Java 无法配置spring security oauth 2.0

我尝试使用SpringSecurityOAuth2.0实现OAuth2.0服务器

我的开发环境如下

Spring框架：4.2.2版本

Spring oauth2:2.0.7版本

ApacheTomcat:8.0.27.0

spring安全xml:

-oauth2.xml

<?xml version='1.0' encoding='UTF-8' ?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:p="http://www.springframework.org/schema/p"
           xmlns:aop="http://www.springframework.org/schema/aop"
           xmlns:context="http://www.springframework.org/schema/context"
           xmlns:tx="http://www.springframework.org/schema/tx"
           xmlns:mvc="http://www.springframework.org/schema/mvc"
           xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
           xmlns:security="http://www.springframework.org/schema/security"
           xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
           http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.2.xsd
           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.2.xsd
           http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.2.xsd
           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
           http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
           http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.2.xsd">

        <!--bean id="clientDetailServices" class="org.zinzu.mv.oauth2.ZZClientDetailServices"/-->
        <http pattern="/oauth/token" create-session="stateless"
            authentication-manager-ref="clientAuthenticationManager"
            xmlns="http://www.springframework.org/schema/security">
            <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
            <anonymous enabled="false" />
            <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
            <!-- include this only if you need to authenticate clients via request 
                parameters -->
            <custom-filter ref="clientCredentialsTokenEndpointFilter"
                after="BASIC_AUTH_FILTER" />
            <access-denied-handler ref="oauthAccessDeniedHandler" />
        </http>

        <!-- This is where we tells spring security what URL should be protected 
            and what roles have access to them -->
        <security:http pattern="/api/**" create-session="never" use-expressions="true"
            entry-point-ref="oauthAuthenticationEntryPoint"
            access-decision-manager-ref="accessDecisionManager">
            <security:anonymous enabled="false" />
            <security:intercept-url pattern="/api/**" access="hasRole('ROLE_USER')" />
            <security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
            <security:access-denied-handler ref="oauthAccessDeniedHandler" />
        </security:http>


        <bean id="oauthAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
            <property name="realmName" value="test" />
        </bean>

        <bean id="clientAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
            <property name="realmName" value="test/client" />
            <property name="typeName" value="Basic" />
        </bean>

        <bean id="oauthAccessDeniedHandler"
            class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

        <bean id="clientCredentialsTokenEndpointFilter"
            class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
            <property name="authenticationManager" ref="clientAuthenticationManager" />
        </bean>

        <bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
            xmlns="http://www.springframework.org/schema/beans">
            <constructor-arg>
                <list>
                    <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
                    <bean class="org.springframework.security.access.vote.RoleVoter" />
                    <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
                </list>
            </constructor-arg>
        </bean>

        <authentication-manager id="clientAuthenticationManager"
            xmlns="http://www.springframework.org/schema/security">
            <authentication-provider user-service-ref="clientDetailsUserService" />
        </authentication-manager>


        <!-- This is simple authentication manager, with a hardcoded user/password 
            combination. We can replace this with a user defined service to get few users 
            credentials from DB -->
        <authentication-manager alias="authenticationManager"
            xmlns="http://www.springframework.org/schema/security">
            <authentication-provider>
                <user-service>
                    <user name="beingjavaguys" password="spring@java" authorities="ROLE_CLIENT" />
                </user-service>
            </authentication-provider>
        </authentication-manager>

        <bean id="clientDetailsUserService"
            class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
            <constructor-arg ref="clientDetails" />
        </bean>


        <!-- This defined token store, we have used inmemory tokenstore for now 
            but this can be changed to a user defined one -->
        <bean id="tokenStore"
            class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore" />

            <bean id="approvalStore"
            class="org.springframework.security.oauth2.provider.approval.TokenApprovalStore">
            <property name="tokenStore" ref="tokenStore" />
        </bean>

        <!-- This is where we defined token based configurations, token validity 
            and other things -->
        <bean id="tokenServices"
            class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
            <property name="tokenStore" ref="tokenStore" />
            <property name="supportRefreshToken" value="true" />
            <property name="accessTokenValiditySeconds" value="120" />
            <property name="clientDetailsService" ref="clientDetails" />
        </bean>
            <bean id="requestFactory"
            class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
            <constructor-arg name="clientDetailsService" ref="clientDetails" />
        </bean>
        <bean id="userApprovalHandler"
            class="org.springframework.security.oauth2.provider.approval.ApprovalStoreUserApprovalHandler">
            <property name="clientDetailsService" ref="clientDetails"/>
                    <property name="approvalStore" ref="approvalStore"/>
                    <property name="requestFactory" ref="requestFactory"/>
        </bean>

        <oauth:authorization-server
            client-details-service-ref="clientDetails" token-services-ref="tokenServices"
            user-approval-handler-ref="userApprovalHandler">
            <oauth:authorization-code />
            <oauth:implicit />
            <oauth:refresh-token />
            <oauth:client-credentials />
            <oauth:password />
        </oauth:authorization-server>

        <oauth:resource-server id="resourceServerFilter"
            resource-id="test" token-services-ref="tokenServices" />

        <oauth:client-details-service id="clientDetails">
            <!-- client -->
            <oauth:client client-id="restapp"
                authorized-grant-types="authorization_code,client_credentials"
                authorities="ROLE_CLIENT" scope="read,write,trust" secret="secret" />

            <oauth:client client-id="restapp"
                authorized-grant-types="password,authorization_code,refresh_token,implicit"
                secret="restapp" authorities="ROLE_CLIENT" />

        </oauth:client-details-service>

        <security:global-method-security
            pre-post-annotations="enabled" proxy-target-class="true">
            <!--you could also wire in the expression handler up at the layer of the 
                http filters. See https://jira.springsource.org/browse/SEC-1452 -->
            <security:expression-handler ref="oauthExpressionHandler" />
        </security:global-method-security>

        <oauth:expression-handler id="oauthExpressionHandler" />
        <oauth:web-expression-handler id="oauthWebExpressionHandler" />

    </beans>

但在不应用SpringOAuth2的spring安全项目中，结果是成功的。 原因是什么？

---

感谢您对每个人的无私帮助。

您在

块中缺少此属性

    use-expressions="true"

   <http 
        use-expressions="true" 
        pattern="/oauth/token" create-session="stateless"
        authentication-manager-ref="clientAuthenticationManager"
        xmlns="http://www.springframework.org/schema/security">
        <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
        <anonymous enabled="false" />
        <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
        <!-- include this only if you need to authenticate clients via request 
            parameters -->
        <custom-filter ref="clientCredentialsTokenEndpointFilter"
            after="BASIC_AUTH_FILTER" />
        <access-denied-handler ref="oauthAccessDeniedHandler" />
    </http>

使用expressions=“true”

    use-expressions="true"

   <http 
        use-expressions="true" 
        pattern="/oauth/token" create-session="stateless"
        authentication-manager-ref="clientAuthenticationManager"
        xmlns="http://www.springframework.org/schema/security">
        <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
        <anonymous enabled="false" />
        <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
        <!-- include this only if you need to authenticate clients via request 
            parameters -->
        <custom-filter ref="clientCredentialsTokenEndpointFilter"
            after="BASIC_AUTH_FILTER" />
        <access-denied-handler ref="oauthAccessDeniedHandler" />
    </http>