无效的访问令牌 Spring Boot 资源服务器

Question

我有一个 Spring Boot 资源服务器，如下所示：

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
}

还有这样的端点：

@RestController
public class TestResourceOne {

    private static final Logger log = Logger.getLogger(TestResourceOne.class);

    @RequestMapping(value = "/calcsqrt")
    public Double calcSqtr(@RequestParam("value") Double value) {
        return Math.sqrt(value);
    }

    @RequestMapping(value = "/sum")
    public Double calcSqtr(@RequestParam("value1") Double value1, @RequestParam("value2") Double value2) {
        return value1 + value2;
    }
}

我的授权服务器位于 Azure AD 中，因此当我调用此端点“/calcsqrt”时，我传递了 Azure 生成的承载令牌。这是我的要求：

GET /serviceone/calcsqrt?value=3 HTTP/1.1
Host: localhost:8080
Authorization: Bearer MY_ACCESS_TOKEN_HERE
Cache-Control: no-cache
Postman-Token: ef5d493c-39f1-4bc4-9084-4ea510ac1255

但我总是从 spring 收到以下错误：

{
    "error": "invalid_token",
    "error_description": "Invalid access token: MY_ACCESS_TOKEN_HERE"
}

Answer 1

看来您的资源配置类是错误的。我已经实现了这样的资源配置

package com.ig.user.config;

import org.springframework.boot.autoconfigure.security.oauth2.resource.UserInfoTokenServices;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;

/**
 * @author Jai
 *
 */
@Configuration
@EnableResourceServer
@EnableWebSecurity
public class ResourceConfig extends ResourceServerConfigurerAdapter {

    private final String userInfoUri = "url";

    private final String clientId = "foo";

    @Override
    public void configure(final ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId("user");
    }

    @Override
    public void configure(final HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/api/v1/user/activate/**").permitAll()//
                .anyRequest().authenticated();
    }

    @Primary
    @Bean
    public UserInfoTokenServices tokenService() {
        final UserInfoTokenServices tokenService = new UserInfoTokenServices(userInfoUri, clientId);
        return tokenService;
    }
}

EDIT-1

• userInfoUri 是授权该资源的 URL
• resourceId 对于每个资源服务器，我们必须创建一个 resourceId，并且我们必须将相同的 id 保存在您存储客户端详细信息的位置

希望对你有所帮助