使用@EnableAuthorizationServer时，如何在 HTTP 基本身份验证筛选器之后添加筛选器

java spring-security spring-security-oauth2

2022-09-04 22:42:36

我正在尝试浏览以下文档：https://github.com/spring-projects/spring-security-oauth/blob/f25592e682303b0cf89e1d7555174bac18e174df/docs/oauth2.md#mapping-user-roles-to-scopes

在文档中，它说为了将用户角色映射到作用域，以及在中设置，我们需要在HTTP之后添加过滤器。我想知道如何做到这一点。checkUserScopes=trueDefaultOAuth2RequestFactoryTokenEndpointAuthenticationFilterBasicAuthenticationFilter

以下是我的授权服务器的外观：

@Configuration
@EnableAuthorizationServer
protected static class OAuth2Config extends
        AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private OAuth2RequestFactory requestFactory;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
        endpoints.authenticationManager(authenticationManager);
        endpoints.requestFactory(requestFactory);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients)
            throws Exception {
        clients.withClientDetails(clientDetailsService());
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer)
            throws Exception {
        oauthServer.checkTokenAccess("isAuthenticated()");
    }

    @Bean
    public ClientDetailsService clientDetailsService() {

        Map<String, ClientDetails> clientDetailsStore = new HashMap<String, ClientDetails>();

        Collection<String> scope = new HashSet<String>();
        scope.add("user");
        scope.add("admin");

        Collection<String> authorizedGrantTypes = new HashSet<String>();
        authorizedGrantTypes.add("password");
        authorizedGrantTypes.add("refresh_token");


        BaseClientDetails clientDetails = new BaseClientDetails();
        clientDetails.setClientId("client");
        clientDetails.setClientSecret("secret");
        clientDetails.setScope(scope);
        clientDetails.setAuthorizedGrantTypes(authorizedGrantTypes);

        clientDetailsStore.put("client", clientDetails);

        InMemoryClientDetailsService clientDetailsService = new InMemoryClientDetailsService();
        clientDetailsService.setClientDetailsStore(clientDetailsStore);

        return clientDetailsService;
    }

    @Bean
    public OAuth2RequestFactory requestFactory() {
        DefaultOAuth2RequestFactory requestFactory = 
                new DefaultOAuth2RequestFactory(clientDetailsService());

        requestFactory.setCheckUserScopes(true);

        return requestFactory;
    }
}

此外，提供一个关于如何测试授权类型密码的示例 CURL 会很棒。

感谢您的任何帮助！

答案 1

而不是使用，你应该能够扩展并包含在你的Spring配置中。例如：@EnableAuthorizationServerAuthorizationServerSecurityConfiguration

@Configuration
public class OAuth2Config extends AuthorizationServerSecurityConfiguration {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
       super.configure(http);
       http.addFilterAfter(myFilter(), BasicAuthenticationFilter.class);
    }
}

答案 2

您还可以通过添加其他过滤器，尽管它们位于基本身份验证之前，而不是之后。AuthorizationServerSecurityConfigurer

@Override
public void configure(AuthorizationServerSecurityConfigurer security) {
    security.addTokenEndpointAuthenticationFilter(myFilter());
    security.checkTokenAccess("isAuthenticated()");
}

为令牌终结点添加新的自定义身份验证筛选器。筛选器将设置为默认基本身份验证筛选器的上游。