在 spring 引导中使用 InMemoryUserDetails 获取错误凭据

Question

我正在使用 spring boot oauth，在进行授权时，即使我使用了 inMemory，我也无法验证我的凭据。

我的授权服务器：

@Configuration
@EnableAuthorizationServer
@Import(ServerWebSecurityConfig.class)
public class OAuth2AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    static final String CLIEN_ID = "ipro-client";
    static final String CLIENT_SECRET = "ipro-secret";
    static final String GRANT_TYPE = "password";
    static final String AUTHORIZATION_CODE = "authorization_code";
    static final String REFRESH_TOKEN = "refresh_token";
    static final String IMPLICIT = "implicit";
    static final String SCOPE_READ = "read";
    static final String SCOPE_WRITE = "write";
    static final String TRUST = "trust";
    static final int ACCESS_TOKEN_VALIDITY_SECONDS = 1 * 60 * 60;
    static final int FREFRESH_TOKEN_VALIDITY_SECONDS = 6 * 60 * 60;
    static final String REDIRECT_URI = "http://localhost:8888/login";

    /*@Autowired
    @Qualifier("ibrdatasource")
    private DataSource dataSource;*/

    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    endpoints.tokenStore(tokenStore()).accessTokenConverter(accessTokenConverter())
        .authenticationManager(authenticationManager).userDetailsService(userDetailsService);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
    oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("permitAll()");
    }

    @Bean
    public TokenStore tokenStore() {
    return new JwtTokenStore(accessTokenConverter());
    }

    /*
     * @Override public void configure(ClientDetailsServiceConfigurer clients)
     * throws Exception { JdbcClientDetailsService jdbcClientDetailsService = new
     * JdbcClientDetailsService(dataSource);
     * clients.withClientDetails(jdbcClientDetailsService); }
     */

    @Override
    public void configure(ClientDetailsServiceConfigurer configurer) throws Exception {

    configurer.inMemory().withClient(CLIEN_ID).secret(CLIENT_SECRET)
        .authorizedGrantTypes(GRANT_TYPE, AUTHORIZATION_CODE, REFRESH_TOKEN, IMPLICIT)
        .scopes(SCOPE_READ, SCOPE_WRITE, TRUST).redirectUris(REDIRECT_URI)
        .accessTokenValiditySeconds(ACCESS_TOKEN_VALIDITY_SECONDS)
        .refreshTokenValiditySeconds(FREFRESH_TOKEN_VALIDITY_SECONDS);
    }

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
    JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
    converter.setSigningKey("123");
    return converter;
    }

    @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
    DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
    defaultTokenServices.setTokenStore(tokenStore());
    defaultTokenServices.setSupportRefreshToken(true);
    return defaultTokenServices;
    }

    @Bean
    public PasswordEncoder userPasswordEncoder() {
    return new BCryptPasswordEncoder(4);
    }



}

我正在添加带有 inMemrory 数据的用户详细信息：

 @Bean
    public UserDetailsService userDetailsService() {

    InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
    manager.createUser(User.withUsername("user").password("user").roles("USER").build());
    manager.createUser(User.withUsername("admin").password("password").roles("USER", "ADMIN").build());
    return manager;

    }

但我无法验证这些细节。它显示了错误的凭据。请帮助我解决这个问题，任何帮助都会很棒。

Answer 1

这可能是因为您没有对密码进行编码。

设置密码时使用BCryptPasswordEncoder。此外，您必须告诉 AuthenticationManagerBuilder 您正在内存中进行身份验证。

创建一个从 WebSecurityConfigurerAdapter 扩展的 class，注入 BCryptPasswordEncoder 类型的 bean 并在定义内存中身份验证时使用它。

SecurityConfiguration.java

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private BCryptPasswordEncoder passwordEncoder;

    @Autowired
    public void globalUserDetails(final AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("user").password(this.passwordEncoder.encode("user")).roles("USER").and()
            .withUser("admin").password(this.passwordEncoder.encode("admin")).roles("USER", "ADMIN").and()
    }
}

Answer 2

 @Bean
    public PasswordEncoder userPasswordEncoder() {
    return new BCryptPasswordEncoder(4);
    }

    @Autowired
    PasswordEncoder passwordEncoder;

    @Bean
    public UserDetailsService userDetailsService() {
    InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
    manager.createUser(
        User.withUsername("user").password(this.passwordEncoder.encode("user")).roles("USER").build());
    manager.createUser(User.withUsername("admin").password(this.passwordEncoder.encode("password"))
        .roles("USER", "ADMIN").build());
    return manager;

    }`enter code here`

在 spring 引导中使用 InMemoryUserDetails 获取错误凭据

Getting Bad credentials with InMemoryUserDetails in spring boot

oauth-2.0

spring-boot

microservices

spring-security-rest

jwt-auth