我对 Spring Oauth 和 Spring Security 很陌生。我正在尝试在我的项目中使用 client_credentials 流程。现在,我设法使用自己的 CustomDetailsService 来从系统中已存在的数据库中获取 client_id 和密码(秘密)。唯一的问题是我无法更改 AuthorizationServer 使用的 DaoAuthenticationProvider 中的密码编码器 - 它默认设置为 PlaintextPasswordEncoder。我无法以它使用 SHAPasswordEncoder 的方式配置它。它始终使用明文编码器。我可能不太了解流程,因为我是 Spring 的新手。
这是我的一些代码(DaoAuthenticationProvider 的配置不起作用):
安全配置.java
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
private static final String RESOURCE_ID = "restservice";
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/register/**");
}
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(daoAuthenticationProvider());
}
@Bean
public DaoAuthenticationProvider daoAuthenticationProvider() {
DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
daoAuthenticationProvider.setUserDetailsService(userDetailsService());
daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
return daoAuthenticationProvider;
}
@Bean
public PasswordEncoder passwordEncoder() {
return new ShaPasswordEncoder();
}
@Configuration
@EnableAuthorizationServer
protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
@Autowired
private MyCustomClientDetailsService myCustomClientDetailsService;
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints)
throws Exception {
endpoints.tokenStore(tokenStore());
}
@Bean
public ResourceServerTokenServices defaultTokenServices() {
final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
defaultTokenServices.setSupportRefreshToken(true);
defaultTokenServices.setTokenStore(tokenStore());
return defaultTokenServices;
}
@Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.withClientDetails(myCustomClientDetailsService);
}
@Bean
public MyCustomClientDetailsService detailsService() {
return new MyCustomClientDetailsService();
}
}
@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
...
}
}
以及自定义 ClientDetailsService 类:
public class MyCustomClientDetailsService implements ClientDetailsService {
@Autowired
private UserService userService;
@Override
public ClientDetails loadClientByClientId(String clientId) throws ClientRegistrationException {
User fan = userService.getFan(clientId);
if (fan == null) {
throw new NoSuchClientException("No client with requested id: " + clientId);
}
BaseClientDetails details = new BaseClientDetails(clientId, restservice, "write", "client_credentials", "USER");
details.setClientSecret(fan.getEncodedPassword());
return details;
}
}
从我的 UserService 获取的encodedPassword 始终是一个错误的凭据,因为 DaoAuthenticationProvider 默认设置了 PlaintextPasswordEncoder。
我在那里缺少什么?
是否可以在用于检查凭据的 DaoAuthenticationProvider 中设置密码编码器?或者我是否必须编写自己的 AuthenticationProvider,以便按照我想要的方式检查它?