在方法级别#oauth2安全表达式

java oauth-2.0 spring-mvc spring-security

2022-09-03 05:21:20

我应该如何才能在方法级别上使用#oauth2安全表达式，如下面的示例所示？

@RequestMapping(value = "email", method = RequestMethod.GET)
  @ResponseBody
  @PreAuthorize("#oauth2.hasScope('read')")
  public String email() {

    return "test@email.com";
  }

如果我对该资源执行请求，我会收到

    [INFO] java.lang.IllegalArgumentException: Failed to evaluate expression '#oauth2.hasScope('read')'
[INFO]  at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:14)
[INFO]  at org.springframework.security.access.expression.method.ExpressionBasedPreInvocationAdvice.before(ExpressionBasedPreInvocationAdvice.java:44)
[INFO]  at org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter.vote(PreInvocationAuthorizationAdviceVoter.java:57)
[INFO]  at org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter.vote(PreInvocationAuthorizationAdviceVoter.java:25)
[INFO]  at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:62)
[INFO]  at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:232)
[INFO]  at org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor.invoke(AspectJMethodSecurityInterceptor.java:43)
[INFO]  at org.springframework.security.access.intercept.aspectj.aspect.AnnotationSecurityAspect.ajc$around$org_springframework_security_access_intercept_aspectj_aspect_AnnotationSecurityAspect$1$c4d57a2b(AnnotationSecurityAspect.aj:63)
[INFO]  at pl.insert.controllers.ResourceController.email(ResourceController.java:22)

如果我在 ResourceServerConfiguration 中指定访问权限，而不是@Controllers'方法，同样有效

@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

  @Override
  public void configure(HttpSecurity http) throws Exception {
    http.requestMatchers().antMatchers("/oauth/resources/**");
    http.authorizeRequests().anyRequest().access("#oauth2.hasScope('read')");
  }
}

标准安全表达式（如@PreAuthorize“permitAll”）或@PreAuthorize（“denyAll”）按预期工作。所以，也许我必须以某种方式告诉我的AspectJMethodSecurityInterceptor使用OAuth2WebSecurityExpressionHandler。有什么想法吗？

答案 1

若要启用#oAuth2安全表达式，只需将默认表达式处理程序设置为 OAuth2MethodSecurityExpressionHandler，而不是 DefaultMethodSecurityExpressionHandler。因为OAuth2MethodSecurityExpressionHandler无论如何都扩展了它，所以整个以前的功能保持不变。我的配置我同时使用GlobalMethodSecurityConfiguration和WebSecurityConfigurerAdapter。

@Configuration
@EnableGlobalMethodSecurity
public class MethodSecurityConfiguration extends GlobalMethodSecurityConfiguration {

  @Override
  protected MethodSecurityExpressionHandler createExpressionHandler() {
    return new OAuth2MethodSecurityExpressionHandler();
  }
}

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  ...
}


@Configuration
@Import({ SecurityConfiguration.class, MethodSecurityConfiguration.class })
public class AppConfiguration {
  ...
}

答案 2

我认为您还需要添加：@EnableGlobalMethodSecurity（prePostEnabled = true）才能使其正常工作。

在遵从页面上回答