Spring oauth2服务器，无法验证令牌

Question

我从 Spring Boot oauth2 服务器生成 JWT 令牌，但是当我想使用 'http://auth_server/oauth/check_token' 端点验证此 jwt 令牌时，我使用授权标头中的 jwt 向此端点发送 post 请求，我得到 401 - 未经授权的 http错误代码。

我从服务器得到的结果：

{
    "timestamp": "2020-03-19T16:28:39.999+0000",
    "status": 401,
    "error": "Unauthorized",
    "message": "Unauthorized",
    "path": "/oauth/check_token"
}

为什么 oauth 服务器返回 401？

这是我的 oauth 服务器的实现：

    @Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;

        @Autowired
        private ClientDetailsServiceImpl clientDetailsService;

        private String privateKey = "private key";

        @Value("${jwt.accessTokenValidititySeconds:43200}") // 12 hours
        private int accessTokenValiditySeconds;

        @Value("${jwt.authorizedGrantTypes: authorization_code}")
        private String[] authorizedGrantTypes;

        @Value("${jwt.refreshTokenValiditySeconds:2592000}") // 30 days
        private int refreshTokenValiditySeconds;

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
                clients.withClientDetails(clientDetailsService);
        }

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {      
            TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
            tokenEnhancerChain.setTokenEnhancers(
              Arrays.asList(tokenEnhancer(), accessTokenConverter()));

            endpoints.tokenStore(tokenStore())
            .accessTokenConverter(accessTokenConverter())
            .authenticationManager(authenticationManager);
        }

        @Override
        public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()").allowFormAuthenticationForClients();
        }


        @Bean
        public JwtAccessTokenConverter accessTokenConverter() {
           JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
           converter.setSigningKey(privateKey);
           return converter;
        }


        @Bean
        public TokenStore tokenStore() {
            return new JwtTokenStore(accessTokenConverter());
        }

        @Bean
        public TokenEnhancer tokenEnhancer() {
            return new CustomTokenEnhancer();
        }

        @Bean
        PasswordEncoder passwordEncoder() {
            return PasswordEncoderFactories.createDelegatingPasswordEncoder();
        }

    }

Answer 1

最后我发现GET 请求应该发送到http://server.com/oauth/check_token?token=[access_token] 和client name 和password 在authorization header 以检查访问令牌的有效性。下面是邮递员的例子：