哪个是正确的OAuth2流

Question

[尝试在春季实施OAuth2。但是卡住了哪一个才是正确的流程？

我保留一个流@Order(1) in (WebSecurityConfigurerAdapter)

点击下面，我将看到默认的登录页面，并成功登录。http://localhost:8301/oauth/authorize?client_id=getidfromfacebook&response_type=code&redirect_uri=http://localhost:9191/xyz重定向到授权页面，接受后获得代码http://localhost:9191/xyz?code=mkuyG4，该代码有助于curl http://localhost:8301/oauth/token -H"Content-type: application/x-www-form-urlencoded" -d'grant_type=authorization_code&redirect_uri=http://localhost:9191/xyz&code=LJQef7' -u getidfromfacebook:getit获取访问权限和刷新令牌我还可以通过curl --location --request POST 'http://localhost:8301/oauth/token?grant_type=refresh_token&client_id=getidfromfacebook&refresh_token=a045acd6-5d66-4db5-a509-4bdadca065e0' -u getidfromfacebook:getit

从给定的刷新令牌中获取一个新的访问令牌。

我在这里面临的问题是，使用给定的访问令牌，我无法访问其中提到的任何资源。antMatchers("/api/**").authenticated() (ResourceServerConfigurerAdapter)。像在邮递员中提供Authorization和值Bearer access-token的标题，还是像curl -H"Authorization: Bearer 1738520f-9f9c-43ef-8f7f-f5886075a7aa" http://localhost:8301/api/users/all/。注意，我也可以获取其他grant_type的访问令牌并刷新它。但是无法通过令牌访问资源。需要注意的是，如果我点击了资源URL，系统将为我提供默认登录名并可以访问它。

另一个流程I 删除 @Order(1)。当我尝试执行授权代码流程时，系统抱怨用户需要登录才能请求（auth）代码。因此，无法继续进行操作（默认登录页面未显示）。但是，我可以继续使用密码授予类型curl http://localhost:8301/oauth/token -d"grant_type=password&username=username&password=userpassword" -H"Content-type:application/x-www-form-urlencoded; charset=utf-8" -u getidfromfacebook:getit我也可以通过访问令牌访问资源。

哪个是正确的方法？为什么我无法使用以前的方法访问资源。

@Configuration
@EnableAuthorizationServer
@AllArgsConstructor                            
public class AuthorizationServerConfigAdapter extends AuthorizationServerConfigurerAdapter {

private final AuthenticationManager authenticationManager;
private final ClientService clientService;
private final UserService userService;

@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    security
            .tokenKeyAccess("permitAll()")
            .checkTokenAccess("isAuthenticated()");
}

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.withClientDetails(clientService);
}

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    endpoints
            .authenticationManager(this.authenticationManager)
            .userDetailsService(userService)
    ;
}

/*****************************/

@Configuration
@EnableResourceServer
public class ResourceServerConfigAdapter extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {
         http
            .authorizeRequests()
            .antMatchers("/api/**").authenticated()
            .antMatchers("/").permitAll();
    }
}

/*****************************/

@Configuration
@EnableWebSecurity
@AllArgsConstructor
@Order(1) // Since we have this working as N, Z and R sever.
public class WebSecurityConfigAdapter extends WebSecurityConfigurerAdapter {

private final UserService userService;

@Override
protected void configure(HttpSecurity http) throws Exception {

    //http.csrf().disable();

    http
            .antMatcher("/**")
            .authorizeRequests()
            .antMatchers("/oauth/authorize**", "/login**", "/error**")
            .permitAll()
            .and()
            .authorizeRequests()
            .anyRequest().authenticated()
            .and()
            .formLogin().permitAll();
}

@Override
protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
    authenticationManagerBuilder
            .userDetailsService(userService)
            .passwordEncoder(passwordEncoder());
}

@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder(BCryptPasswordEncoder.BCryptVersion.$2A);
}

}

Answer 1

@Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .requestMatcher(request -> {
                String auth = request.getHeader("Authorization");
                return (auth != null && auth.startsWith("Bearer"));
            })
            .authorizeRequests()
            .antMatchers("/api/**").authenticated()
            .antMatchers("/").permitAll();
    }