Spring Oauth2 提供程序 PreAuthorize 注入自动装配失败

Question

我正在尝试通过使用 @PreAuthorize 注释保护控制器方法来增强我的 OAuth2 提供程序的安全性。我还添加了 @EnableGlobalMethodSecurity，因此 @PreAuthorize 可以与 oauth 一起使用。

这是我当前的设置：

@Configuration
@ComponentScan
@EnableAutoConfiguration
@EnableResourceServer
@RestController
public class Application {

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }

    @RequestMapping("/")
    public String home() {
        return "Hello World";
    }

    @PreAuthorize("#oauth2.clientHasRole('ROLE_CUSTOM')")
    @RequestMapping("/a")
    public String a() {
        return "foo";
    }

    @PreAuthorize("#oauth2.clientHasRole('ROLE_TRUSTED_CLIENT')")
    @RequestMapping("/b")
    public String b() {
        return "bar";
    }

    // So that @PreAuthorize notations would work
    @Configuration
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public static class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
        @Override
        protected MethodSecurityExpressionHandler createExpressionHandler() {
            return new OAuth2MethodSecurityExpressionHandler();
        }
    }

    @Configuration
    @EnableWebSecurity
    public static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.authenticationManager(authenticationManager).tokenStore(tokenStore());
        }

        @Bean
        public ApprovalStore approvalStore() throws Exception {
            TokenApprovalStore store = new TokenApprovalStore();
            store.setTokenStore(tokenStore());
            return store;
        }

        @Bean
        public TokenStore tokenStore() {
            return new InMemoryTokenStore();
        }

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            // @formatter:off
            clients.inMemory()
                .withClient("my-trusted-client")
                    .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                    .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
                    .scopes("read", "write", "trust")
                    .resourceIds("oauth2-resource")
                    .accessTokenValiditySeconds(60)
            .and()
                .withClient("my-client-with-registered-redirect")
                    .authorizedGrantTypes("authorization_code")
                    .authorities("ROLE_CLIENT")
                    .scopes("read", "trust")
                    .resourceIds("oauth2-resource")
                    .redirectUris("http://anywhere?key=value")
            .and()
                .withClient("my-client-with-secret")
                    .authorizedGrantTypes("client_credentials", "password")
                    .authorities("ROLE_CLIENT","ROLE_CUSTOM")
                    .scopes("read")
                    .resourceIds("oauth2-resource")
                    .secret("secret");
        // @formatter:on
        } 
    }
}

当我删除 @PreAuthorize 符号时它有效，但是当我添加它们时，编译器抛出大量 missing injection of autowired 异常，我不能真正查明也找不到解释真正导致问题的原因。

Here's my output

很抱歉，我无法提供任何额外的输出或研究，有点卡在这一点上。

Answer 1

尝试从其余配置中提取 @RestController class。

除了全能配置 classes 维护起来很麻烦之外，Spring 可能在配置方法安全性和在同一 class 中使用它方面存在问题.

Spring Oauth2 提供程序 PreAuthorize 注入自动装配失败

Spring Oauth2 provider PreAuthorize failed to inject autowired

java

spring

dependency-injection

oauth2