向 Spring OAuth2 Auth Server 添加多个客户端答案

【问题标题】：Adding more then one client to the Spring OAuth2 Auth Server向 Spring OAuth2 Auth Server 添加多个客户端
【发布时间】：2016-06-13 15:21:12
【问题描述】：

我有 Spring OAuth 授权服务器，我想添加对多个客户端 (id) 的支持。我这样配置客户端：

clients
            .inMemory().withClient(client).secret(clientSecret)
            .resourceIds(resourceId)
            .authorizedGrantTypes("client_credentials", "password", "refresh_token", "implicit", "authorization_code")
            .authorities("ROLE_USER")
            .scopes("read", "write")
            .autoApprove(true)
            .and()
            .inMemory().withClient("acme").secret("acmesecret")
            .resourceIds(resourceId)
            .authorizedGrantTypes("client_credentials", "password", "refresh_token", "implicit", "authorization_code")
            .authorities("ROLE_USER_ACME")
            .scopes("read", "write")
            .autoApprove(true);

我可以使用第一个客户端获取访问令牌，但尝试使用第二个客户端获取访问令牌时出现此错误：

{
  "timestamp": 1456822249638,
  "status": 401,
  "error": "Unauthorized",
  "message": "Bad credentials",
  "path": "/oauth/token"
}

是否可以添加多个客户端以及如何添加？另外，如何从数据库中读取客户端？

【问题讨论】：

标签： java spring spring-security oauth-2.0 spring-security-oauth2

【解决方案1】：

不要使用多个inMemory 构建器，而是在一个inMemory 中连接多个withClient：

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory()
                .withClient("first")
                .secret("secret")
                .scopes("read")
                .authorizedGrantTypes("password")
            .and()
                .withClient("sec")
                .secret("secret")
                .scopes("read")
                .authorizedGrantTypes("password");
}

【讨论】：

是否可以通过 application.yml 文件来实现？
@AndreasLundgren：.yml-file 有什么运气吗？
不，我们最终跳过了 oAuth2，因为我们实际上没有任何需要访问的第三方后端系统，只有内部 BE 系统和客户端。

【解决方案2】：

对于inMemorybuilder 带配置（您必须定义自己的配置）：

 @Override
    public void configure ( ClientDetailsServiceConfigurer clients ) throws Exception {
        // @formatter:off
        InMemoryClientDetailsServiceBuilder inMemoryBuilder = clients.inMemory ();
        for (String clientKey: authServerProperties.getClient ().keySet ()) {
            OAuthClientProperties client = authServerProperties.getClient ().get ( clientKey );
            inMemoryBuilder
                .withClient ( client.getClientId () )
                .secret ( client.getClientSecret () )
                .scopes ( client.getScopes () == null ? new String[] {"openid"} : client.getScopes () )
                .authorizedGrantTypes ( client.getAuthorizedGrandTypes () == null ? "client_credentials" : client.getAuthorizedGrandTypes () );
        }

        // @formatter:on
    }

有两个额外的类：

@ConfigurationProperties ( prefix = "my-authorization-server" )
public class AuthServerProperties 

    private final Map<String, OAuthClientProperties> client = new HashMap<> ();

    ...

    public Map<String, OAuthClientProperties> getClient () {
        return client;
    }

    ...

}


public class OAuthClientProperties {

    private String clientId;

    private String clientSecret;

    private String[] scopes;

    private String authorizedGrandTypes;

    public String getClientId () {
        return clientId;
    }

    public void setClientId ( String clientId ) {
        this.clientId = clientId;
    }

    public String getClientSecret () {
        return clientSecret;
    }

    public void setClientSecret ( String clientSecret ) {
        this.clientSecret = clientSecret;
    }

    public String[] getScopes () {
        return scopes;
    }

    public void setScopes ( String[]  scopes ) {
        this.scopes = scopes;
    }

    public String getAuthorizedGrandTypes () {
        return authorizedGrandTypes;
    }

    public void setAuthorizedGrandTypes ( String authorizedGrandTypes ) {
        this.authorizedGrandTypes = authorizedGrandTypes;
    }

}

最后，在属性中你会有这样的东西：

my-authorization-server.client.foo.client-id=foo-client
my-authorization-server.client.foo.client-secret=foo-client-supersecret
my-authorization-server.client.foo.scopes=read

my-authorization-server.client.bar.client-id=bar-client
my-authorization-server.client.bar.client-secret=bar-client-verysupersecret
my-authorization-server.client.bar.scopes=read,write

【讨论】：