彈簧安全oauth2後限制

Question

我目前正在試圖實現一個彈簧安全oauth2春天應用程序來保護我的資源，以及從外部設備（例如IOS或Android應用程序）接收數據 隨着以下春季配置設置，我可以達到保護資源的目的，所以基本上任何人都希望查看JSON數據，他們不得不通過

<beans xmlns="http://www.springframework.org/schema/beans" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:context="http://www.springframework.org/schema/context" 
     xmlns:oauth="http://www.springframework.org/schema/security/oauth2" 
     xmlns:sec="http://www.springframework.org/schema/security" 
     xsi:schemaLocation="http://www.springframework.org/schema/beans 

     http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
     http://www.springframework.org/schema/security 
     http://www.springframework.org/schema/security/spring-security-3.2.xsd 
     http://www.springframework.org/schema/security/oauth2 
     http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd 
     http://www.springframework.org/schema/context 
     http://www.springframework.org/schema/context/spring-context-3.1.xsd"> 

<!-- Definition of the Authentication Service --> 
<http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager" 
     xmlns="http://www.springframework.org/schema/security"> 
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/> 
    <anonymous enabled="false"/> 
    <http-basic entry-point-ref="clientAuthenticationEntryPoint"/> 
    <!-- include this only if you need to authenticate clients via request parameters --> 
    <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> 
    <access-denied-handler ref="oauthAccessDeniedHandler"/> 
</http> 

<!-- Protected resources --> 
<http pattern="/searchResultAPI/**" 
     create-session="never" 
     entry-point-ref="oauthAuthenticationEntryPoint" 
     access-decision-manager-ref="accessDecisionManager" 
     xmlns="http://www.springframework.org/schema/security"> 
    <anonymous enabled="false"/> 
    <intercept-url pattern="/searchResultAPI/**" access="ROLE_USER"/> 
    <intercept-url pattern="/receiveUserDataAPI/**" access="ROLE_USER"/> 
    <custom-filter ref="resourceServerFilter" 
        before="PRE_AUTH_FILTER"/> 
    <access-denied-handler 
      ref="oauthAccessDeniedHandler"/> 
</http> 

<bean id="oauthAuthenticationEntryPoint" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
    <property name="realmName" value="dstest"/> 
</bean> 

<bean id="clientAuthenticationEntryPoint" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
    <property name="realmName" value="dstest/client"/> 
    <property name="typeName" value="Basic"/> 
</bean> 

<bean id="oauthAccessDeniedHandler" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/> 

<bean id="clientCredentialsTokenEndpointFilter" 
     class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"> 
    <property name="authenticationManager" ref="clientAuthenticationManager"/> 
</bean> 

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" 
     xmlns="http://www.springframework.org/schema/beans"> 
    <constructor-arg> 
     <list> 
      <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/> 
      <bean class="org.springframework.security.access.vote.RoleVoter"/> 
      <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/> 
     </list> 
    </constructor-arg> 
</bean> 

<!-- Authentication in config file --> 
<authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"> 
    <authentication-provider user-service-ref="clientDetailsUserService"/> 
</authentication-manager> 

<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security"> 
    <authentication-provider> 
     <user-service id="userDetailsService"> 
      <user name="admin" password="password" authorities="ROLE_USER"/> 
     </user-service> 
    </authentication-provider> 
</authentication-manager> 

<bean id="clientDetailsUserService" 
     class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"> 
    <constructor-arg ref="clientDetails"/> 
</bean> 

<!-- Token Store --> 
<bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore"/> 

<bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"> 
    <property name="tokenStore" ref="tokenStore"/> 
    <property name="supportRefreshToken" value="true"/> 
    <property name="clientDetailsService" ref="clientDetails"/> 
    <!-- VIV --> 
    <property name="accessTokenValiditySeconds" value="10"/> 
</bean> 

<bean id="userApprovalHandler" 
     class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler"> 
    <property name="tokenServices" ref="tokenServices"/> 
</bean> 

<!-- Token management --> 
<oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices" 
          user-approval-handler-ref="userApprovalHandler"> 
    <oauth:authorization-code/> 
    <oauth:implicit/> 
    <oauth:refresh-token/> 
    <oauth:client-credentials/> 
    <oauth:password/> 
</oauth:authorization-server> 

<oauth:resource-server id="resourceServerFilter" 
         resource-id="dstest" 
         token-services-ref="tokenServices"/> 

<!-- Client Definition --> 
<oauth:client-details-service id="clientDetails"> 

    <oauth:client client-id="my-trusted-client" 
        authorized-grant-types="password,authorization_code,refresh_token,implicit,redirect" 
        authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT" 
        redirect-uri="/web" 
        scope="read,write,trust" 
        access-token-validity="30" 
        refresh-token-validity="600"/> 

</oauth:client-details-service> 


<sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true"> 
    <sec:expression-handler ref="oauthExpressionHandler"/> 
</sec:global-method-security> 
<oauth:expression-handler id="oauthExpressionHandler"/> 
<oauth:web-expression-handler id="oauthWebExpressionHandler"/> 

</beans> 

1.to得到刷新令牌

http://www.sample.com/oauth/token?grant_type=password&client_id=my-trusted-client&username=admin&password=password 

次刷新令牌交換訪問令牌

http://www.sample.com/oauth/token?client_id=my-trusted-client&grant_type=refresh_token&refresh_token=5fbdc1fe-6d26-458a-818f-4e49c41a47ff

最後一步使用訪問令牌來訪問JSON數據

http://www.sample.com/searchResultAPI/results?search_item_id=0098&access_token=3658213e-5bb0-4c4b-89ca-f0f82513fc22

我與上述過程中檢索數據沒有問題。

但是，當我試圖發佈一些數據到這個URL（假設servlet requestmapping是爲了這個url，並且所有的gson orm和模型完成了等等），spring安全並沒有停止發佈到http://www.sample.com/receiveUserDataAPI/receiver，即使沒有最初呼叫oauth/token?grant_type=password&client_id=my-trusted-client&username=admin&password=password獲得訪問令牌。

{ 
"customer": 
    { 
     "address": "somewhere", 
     "city": "London", 
    } 

} 

它只是直接把數據通過這個servlet放到數據庫中。 理想情況下，我的計劃就像是進行數據處理的過程，授予用戶訪問令牌第一名，然後使用令牌發佈數據，彈出安全檢查令牌有效並接收數據。我想它應該將json數據發佈到url，比如http://www.sample.com/receiveUserDataAPI/receiver?&access_token=3658213e-5bb0-4c4b-89ca-f0f82513fc22？ 任何人都可以指出我在哪裏設置錯誤或我錯過了設置任何屬性？ 謝謝

Answer 1

當您的客戶端收到訪問令牌時，將其放入您的服務器上任何受保護資源的請求標頭{'Authorization'：'Bearer {access_token}'}。 Spring會自動檢查這個令牌和所有者權限。