我似乎无法使我的安全配置正确.无论我在使用hasRole
端点时做什么,总是返回403.
此外,除非我重复我的,我不能得到任何工作antMatchers
下都.requestMatchers()
和.authorizeRequests()
.我在这里显然遗漏了一些东西.
基本上我希望一切都要求身份验证,但只有一些端点只有在用户是某些组的成员时才可访问(现在只是管理员).
我的安全配置如下.除了hasRole
工作之外的一切.
@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableWebSecurity
@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.requestMatchers()
.antMatchers(HttpMethod.GET, "/v2/api-docs", "/swagger-resources/**", "/swagger-ui.html")
.antMatchers(HttpMethod.GET, "/users")
.and()
.authorizeRequests()
.antMatchers(HttpMethod.GET, "/v2/api-docs", "/swagger-resources/**", "/swagger-ui.html").permitAll()
.antMatchers(HttpMethod.GET, "/users").hasRole("ADMIN")
.anyRequest().authenticated();
}
// Inspiration: https://spring.io/blog/2015/06/08/cors-support-in-spring-framework#comment-2416096114
@Override
public void configure(WebSecurity web) throws Exception {
web
.ignoring()
.antMatchers(HttpMethod.OPTIONS, "/**");
}
}
我的AuthenticationConfiguration如下
@Configuration @EnableResourceServer public class AuthenticationConfiguration extends GlobalAuthenticationConfigurerAdapter { private final UserDetailsService userService; private final PasswordEncoder passwordEncoder; public AuthenticationConfiguration(UserDetailsService userService, PasswordEncoder passwordEncoder) { this.userService = userService; this.passwordEncoder = passwordEncoder; } @Override public void init(AuthenticationManagerBuilder auth) throws Exception { auth .userDetailsService(userService) .passwordEncoder(passwordEncoder); } }
我的AuthorizationServerConfiguration如下
@Configuration @EnableAuthorizationServer public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter { private final AuthenticationManager authenticationManager; public AuthorizationServerConfiguration(AuthenticationManager authenticationManager) { this.authenticationManager = authenticationManager; } @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { endpoints.authenticationManager(authenticationManager); } @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { clients .inMemory() .withClient("html5") .secret("password") .authorizedGrantTypes("password") .scopes("openid"); } }
我很高兴发布我的用户服务和其他东西.但是一切似乎都在旁边工作,hasRole
并且Principal
充满了正确的权威(角色).但如果我要发布更多代码,请告诉我.
整个源代码可以在这里找到.