainProxy:324 - /login-attempt at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 
FilterChainProxy:324 - /login-attempt at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter' 
HstsHeaderWriter:128 - Not injecting HSTS header since it did not match the requestMatcher org.springframework.se[email protected]2fa4c8cd 
FilterChainProxy:324 - /login-attempt at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter' 
AntPathRequestMatcher:151 - Checking match of request : '/login-attempt'; against '/logout' 
FilterChainProxy:324 - /login-attempt at position 5 of 11 in additional filter chain; firing Filter: 'OAuth2AuthenticationProcessingFilter' 
BearerTokenExtractor:54 - Token not found in headers. Trying request parameters. 
BearerTokenExtractor:57 - Token not found in request parameters. Not an OAuth2 request. 
OAuth2AuthenticationProcessingFilter:141 - No token in request, will continue chain. 
FilterChainProxy:324 - /login-attempt at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' 
FilterChainProxy:324 - /login-attempt at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' 
FilterChainProxy:324 - /login-attempt at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' 
AnonymousAuthenticationFilter:100 - Populated SecurityContextHolder with anonymous token: 'org.sprin[email protected]9056f12c: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin[email protected]380f4: RemoteIpAddress: 127.0.0.1;SessionId:672t27n01ruouli4a041a0xq;Granted Authorities: ROLE_ANONYMOUS' 
FilterChainProxy:324 - /login-attempt at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter' 
FilterChainProxy:324 - /login-attempt at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' 
FilterChainProxy:324 - /login-attempt at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' 
RegexRequestMatcher:106 - Checking match of request : '/login-attempt'; against '/api/v0/.*' 
FilterSecurityInterceptor:209 - Public object - authentication not attempted 
FilterChainProxy:309 - /login-attempt reached end of additional filter chain; proceeding with original chain

我在做什麼錯？提前致謝！

來源

2016-11-17 Alex

不確定它是否解決了您的問題。讓我們試試看。將

@Order(1) 
@Order(2)

添加到您的配置類，然後重試。

來源

2017-01-25 06:39:30 Srikanth

Oauth 2.0與Spring Security的配置衝突

回答

相關問題