Spring Security-OAuth2でWebSecurityアダプタを使用する方法

Question

OAuth2と単純なSpring Security（Web Securityアダプタ）を使用して認証システムを実現しようとしています。しかし、設定しようとしているので、私は両方のサービスを一緒に使用することはできません。下記の共有設定ファイルコードに従って、しかし、それはOAuth2またはスプリングセキュリティ（Webセキュリティーアダプター）を使用した単純な認証を使用します。私は両方の認証システムがURLの識別に基づいて動作する必要があります。

ありがとうございます！

@Configuration 
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, proxyTargetClass = true) 
public class ConfigurationClass { 

    // Its working as simple auth spring security 
    @EnableWebSecurity 
    @Configuration 
    @Order(1) 
    protected static class StatelessAuthenticationSecurityConfig extends WebSecurityConfigurerAdapter { 
     @Autowired 
     private UserDetailsService userDetailsService; 

     @Autowired 
     private TokenAuthenticationService tokenAuthenticationService; 

     @Autowired 
     private OtpManage OtpManage; 

     @Autowired 
     private RoleRepository RoleRepository; 

     public StatelessAuthenticationSecurityConfig() { 
      super(true); 

     } 


     @Override 
     protected void configure(HttpSecurity http) throws Exception { 

      // allow anonymous resource requests 
      .antMatchers("/").permitAll() 

      // allow anonymous POSTs to login 
      .antMatchers(HttpMethod.POST, "/user/registration").permitAll() 
      .antMatchers(HttpMethod.POST, "/user/changepassword").permitAll() 
      .antMatchers(HttpMethod.POST, "/user/resetpassword").permitAll() 
      // .antMatchers(HttpMethod.POST, 
      // "/api/otpResetPassword").permitAll() 
      .antMatchers(HttpMethod.POST, "/user/saveusergroup").permitAll() 
      .antMatchers(HttpMethod.POST, "/user/bugreport").permitAll() 
      .antMatchers(HttpMethod.POST, "/user/createtoken").permitAll() 

      // .anyRequest().authenticated().and() 
      .anyRequest().hasAnyRole("USER","SYSTEM_ADMIN","ADMIN").and() 

      // custom JSON based authentication by POST of 
      // {"username":"<name>","password":"<password>"} which sets the 
      // token header upon authentication 
      .addFilterBefore(new StatelessLoginFilter("/api/login", tokenAuthenticationService, userDetailsService, 
        authenticationManager(), OtpManage), UsernamePasswordAuthenticationFilter.class) 


      // custom Token based authentication based on the header 
      // previously given to the client 
      .addFilterBefore(new StatelessAuthenticationFilter(tokenAuthenticationService), 
        UsernamePasswordAuthenticationFilter.class); 


     } 

     @Bean 
     @Override 
     public AuthenticationManager authenticationManagerBean() throws Exception { 
      return super.authenticationManagerBean(); 
     } 

     @Override 
     protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
      auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder()); 
     } 

     @Override 
     protected UserDetailsService userDetailsService() { 
      return userDetailsService; 
     } 

    } 

    // Its not working, But if I removed @Order(1) annotation from StatelessAuthenticationSecurityConfig class then this one will work as default 
    @Configuration 
    @EnableResourceServer 
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter { 

     @Autowired 
     private CustomAuthenticationEntryPoint customAuthenticationEntryPoint; 

     @Autowired 
     private CustomLogoutSuccessHandler customLogoutSuccessHandler; 

     @Override 
     public void configure(HttpSecurity http) throws Exception { 
      System.out.println("@EnableResourceServer"); 
      http 
        .exceptionHandling() 
        .authenticationEntryPoint(customAuthenticationEntryPoint) 
        .and() 
        .logout() 
        .logoutUrl("/oauth/logout") 
        .logoutSuccessHandler(customLogoutSuccessHandler) 
        .and() 
        .csrf() 
        .requireCsrfProtectionMatcher(new AntPathRequestMatcher("/oauth/authorize")) 
        .disable() 
        .headers() 
        .frameOptions().disable().disable() 
        .sessionManagement() 
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
        .and() 
        .authorizeRequests() 
        .antMatchers("/hello/").permitAll() 
        .antMatchers("/secure/**").authenticated(); 

     } 

    } 

    @Configuration 
    @EnableAuthorizationServer 
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter implements EnvironmentAware { 

     private static final String ENV_OAUTH = "authentication.oauth."; 
     private static final String PROP_CLIENTID = "clientid"; 
     private static final String PROP_SECRET = "secret"; 
     private static final String PROP_TOKEN_VALIDITY_SECONDS = "tokenValidityInSeconds"; 

     private RelaxedPropertyResolver propertyResolver; 

     @Autowired 
     private DataSource dataSource; 

     @Bean 
     public TokenStore tokenStore() { 
      return new JdbcTokenStore(dataSource); 
     } 

     @Autowired 
     @Qualifier("authenticationManagerBean") 
     private AuthenticationManager authenticationManager; 

     @Override 
     public void configure(AuthorizationServerEndpointsConfigurer endpoints) 
       throws Exception { 
      endpoints 
        .tokenStore(tokenStore()) 
        .authenticationManager(authenticationManager); 
     } 

     @Override 
     public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
      System.out.println("@AuthorizationServerConfigurerAdapter"); 
      clients 
        .inMemory() 
        .withClient(propertyResolver.getProperty(PROP_CLIENTID)) 
        .scopes("read", "write") 
        .authorities(Authorities.ROLE_ADMIN.name(), Authorities.ROLE_USER.name()) 
        .authorizedGrantTypes("password", "refresh_token") 
        .secret(propertyResolver.getProperty(PROP_SECRET)) 
        .accessTokenValiditySeconds(propertyResolver.getProperty(PROP_TOKEN_VALIDITY_SECONDS, Integer.class, 1800)); 
     } 

     @Override 
     public void setEnvironment(Environment environment) { 
      this.propertyResolver = new RelaxedPropertyResolver(environment, ENV_OAUTH); 
     } 

    } 

} 

アップデート：私はEnableOAuth2Client、@Order（SecurityProperties.ACCESS_OVERRIDE_ORDER） @で自分のコードにいくつかの変更を加えていると私はまさに私が何をしたいのか達成している

。しかし、今問題は私は投稿URL："/ api/login"をユーザー資格情報で呼び出すことができないということです。 のURLが見つかりませんでしたというエラーが表示されます。 WebSecurityConfigクラスの自分のコードに従って、AbstractAuthenticationProcessingFilterを継承するloginFilterクラスのconfigure（HttpSecurity http）メソッドにfilterを追加しました。しかし、 "/ api/login" URLでマップされているこのフィルタはまったく動作しません。なぜこの1つのフィルターが機能していないのですかわかりません。誰かが同じことについて私を助けてくれますか？

#WebSecurityConfigClass

/** 
* Implementation of HttpSecurity configure method 
* Implementation custom JSON based authentication by POST of {"username":"<name>","password":"<password>"} which sets the token header upon authentication 
* @author Santosh 
* 
*/ 
@EnableOAuth2Client 
@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled=true, securedEnabled = true, proxyTargetClass = true) 
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private UserDetailsService userDetailsService; 

    @Autowired 
    private TokenAuthenticationService tokenAuthenticationService; 

    @Autowired 
    private MessageSource messages; 

    @Autowired 
    private RESTAuthenticationEntryPoint authenticationEntryPoint; 

    @Autowired 
    private RESTAuthenticationSuccessHandler restAuthenticationSuccessHandler; 

    @Autowired 
    private RESTAuthenticationFailureHandler restAuthenticationFailureHandler; 

    @Autowired 
    private CustomAccessDeniedHandler accessDeniedHandler; 

    public WebSecurityConfig() { 
     super(true); 
    } 

    /*@Autowired 
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception { 
     auth.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN"); 
     auth.inMemoryAuthentication().withUser("testUser").password("testUser").roles("USER"); 
    } 
*/ 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { 

     // setup security 
     http 
     .exceptionHandling() 
     .accessDeniedHandler(accessDeniedHandler) 
     .authenticationEntryPoint(authenticationEntryPoint) 
     .and() 
     .authorizeRequests() 
      .anyRequest() 
       .fullyAuthenticated() 
       .and().httpBasic(); 

     http 
     .exceptionHandling() 
     .accessDeniedHandler(accessDeniedHandler) 
     .authenticationEntryPoint(authenticationEntryPoint) 
     .and() 
     .anonymous().and() 
     .servletApi().and() 
     .headers().and() 
     .authorizeRequests() 
     .antMatchers(HttpMethod.POST, "/api/login").permitAll() 

     .antMatchers("/admin/**").hasRole("ADMIN") 
     .and() 
     .authorizeRequests() 
     .anyRequest().hasAnyRole("USER").and() 
     //all other request need to be authenticated 
     // custom JSON based authentication by POST of {"username":"<name>","password":"<password>"} which sets the token header upon authentication 
     .addFilterBefore(new LoginFilter("/api/login", tokenAuthenticationService, userDetailsService, authenticationManager(), restAuthenticationSuccessHandler, restAuthenticationFailureHandler), UsernamePasswordAuthenticationFilter.class) 
     // custom Token based authentication based on the header previously given to the client 
     .addFilterBefore(new ApplicationFilter (tokenAuthenticationService, messages), UsernamePasswordAuthenticationFilter.class); 

    } 

// To allow Pre-flight [OPTIONS] request from browser 
    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**"); 
     web.ignoring()//allow anonymous GETs to API 
     .antMatchers(HttpMethod.GET, "/api/status/**"); 
    } 

    @Bean 
    public RequestContextListener requestContextListener(){ 
     return new RequestContextListener(); 
    } 

    @Bean 
    public PasswordEncoder encoder() { 
     return new BCryptPasswordEncoder(); 
    } 

    @Bean 
    public CustomBasicAuthenticationEntryPoint getBasicAuthEntryPoint(){ 
     return new CustomBasicAuthenticationEntryPoint(); 
    } 

    @Bean(name="authenticationManagerBean") 
    @Override 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 
} 

＃1 OAuth2ServerConfiguration

@Configuration 
public class OAuth2ServerConfiguration { 

    private static final String RESOURCE_ID = "restservice"; 
    private static final String ROLE_ADMIN = "ADMIN"; 

    @Configuration 
    @EnableResourceServer 
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter { 

     @Autowired 
     private CustomOAuth2AccessDeniedHandler accessDeniedHandler; 

     @Autowired 
     private RESTOAuth2AuthenticationEntryPoint restAuthenticationEntryPoint; 

     @Override 
     public void configure(ResourceServerSecurityConfigurer resources) { 
      resources.resourceId(RESOURCE_ID); 
     } 

     @Override 
     public void configure(HttpSecurity http) throws Exception { 

      http 
      .authorizeRequests() 
      .antMatchers("/api/hello").permitAll() 
      .antMatchers("https://stackoverflow.com/users/current/**","/oauth/token","/oauth/authorize","/oauth/refresh_token").permitAll() 
      .antMatchers("/api/greeting").authenticated().and().exceptionHandling() 
        .accessDeniedHandler(accessDeniedHandler) 
        .authenticationEntryPoint(restAuthenticationEntryPoint); 
     } 


    } 

    @Configuration 
    @EnableAuthorizationServer 
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter { 

     @Autowired 
     @Qualifier("authenticationManagerBean") 
     private AuthenticationManager authenticationManager; 

     @Autowired 
     private UserDetailsService userDetailsService; 

     @Autowired 
     private DataSource dataSource; 

     @Autowired 
     private TokenStore tokenStore; 

     @Bean 
     public TokenStore tokenStore() { 
      return new JdbcTokenStore(dataSource); 
     } 

//  @Autowired 
//  private UserApprovalHandler userApprovalHandler; 

     @Override 
     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { 

      endpoints.tokenStore(this.tokenStore).authenticationManager(this.authenticationManager) 
        .userDetailsService(userDetailsService); 
//   .userApprovalHandler(userApprovalHandler) 
     } 

     @Override 
     public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
//   jdbc(dataSource) 
      clients.inMemory().withClient("clientapp").authorizedGrantTypes("password", "refresh_token") 
        .authorities("USER").scopes("read", "write").resourceIds(RESOURCE_ID).secret("123456") 
        .accessTokenValiditySeconds(20)// Access token is only valid 
                // for 2 minutes. 
        .refreshTokenValiditySeconds(1200);// Refresh token is only 
                 // valid for 10 
                 // minutes.; 

     } 

     @Bean 
     @Primary 
     public DefaultTokenServices tokenServices() { 
      DefaultTokenServices tokenServices = new DefaultTokenServices(); 
      tokenServices.setSupportRefreshToken(true); 
      tokenServices.setTokenStore(this.tokenStore); 
      return tokenServices; 
     } 

    } 

} 

Answer 1

WebSecurityAdapterあなたがHttpSecurityのインスタンスが起動することを要求する上で決定するためにrequestMatchersを構築したいあなたに。例えば

：

protected void configure(HttpSecurity http) throws Exception { 
    http.requestMatchers().antMatchers("/secure/path", "/more/secure/path"); 
    // Rest of your configuration. 
}