招摇匿名用户答案

【问题标题】：Swagger anonymousUser招摇匿名用户
【发布时间】：2018-10-11 14:42:38
【问题描述】：

我已将 swagger 配置为使用如下登录名/密码：

@Configuration
@EnableSwagger2
public class SwaggerConfiguration {

    @Bean
    public Docket SwaggerApi() {
        return new Docket(DocumentationType.SWAGGER_2)
                .groupName("cms")
                .select().apis(RequestHandlerSelectors.any())
                .paths(PathSelectors.any())
                .build()
                .securitySchemes(Collections.singletonList(securitySchema()))
                .securityContexts(Collections.singletonList(securityContext())).pathMapping("/")
                .useDefaultResponseMessages(false)
                .apiInfo(apiInfo());
    }

    private SecurityContext securityContext() {
        return SecurityContext.builder().securityReferences(defaultAuth()).forPaths(PathSelectors.ant("/**"))
                              .build();
    }

    private List<SecurityReference> defaultAuth() {

        final AuthorizationScope[] authorizationScopes = new AuthorizationScope[3];
        authorizationScopes[0] = new AuthorizationScope("read", "read all");
        authorizationScopes[1] = new AuthorizationScope("trust", "trust all");
        authorizationScopes[2] = new AuthorizationScope("write", "write all");

        return Collections.singletonList(new SecurityReference("oauth2schema", authorizationScopes));
    }

    @Bean
    public SecurityConfiguration securityInfo() {
        return new SecurityConfiguration("app", "app-secret", "", "", "", ApiKeyVehicle.HEADER, "", " ");
    }

    private OAuth securitySchema() {
        List<AuthorizationScope> authorizationScopeList = new ArrayList<>();
        authorizationScopeList.add(new AuthorizationScope("read", "read all"));
        authorizationScopeList.add(new AuthorizationScope("trust", "trust all"));
        authorizationScopeList.add(new AuthorizationScope("write", "access all"));

        List<GrantType> grantTypes = new ArrayList<>();
        GrantType creGrant = new ResourceOwnerPasswordCredentialsGrant("http://localhost/swaggerAuth");

        grantTypes.add(creGrant);

        return new OAuth("oauth2schema", authorizationScopeList, grantTypes);
    }

    private ApiInfo apiInfo() {
        return new ApiInfoBuilder()
                .title("Application")
                .version("1.0")
                .build();
    }

这是我的自动化方法：

@RequestMapping(value = "/swaggerAuth", method = RequestMethod.POST,
        consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE,
        produces = {MediaType.APPLICATION_ATOM_XML_VALUE, MediaType.APPLICATION_JSON_VALUE})
public ResponseEntity<?> authenticate(@RequestBody MultiValueMap<String, String> formData) {
    String username = formData.get("username").get(0);
    String password = formData.get("password").get(0);
    final Authentication authentication = authenticationManager.authenticate(
            new UsernamePasswordAuthenticationToken(username, password)
    );
    SecurityContextHolder.getContext().setAuthentication(authentication);

    final UserDetails userDetails = userDetailsService.loadUserByUsername(username );
    return jwtTokenUtil.generateToken(userDetails);
}

当我通过 Swagger 登录时，一切都很好。用户通过身份验证并将Authentication 设置为SecurityContextHolder。

但是对于每一个下一个招摇的请求，用户都是anonymousUser，而不是我通过身份验证的那个。

我的配置有什么问题？

编辑：我从授权控制器返回的令牌没有在 swagger 请求标头中发送...

【问题讨论】：

你能分享你的 swagger.json 吗？
@HelderSepulveda 我没有swagger.json。我提供的代码是我唯一的配置
有趣...您是否有类似的 UI：petstore.swagger.io？
完全一样。可在localhost:8080/swagger-ui.html 获得
在这种情况下，您应该有一个 swagger 文档，它可以是 JSON 或 YAML，但您看到的所有内容都是由该 swagger 驱动的

标签： java spring spring-mvc spring-boot swagger

【解决方案1】：

问题是在authenticate() 方法中我返回的是纯字符串。相反，我应该返回一个带有access_token 字符串字段的对象：

public class SwaggerAuthenticationResponse {

    private final String access_token;

    public SwaggerAuthenticationResponse(String access_token) {
        this.access_token = access_token;
    }

    public String getAccess_token() {
        return this.access_token;
    }
}

【讨论】：