RESTful Web 服务 + Spring Security：带有访问令牌的 API 服务？
Posted
技术标签:
【中文标题】RESTful Web 服务 + Spring Security：带有访问令牌的 API 服务？【英文标题】：RESTful Web service + Spring Security : API service with access token? 【发布时间】：2015-10-21 10:22:29 【问题描述】：我已经在我的 RESTful Web 服务中实现了 Spring Security。
访问令牌的 OAuth 请求
http://localhost:8084/Weekenter/oauth/token?grant_type=password&client_id=restapp&client_secret=restapp&username=anoo@codelynks.com&password=mypass
作为回应，我将获得访问令牌和刷新令牌。
现在我可以通过以下查询字符串参数方法请求具有给定访问令牌的 API 服务。并且完美运行。
请求格式
在上面的快照中，我有
JSON格式的请求，access_token除外。
"mainCategory":"Deals",
"subCategory":"Vigo"
实际上我必须使用以下格式。
"mainCategory":"Deals",
"subCategory":"Vigo",
"access_token":"122356545555"
但是，当我尝试这个时，它会抛出错误
<oauth>
<error_description>
An Authentication object was not found in the SecurityContext
</error_description>
<error>
unauthorized
</error>
</oauth>
spring-security.xml
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc"
xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd ">
<!-- This is default url to get a token from OAuth -->
<http pattern="/oauth/token" create-session="stateless"
authentication-manager-ref="clientAuthenticationManager"
xmlns="http://www.springframework.org/schema/security">
<intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
<anonymous enabled="false" />
<http-basic entry-point-ref="clientAuthenticationEntryPoint" />
<!-- include this only if you need to authenticate clients via request
parameters -->
<custom-filter ref="clientCredentialsTokenEndpointFilter"
after="BASIC_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<!-- This is where we tells spring security what URL should be protected
and what roles have access to them -->
<!-- <http pattern="/api/**" create-session="never"
entry-point-ref="oauthAuthenticationEntryPoint"
access-decision-manager-ref="accessDecisionManager"
xmlns="http://www.springframework.org/schema/security">
<anonymous enabled="false" />
<intercept-url pattern="/api/**" access="ROLE_APP" />
<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>-->
<http pattern="/utililty/**" create-session="never"
entry-point-ref="oauthAuthenticationEntryPoint"
access-decision-manager-ref="accessDecisionManager"
xmlns="http://www.springframework.org/schema/security">
<anonymous enabled="false" />
<intercept-url pattern="/utililty/getNationalityList" access="ROLE_APP" />
<intercept-url pattern="/utililty/getSettingsUrl" access="ROLE_APP" />
<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<http pattern="/admin/**" create-session="never"
entry-point-ref="oauthAuthenticationEntryPoint"
access-decision-manager-ref="accessDecisionManager"
xmlns="http://www.springframework.org/schema/security">
<anonymous enabled="false" />
<intercept-url pattern="/admin/fetch-sub-category" access="ROLE_APP" />
<intercept-url pattern="/admin/create-category" access="ROLE_APP" />
<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<bean id="oauthAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
<property name="realmName" value="test" />
</bean>
<bean id="clientAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
<property name="realmName" value="test/client" />
<property name="typeName" value="Basic" />
</bean>
<bean id="oauthAccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
<bean id="clientCredentialsTokenEndpointFilter"
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
<property name="authenticationManager" ref="clientAuthenticationManager" />
</bean>
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
xmlns="http://www.springframework.org/schema/beans">
<constructor-arg>
<list>
<bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
<bean class="org.springframework.security.access.vote.RoleVoter" />
<bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
</list>
</constructor-arg>
</bean>
<authentication-manager id="clientAuthenticationManager"
xmlns="http://www.springframework.org/schema/security">
<authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>
<!-- Custom User details service which is provide the user data -->
<bean id="customUserDetailsService"
class="com.weekenter.www.service.impl.CustomUserDetailsService" />
<!-- Authentication manager -->
<authentication-manager alias="authenticationManager"
xmlns="http://www.springframework.org/schema/security">
<authentication-provider user-service-ref="customUserDetailsService">
<password-encoder hash="plaintext">
</password-encoder>
</authentication-provider>
</authentication-manager>
<bean id="clientDetailsUserService"
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<constructor-arg ref="clientDetails" />
</bean>
<!-- This defined token store, we have used inmemory tokenstore for now
but this can be changed to a user defined one -->
<bean id="tokenStore"
class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" />
<!-- This is where we defined token based configurations, token validity
and other things -->
<bean id="tokenServices"
class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
<property name="tokenStore" ref="tokenStore" />
<property name="supportRefreshToken" value="true" />
<property name="accessTokenValiditySeconds" value="120" />
<property name="clientDetailsService" ref="clientDetails" />
</bean>
<bean id="userApprovalHandler"
class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler">
<property name="tokenServices" ref="tokenServices" />
</bean>
<oauth:authorization-server
client-details-service-ref="clientDetails" token-services-ref="tokenServices"
user-approval-handler-ref="userApprovalHandler">
<oauth:authorization-code />
<oauth:implicit />
<oauth:refresh-token />
<oauth:client-credentials />
<oauth:password />
</oauth:authorization-server>
<oauth:resource-server id="resourceServerFilter"
resource-id="test" token-services-ref="tokenServices" />
<oauth:client-details-service id="clientDetails">
<!-- client -->
<oauth:client client-id="restapp"
authorized-grant-types="authorization_code,client_credentials"
authorities="ROLE_APP" scope="read,write,trust" secret="secret" />
<oauth:client client-id="restapp"
authorized-grant-types="password,authorization_code,refresh_token,implicit"
secret="restapp" authorities="ROLE_APP" />
</oauth:client-details-service>
<sec:global-method-security
pre-post-annotations="enabled" proxy-target-class="true">
<!--you could also wire in the expression handler up at the layer of the
http filters. See https://jira.springsource.org/browse/SEC-1452 -->
<sec:expression-handler ref="oauthExpressionHandler" />
</sec:global-method-security>
<oauth:expression-handler id="oauthExpressionHandler" />
<oauth:web-expression-handler id="oauthWebExpressionHandler" />
</beans>
自定义身份验证处理程序
@Service
@Transactional(readOnly = true)
public class CustomUserDetailsService implements UserDetailsService
@Autowired
private LoginDao loginDao;
public UserDetails loadUserByUsername(String login)
throws UsernameNotFoundException
boolean enabled = true;
boolean accountNonExpired = true;
boolean credentialsNonExpired = true;
boolean accountNonLocked = true;
com.weekenter.www.entity.User user = null;
try
user = loginDao.getUser(login);
if (user != null)
if (user.getStatus().equals("1"))
enabled = false;
else
throw new UsernameNotFoundException(login + " Not found !");
catch (Exception ex)
try
throw new Exception(ex.getMessage());
catch (Exception ex1)
return new User(
user.getEmail(),
user.getPassword(),
enabled,
accountNonExpired,
credentialsNonExpired,
accountNonLocked,
getAuthorities()
);
public Collection<? extends GrantedAuthority> getAuthorities()
List<GrantedAuthority> authList = getGrantedAuthorities(getRoles());
return authList;
public List<String> getRoles()
List<String> roles = new ArrayList<String>();
roles.add("ROLE_APP");
return roles;
public static List<GrantedAuthority> getGrantedAuthorities(List<String> roles)
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
for (String role : roles)
authorities.add(new SimpleGrantedAuthority(role));
return authorities;
【问题讨论】：
投反对票的人能否解释一下为什么这样做？ 为什么要将 access_token 保留在 json 中？您可以使用 POST 方法并仍然将 acces_token 保留为 url 参数。 这可能是一个安全问题，对@jgr？ 【参考方案1】：为什么要通过请求正文传递访问令牌。您需要通过标头传递令牌。以下是处理访问和刷新令牌的 3 步过程 -
1- 获取访问令牌 -
http://localhost:8080/webapp/oauth/token?grant_type=password&client_id=abc&client_secret=xyz&username=user1&password=user1
此请求为您提供访问令牌和刷新令牌。
2- 将此访问令牌作为标头传递并访问受保护的资源
http://localhost:8080/webapp/calendar/doctor/search?cityid=1
标题：
授权 = 承载 f8e5f8cc-9465-4789-8734-9fa97e9fe05a
3- 如果之前的 Token 过期，则获取新的 Access Token。
http://localhost:8080/webapp/oauth/token?grant_type=refresh_token&client_id=client1&client_secret=client1&refresh_token=323872a7-5d25-40a6-adc6-80e19c5c8cea
拥有如下认证提供者 -
import java.util.ArrayList;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.GrantedAuthority;
public class HealthcareUserAuthenticationProvider implements AuthenticationProvider
public Authentication authenticate(Authentication authentication) throws AuthenticationException
AppPasswordAuthenticationToken userPassAuthToken;
List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
String userName = (String) authentication.getPrincipal();
if (authentication.getCredentials().equals(AppSecurityDAO.getDocUserPassword(userName)))
userPassAuthToken = new HealthcareUserPasswordAuthenticationToken(authentication.getPrincipal(),
authentication.getCredentials(), grantedAuthorities);
else if (authentication.getCredentials().equals(AppSecurityDAO.getUserPassword(userName)))
userPassAuthToken = new AppUserPasswordAuthenticationToken(authentication.getPrincipal(),
authentication.getCredentials(), grantedAuthorities);
else
throw new BadCredentialsException("Bad User Credentials.");
return userPassAuthToken;
有如下客户详细信息服务 -
@Service
public class HealthcareClientDetailsService implements ClientDetailsService
@Autowired
AppSecurityDAO appSecurityDAO;
public ClientDetails loadClientByClientId(String clientId) throws OAuth2Exception
String clientSecret = appSecurityDAO.getClientOauthSecret(clientId);
if (clientId.equals("client1"))
List<String> authorizedGrantTypes = new ArrayList<String>();
authorizedGrantTypes.add("password");
authorizedGrantTypes.add("refresh_token");
authorizedGrantTypes.add("client_credentials");
BaseClientDetails clientDetails = new BaseClientDetails();
clientDetails.setClientId(clientId);
clientDetails.setClientSecret(clientSecret);
clientDetails.setAuthorizedGrantTypes(authorizedGrantTypes);
return clientDetails;
else if (clientId.equals("client2"))
List<String> authorizedGrantTypes = new ArrayList<String>();
authorizedGrantTypes.add("password");
authorizedGrantTypes.add("refresh_token");
authorizedGrantTypes.add("client_credentials");
BaseClientDetails clientDetails = new BaseClientDetails();
clientDetails.setClientId("client2");
clientDetails.setClientSecret("client2");
clientDetails.setAuthorizedGrantTypes(authorizedGrantTypes);
return clientDetails;
else
throw new NoSuchClientException("No client with requested id: " + clientId);
并拥有您自己的自定义凭据验证，即 AppUserPasswordAuthenticationToken 如下 -
public class AppUserPasswordAuthenticationToken extends AbstractAuthenticationToken --
private static final long serialVersionUID = 310L;
private final Object principal;
private Object credentials;
private int loginId;
public int getLoginId()
return loginId;
public void setLoginId(int loginId)
this.loginId = loginId;
public AppUserPasswordAuthenticationToken(Object principal, Object credentials) --
super(null);
this.principal = principal;
this.credentials = credentials;
setAuthenticated(false);
public AppUserPasswordAuthenticationToken(Object principal, Object credentials,--
Collection<? extends GrantedAuthority> authorities)
super(authorities);
this.principal = principal;
this.credentials = credentials;
super.setAuthenticated(true);
public Object getCredentials()
return this.credentials;
public Object getPrincipal()
return this.principal;
public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException
if (isAuthenticated)
throw new IllegalArgumentException(
"Cannot set this token to trusted");
super.setAuthenticated(false);
public void eraseCredentials()
super.eraseCredentials();
this.credentials = null;
【讨论】：
您是否想说我们不会更改 Web 服务部分中的任何配置以从客户端请求带有标头的令牌？ spring-security 会从Header 获取访问令牌而不做任何特别的事情吗？
您需要准备好所有配置，否则您将如何获得访问/刷新令牌。使用所有配置，您可以按照我上面解释的方式访问它。
默认从头部获取。您仍然需要有实现 AuthenticationProvider 的 UserAuthenticationProvider。在这里，您将有自己的逻辑/检查来发布令牌或拒绝它。
你可以看到我已经使用了自定义身份验证提供程序，它实现了UserDetailsService..为什么我应该手动编写它将由 spring 自己处理的令牌逻辑，对吗？我可以在UserDetailsService 中抛出异常，如果它抛出了访问令牌可能无法在我的原因中提供
好吧，不是真的。您必须验证请求，然后才能发出令牌。您可以实现 AuthenticationProvider 来做到这一点。我正在编辑我的答案，请检查。以上是关于RESTful Web 服务 + Spring Security：带有访问令牌的 API 服务？的主要内容，如果未能解决你的问题，请参考以下文章
如何使用 Spring RESTful Web 服务处理 CSRF 保护？
[译]Spring Boot 构建一个RESTful Web服务
Spring Webflux 构建响应式 Restful Web 服务
Spring Webflux 构建响应式 Restful Web 服务