Spring Boot Oauth2，无法从 javascript 客户端发送 clientId答案

【问题标题】：Spring Boot Oauth2, Can't send clientId from a javascript clientSpring Boot Oauth2，无法从 javascript 客户端发送 clientId
【发布时间】：2018-12-05 18:35:48
【问题描述】：

简而言之，我的问题是我无法发送从 Web 客户端配置的客户端 ID。

详细说明：

我创建了一个简单的 spring boot oauth2 服务器。服务器按预期完美运行，我通过发送用户凭据来请求令牌，并通过使用邮递员发送发布请求来接收令牌：

trusted-app@localhost:8080/oauth/token

请注意，我将客户端 trusted-app id 作为 url 的一部分发送！

成功响应：

{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsib2F1dGgyX2FwcGxpY2F0aW9uIl0sInVzZXJfbmFtZSI6ImFkbWluIiwic2NvcGUiOlsicmVhZCIsIndyaXRlIiwidXNlcl9pbmZvIl0sImV4cCI6MTUzMDA5Njg5OSwiYXV0aG9yaXRpZXMiOlsiUk9MRV9SRUdJU1RFUiIsIlJPTEVfQURNSU4iXSwianRpIjoiZTZjMjdlYmItN2ZkNC00MzU2LWFmYzgtNmQ5NTk4M2YwMWE0IiwiY2xpZW50X2lkIjoiQ2xpZW50SWQifQ.Xsi-9J7R5oeiaa29VAYgtLYFB971VMRLKAwpTYz0gNI",
    "token_type": "bearer",
    "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsib2F1dGgyX2FwcGxpY2F0aW9uIl0sInVzZXJfbmFtZSI6ImFkbWluIiwic2NvcGUiOlsicmVhZCIsIndyaXRlIiwidXNlcl9pbmZvIl0sImF0aSI6ImU2YzI3ZWJiLTdmZDQtNDM1Ni1hZmM4LTZkOTU5ODNmMDFhNCIsImV4cCI6MTUzMjY0NTY5OSwiYXV0aG9yaXRpZXMiOlsiUk9MRV9SRUdJU1RFUiIsIlJPTEVfQURNSU4iXSwianRpIjoiNzI5ZDViMDctN2E0Yy00MmEyLWEzYTQtMTk2MTY0YWU2YmNmIiwiY2xpZW50X2lkIjoiQ2xpZW50SWQifQ.QgNg7LwYs8M4UuBW1ntkqHPGugqFIbHG8XQUPARWq3M",
    "expires_in": 43199,
    "scope": "read write user_info",
    "jti": "e6c27ebb-7fd4-4356-afc8-6d95983f01a4"
}

我的问题是从 javascript 代码发送相同的请求，使用任何 javascript 客户端库、JQuery/Axios 或任何东西，我总是收到错误：

{
    "timestamp": 1530058939432,
    "status": 401,
    "error": "Unauthorized",
    "message": "Full authentication is required to access this resource",
    "path": "/oauth/token"
}

我在邮递员上也遇到同样的错误，如果我请求错误客户 ID，或没有客户 ID。
检查 Chrome 网络日志，我发现请求总是在没有客户端 ID 的情况下发送！
我做了很多研究，我可以看到其他将客户端 ID 作为查询参数发送的项目：clientId:trusted-app，但这对我不起作用，不是作为查询参数，不是作为标题，并且不作为表单参数。

现在我完全糊涂了，是否允许从 Web 客户端在 url 中发送客户端 ID？有没有办法可以配置spring security来从标头、查询或表单参数中读取clientId？

这里是

AuthorizationServerConfigurerAdapter：

    @Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

        @Value("${security.oauth2.resource.id}")
        private String resourceId;

        @Value("${access_token.validity_period}")
        private int accessTokenValiditySeconds;

        @Value("${refresh_token.validity_period}")
        private int refreshTokenValiditySeconds;

        @Autowired
        private AuthenticationManager authenticationManager;

        @Autowired
        private SecretKeyProvider keyProvider;

        @Bean
        public UserDetailsService userDetailsService() {
            return new AccountServiceImpl();
        }

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints
                    .authenticationManager(authenticationManager)
                    .tokenServices(tokenServices())
                    .tokenStore(tokenStore())
                    .accessTokenConverter(accessTokenConverter());
        }

        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer.tokenKeyAccess("permitAll()")
                    .checkTokenAccess("isAuthenticated()");
        }

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                    .withClient("trusted-app")
                    .authorizedGrantTypes("authorization_code", "implicit", "client_credentials", "password", "refresh_token")
                    .authorities("ROLE_TRUSTED_CLIENT")
                    .scopes("read", "write", "user_info")
                    .resourceIds(resourceId)
                    .accessTokenValiditySeconds(accessTokenValiditySeconds)
                    .refreshTokenValiditySeconds(refreshTokenValiditySeconds)
                    .autoApprove(true);
        }

        @Bean
        public TokenStore tokenStore() {
            return new JwtTokenStore(accessTokenConverter());
        }

        @Bean
        public JwtAccessTokenConverter accessTokenConverter() {
            JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
            try {
                converter.setSigningKey(keyProvider.getKey());
            } catch (URISyntaxException | KeyStoreException | NoSuchAlgorithmException | IOException | UnrecoverableKeyException | CertificateException e) {
                e.printStackTrace();
            }

            return converter;
        }

        @Bean
        @Primary
        public DefaultTokenServices tokenServices() {
            DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
            defaultTokenServices.setTokenStore(tokenStore());
            defaultTokenServices.setSupportRefreshToken(true);
            defaultTokenServices.setTokenEnhancer(accessTokenConverter());
            return defaultTokenServices;
        }
    }

还有 WebSecurityConfigurerAdapter：

@Configuration
@EnableWebSecurity(debug = true)
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private BCryptPasswordEncoder bCryptPasswordEncoder;

    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setPasswordEncoder(bCryptPasswordEncoder);
        provider.setUserDetailsService(userDetailsService);
        return provider;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .userDetailsService(userDetailsService)
                .passwordEncoder(bCryptPasswordEncoder);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
                .and()
                .authorizeRequests()
                .antMatchers("/oauth/token").anonymous()
                .and()
                .authorizeRequests()
                .anyRequest().authenticated();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web
                .ignoring()
                .antMatchers("/resources/**", "/static/**", "/css/**", "/js/**", "/images/**");
    }
}

我现在只分享这两个类，因为我相信我需要的解决方案只能在这里修复，我可能是错的。

【问题讨论】：

您能分享一下您的请求吗？您使用的是哪个授权？

标签： spring-boot oauth-2.0 spring-security-oauth2 clientid

【解决方案1】：

您可以配置授权服务器，以便客户端可以通过以下表单数据进行身份验证，

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

  @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.allowFormAuthenticationForClients();
    }
}

然后你可以发送表单数据

curl -X POST \
  http://localhost:54040/oauth/token \
  -H 'content-type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW' \
  -F grant_type=system \
  -F username=udara \
  -F password=udara123 \
  -F client_id=wfw3e5454353wwrwrtr \
  -F client_secret=432fwrw5425242543w245325

或作为 x-www-form-urlencoded

curl -X POST \
  http://localhost:54040/oauth/token \

  -H 'Content-Type: application/x-www-form-urlencoded'  \
  -d 'grant_type=internal&username=udara&password=udara123&client_id=wfw3e5454353wwrwrtr&client_secret=432fwrw5425242543w245325'

【讨论】：