无法让spring oauth2服务器工作

Question

似乎无法让 spring oauth2 服务器配置成功使用令牌进行身份验证。

我觉得我错过了一些非常微小的东西，但我会接受任何指示。

我正在尝试密码授权。我一直在 /oauth/token 上遇到 404。请参阅下面的配置和 curl（userAuthenticationProvider 由 @Configuration 在自定义提供程序上注入）：

配置：

<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc"
xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2
http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
http://www.springframework.org/schema/mvc
http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">


<oauth:authorization-server 
    client-details-service-ref="clientDetails" token-services-ref="tokenServices"
    user-approval-handler-ref="userApprovalHandler">
    <oauth:authorization-code />
    <oauth:implicit />
    <oauth:refresh-token />
    <oauth:client-credentials />
    <oauth:password authentication-manager-ref="clientAuthenticationManager" />
</oauth:authorization-server>

<oauth:client-details-service id="clientDetails">
    <oauth:client client-id="my-trusted-client"
        authorized-grant-types="password,authorization_code,refresh_token,implicit"
        authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT, ROLE_USER" scope="read,write,trust"
        access-token-validity="60" />
    <oauth:client client-id="my-trusted-client-with-secret"
        authorized-grant-types="password,authorization_code,refresh_token,implicit"
        secret="somesecret" authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT, ROLE_USER"
        scope="read,write,trust" />
    <oauth:client client-id="my-client-with-secret"
        authorized-grant-types="client_credentials" authorities="ROLE_CLIENT, ROLE_USER"
        scope="read" secret="secret" />
    <oauth:client client-id="my-less-trusted-client"
        authorized-grant-types="authorization_code,implicit" authorities="ROLE_CLIENT, ROLE_USER" />
    <oauth:client client-id="my-less-trusted-autoapprove-client"
        authorized-grant-types="implicit" authorities="ROLE_CLIENT, ROLE_USER" />
    <oauth:client client-id="my-client-with-registered-redirect"
        authorized-grant-types="authorization_code,client_credentials"
        authorities="ROLE_CLIENT, ROLE_USER" redirect-uri="http://anywhere?key=value"
        scope="read,trust" />
    <oauth:client client-id="my-untrusted-client-with-registered-redirect"
        authorized-grant-types="authorization_code" authorities="ROLE_CLIENT, ROLE_USER"
        redirect-uri="http://anywhere" scope="read" />
    <oauth:client client-id="tonr" resource-ids="sparklr"
        authorized-grant-types="authorization_code,implicit" authorities="ROLE_CLIENT"
        scope="read,write" secret="secret" />
</oauth:client-details-service>

<bean id="clientDetailsUserService"
    class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <constructor-arg ref="clientDetails" />
</bean>

<bean id="oauthAccessDeniedHandler"
    class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

<bean id="tokenStore"
    class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore" />

<bean id="tokenServices"
    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <property name="tokenStore" ref="tokenStore" />
    <property name="supportRefreshToken" value="true" />
    <property name="clientDetailsService" ref="clientDetails" />
</bean>

<bean id="oAuth2RequestFactory"
    class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
    <constructor-arg ref="clientDetails" />
</bean>

<bean id="userApprovalHandler"
    class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
    <property name="tokenStore" ref="tokenStore" />
    <property name="requestFactory" ref="oAuth2RequestFactory" />
</bean>

<bean id="clientCredentialsTokenEndpointFilter"
    class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <property name="authenticationManager" ref="clientAuthenticationManager" />
</bean>

<http pattern="/oauth/token" create-session="stateless"
    authentication-manager-ref="clientAuthenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
    <anonymous enabled="false" />
    <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
    <!-- include this only if you need to authenticate clients via request 
        parameters -->
    <custom-filter ref="clientCredentialsTokenEndpointFilter"
        before="BASIC_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<http pattern="/oauth/check_token" create-session="stateless"
    authentication-manager-ref="clientAuthenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false" />
    <http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

<authentication-manager id="clientAuthenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>

<authentication-manager
    xmlns="http://www.springframework.org/schema/security" alias="userAuthenticationManager">
    <authentication-provider ref="userAuthenticationProvider">
        <!-- <user-service> <user name="admin" password="adminpassword" authorities="ROLE_USER" 
            disabled="true" locked="true" /> <user name="user" password="userpassword" 
            authorities="ROLE_USER" /> </user-service> -->
    </authentication-provider>
</authentication-manager>

<bean id="clientAuthenticationEntryPoint"
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <!-- <property name="realmName" value="test" /> -->
</bean>
<bean id="oauthAuthenticationEntryPoint"
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <property name="realmName" value="test" />
</bean>

<!-- ACCESS DECISION AND ROLE VOTERS -->

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
    xmlns="http://www.springframework.org/schema/beans">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
        </list>
    </constructor-arg>
</bean>

<sec:global-method-security
    jsr250-annotations="enabled" access-decision-manager-ref="accessDecisionManager" />

卷曲：

curl my-trusted-client-with-secret:somesecret@localhost:8080/oauth/token -d grant_type=password -d username=admin -d password=adminpassword

如有任何问题，我会提出任何指示。

Answer 1

即使在 Spring 安全过滤器链对我的客户端进行身份验证后，我仍然在 /oauth/token 上收到 404，因为部署描述符（即 web.xml）缺少 Spring Dispatcher servlet 配置。添加了以下内容，一切都很好：

<servlet>
    <servlet-name>spring</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:META-INF/spring/servlet-context.xml</param-value>
    </init-param>
    <load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>spring</servlet-name>
    <url-pattern>/oauth/token</url-pattern>
</servlet-mapping>