Java 弹簧靴。无法使用令牌进行身份验证
我正在实现OAuth2授权授予流。 通过登录页面登录时,用户能够收到访问令牌。但是,当我传递访问令牌以调用需要身份验证的端点时,它会触发异常 以下是一些日志:Java 弹簧靴。无法使用令牌进行身份验证,java,spring-boot,oauth-2.0,spring-security-oauth2,Java,Spring Boot,Oauth 2.0,Spring Security Oauth2,我正在实现OAuth2授权授予流。 通过登录页面登录时,用户能够收到访问令牌。但是,当我传递访问令牌以调用需要身份验证的端点时,它会触发异常 以下是一些日志: |2017-08-05 22:37:54.102 INFO 18809 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: org.springframework.security.oauth2.config
|2017-08-05 22:37:54.102 INFO 18809 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Creating filter
chain:
org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfiguration$NotOAuthRequestMatcher@7efa3f63,
[
org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@7134b8a7,
org.springframework.security.web.context.SecurityContextPersistenceFilter@3ff54f3d,
org.springframework.security.web.header.HeaderWriterFilter@7b61bf11,
org.springframework.security.web.authentication.logout.LogoutFilter@18b74ea,
org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter@1665fa54,
org.springframework.security.web.savedrequest.RequestCacheAwareFilter@14c93774,
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@62a68bcb,
org.springframework.security.web.authentication.AnonymousAuthenticationFilter@2262d6d5,
org.springframework.security.web.session.SessionManagementFilter@40247d48,
org.springframework.security.web.access.ExceptionTranslationFilter@315105f,
org.springframework.security.web.access.intercept.FilterSecurityInterceptor@70025b99]
如您所见,链中有一个OAuth2AuthenticationProcessingFilter
但是,当我调用端点时,会得到以下日志:
.808 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2017-08-05 23:14:24.808 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2017-08-05 23:14:24.808 DEBUG 19570 --- [nio-8080-exec-3] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
2017-08-05 23:14:24.808 DEBUG 19570 --- [nio-8080-exec-3] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
2017-08-05 23:14:24.808 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2017-08-05 23:14:24.809 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@7091e577
2017-08-05 23:14:24.809 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 4 of 11 in additional filter chain; firing Filter: 'CsrfFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 5 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /users' doesn't match 'POST /logout
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 6 of 11 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /users' doesn't match 'POST /login
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 7 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 8 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.session.SessionManagementFilter : Requested session ID 82C8AE1B7613B93D9F52F5A09CA5D114 is invalid.
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2017-08-05 23:14:24.810 DEBUG 19570 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy : /users at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2017-08-05 23:14:24.811 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /users' doesn't match 'POST /logout
2017-08-05 23:14:24.811 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/users'; against '/resources/**'
2017-08-05 23:14:24.811 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /users; Attributes: [authenticated]
2017-08-05 23:14:24.814 DEBUG 19570 --- [nio-8080-exec-3] o.s.b.a.audit.listener.AuditListener : AuditEvent [timestamp=Sat Aug 05 23:14:24 CEST 2017, principal=<unknown>, type=AUTHENTICATION_FAILURE, data={type=org.springframework.security.authentication.AuthenticationCredentialsNotFoundException, message=An Authentication object was not found in the SecurityContext}]
2017-08-05 23:14:24.817 DEBUG 19570 --- [nio-8080-exec-3] o.s.s.w.a.ExceptionTranslationFilter : Authentication exception occurred; redirecting to authentication entry point
有人知道原因是什么吗?
谢谢
更新1
以下是我的配置:
以下是我如何调用端点:
curl -H "Authorization: bearer eaee916e-fdf1-4e80-808e-cfd9b2944539" localhost:8080/users
更新2
我想如果我
security.oauth2.resource.filter-order = 3
然后,上面的命令起作用,但是在调用/oauth/authorize
时,使用此设置,我收到以下错误:
“访问此资源需要完全身份验证。未经授权”。我遇到了类似问题,解决方法如下,您需要配置资源服务器:
@Configuration
@EnableResourceServer
protected static class ResourceServer extends ResourceServerConfigurerAdapter {
@Autowired
private TokenStore tokenStore;
@Override
public void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/**", "/secured_area/**")
// etc. add more matchers
.authorizeRequests()
.anyRequest().authenticated();
}
@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
resources.tokenStore(tokenStore).resourceId("myapp");
}
}
另外,从spring boot 1.5.1+开始,我相信,安全过滤器的订单发生了变化,您可能希望超越订单:
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfigurerAdapter extends WebSecurityConfigurerAdapter { ..... }
我遇到了类似的问题,解决方法如下,您需要配置资源服务器:
@Configuration
@EnableResourceServer
protected static class ResourceServer extends ResourceServerConfigurerAdapter {
@Autowired
private TokenStore tokenStore;
@Override
public void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/**", "/secured_area/**")
// etc. add more matchers
.authorizeRequests()
.anyRequest().authenticated();
}
@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
resources.tokenStore(tokenStore).resourceId("myapp");
}
}
另外,从spring boot 1.5.1+开始,我相信,安全过滤器的订单发生了变化,您可能希望超越订单:
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfigurerAdapter extends WebSecurityConfigurerAdapter { ..... }
您是否正在使用
OAuth2RestTemplate
获取资源?@JuanCarlosMendoza,否显示您如何尝试访问端点。那个端点属于资源服务器吗?@JuanCarlosMendoza,我已经更新了帖子。它有用吗?您是否使用OAuth2RestTemplate
获取资源?@JuanCarlosMendoza,没有。请展示您如何尝试访问端点。那个端点属于资源服务器吗?@JuanCarlosMendoza,我已经更新了帖子。它有用吗?但是使用这种方法,当我调用/oauth/authorize
时,我收到以下错误:“在SecurityContext中找不到身份验证对象”不确定您的代码是什么样子,但这是基于指向Github中原始代码的链接的。您如何进行/oauth/authorize调用?但是使用这种方法,当我调用/oauth/authorize
时,我收到以下错误:“在SecurityContext中找不到身份验证对象”不确定您的代码是什么样子,但这是基于指向Github中原始代码的链接。您如何进行/oauth/authorize调用?