EnableResourceServer breaks oAuth2 authorization server

问题

I implemented oAuth2 authorization server using Spring Boot version 1.5.2.RELEASE. The authorization server supports implicit flow. With the WebSecurityConfig below the login form (http://localhost:8200/login) works well.

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JpaUserDetailsService userDetailsService;

    @Bean
    @Override
    public UserDetailsService userDetailsServiceBean() throws Exception {
    return userDetailsService;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() throws Exception {
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setUserDetailsService(userDetailsServiceBean());
    provider.setPasswordEncoder(passwordEncoder());
    return provider;
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
    return new ProviderManager(singletonList(authenticationProvider()));
    }

    @Override
    public void configure(WebSecurity web) {
    web.ignoring()
            .antMatchers("/")
            .antMatchers("/docs/**")
            .antMatchers("/swagger/**")
            .antMatchers("/token/**")
            .antMatchers("/v2/*")
        .antMatchers(HttpMethod.OPTIONS, "/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests().antMatchers("/login**").permitAll().anyRequest().authenticated().and()
            .formLogin().loginPage("/login").permitAll().and()
            .logout().permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }
}

I want resource server be a part of the same application. The purpose is I need a /me endpoint that will provide me details of logged in user and endpoints for managing users. But as soon as I add ResourceServerConfig annotated with EnableResourceServer below I start getting an error "Full authentication is required to access this resource" when I request http://localhost:8200/login.

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    public static final String RESOURCE_ID = "proclaim-auth";

    @Autowired
    private ResourceServerTokenServices tokenServices;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
    resources
            .resourceId(RESOURCE_ID)
            .tokenServices(tokenServices);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/api/ **").authenticated();
    }
}

I suspect that resource server security chain precedes authorization server security chain. I tried to annotate WebSecurityConfig with annotation Order but it did not fix my problem:

@Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    ...
}

What am I doing wrong? Please advise. Thanks in advance!

EDIT 1 I added method configure(HttpSecurity http) into ResourceServerConfig and changed value of Order annotation to -1 on WebSecurityConfig. Now the security filted defined in WebSecurityConfig is applied and the one defined in ResourceServerConfig is ignored. So when I call /me endpoint with valid token I'm redirected to login page.

回答1:

The cause of the problem was wrong configuration of http security in the ResourceServerConfig class. The correct configuration is as follows:

@Override
public void configure(HttpSecurity http) throws Exception {
    http
            .requestMatchers().antMatchers("/api/**").and()
            .authorizeRequests().anyRequest().authenticated();
}

The requestMatchers will ensure that only requests on paths starting with "/api/" will be processed by this security chain. All other requests will be passed to the security chain defined in the WebSecurityConfig class. I was missing this in my config so all requests were processed by the ResourceServerConfig security chain and none request reached the WebSecurityConfig security chain.

来源：https://stackoverflow.com/questions/44532189/enableresourceserver-breaks-oauth2-authorization-server

标签

spring-boot

spring-security

spring-security-oauth2

spring-oauth2