spring oauth2 server grant by password Access is denied (user is anonymous) - spring

Question

I try to setup a authserver, but when it get token in Advance rest client,it can't grant by password and input basic user and password Access is denied (user is anonymous)
2017-03-23 21:18:56.788[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m Trying to match using Ant [pattern='/logout', PUT]
[2m2017-03-23 21:18:56.788[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Request 'GET /oauth/token' doesn't match 'PUT /logout
[2m2017-03-23 21:18:56.789[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m Trying to match using Ant [pattern='/logout', DELETE]
[2m2017-03-23 21:18:56.789[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Request 'GET /oauth/token' doesn't match 'DELETE /logout
[2m2017-03-23 21:18:56.789[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.web.util.matcher.OrRequestMatcher [0;39m [2m:[0;39m No matches found
[2m2017-03-23 21:18:56.789[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.security.web.FilterChainProxy [0;39m [2m:[0;39m /oauth/token?client_id=client&client_secret=secret&grant_type=password&username=reader&password=reader at position 5 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
[2m2017-03-23 21:18:56.790[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.security.web.FilterChainProxy [0;39m [2m:[0;39m /oauth/token?client_id=client&client_secret=secret&grant_type=password&username=reader&password=reader at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
[2m2017-03-23 21:18:56.790[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.security.web.FilterChainProxy [0;39m [2m:[0;39m /oauth/token?client_id=client&client_secret=secret&grant_type=password&username=reader&password=reader at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
[2m2017-03-23 21:18:56.792[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.security.web.FilterChainProxy [0;39m [2m:[0;39m /oauth/token?client_id=client&client_secret=secret&grant_type=password&username=reader&password=reader at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
[2m2017-03-23 21:18:56.795[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.a.AnonymousAuthenticationFilter [0;39m [2m:[0;39m Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken#9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
[2m2017-03-23 21:18:56.796[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.security.web.FilterChainProxy [0;39m [2m:[0;39m /oauth/token?client_id=client&client_secret=secret&grant_type=password&username=reader&password=reader at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
[2m2017-03-23 21:18:56.796[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.session.SessionManagementFilter [0;39m [2m:[0;39m Requested session ID 72A53EBFC2683D7F4CEAF0BF51D76993 is invalid.
[2m2017-03-23 21:18:56.796[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.security.web.FilterChainProxy [0;39m [2m:[0;39m /oauth/token?client_id=client&client_secret=secret&grant_type=password&username=reader&password=reader at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
[2m2017-03-23 21:18:56.796[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.security.web.FilterChainProxy [0;39m [2m:[0;39m /oauth/token?client_id=client&client_secret=secret&grant_type=password&username=reader&password=reader at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
[2m2017-03-23 21:18:56.798[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/oauth/token'; against '/oauth/token'
[2m2017-03-23 21:18:56.798[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.a.i.FilterSecurityInterceptor [0;39m [2m:[0;39m Secure object: FilterInvocation: URL: /oauth/token?client_id=client&client_secret=secret&grant_type=password&username=reader&password=reader; Attributes: [fullyAuthenticated]
[2m2017-03-23 21:18:56.798[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.a.i.FilterSecurityInterceptor [0;39m [2m:[0;39m Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken#9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
[2m2017-03-23 21:18:56.804[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.access.vote.AffirmativeBased [0;39m [2m:[0;39m Voter: org.springframework.security.web.access.expression.WebExpressionVoter#5f5f5614, returned: -1
[2m2017-03-23 21:18:56.814[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.a.ExceptionTranslationFilter [0;39m [2m:[0;39m Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) ~[spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) [spring-security-web-4.2.2.RELEASE.jar:4.2.2.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:105) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:106) [spring-boot-actuator-1.5.2.RELEASE.jar:1.5.2.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.7.RELEASE.jar:4.3.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:474) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:783) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:798) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1434) [tomcat-embed-core-8.5.11.jar:8.5.11]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.11.jar:8.5.11]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_65]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_65]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.11.jar:8.5.11]
at java.lang.Thread.run(Thread.java:745) [na:1.8.0_65]
[2m2017-03-23 21:18:56.819[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.util.matcher.AndRequestMatcher [0;39m [2m:[0;39m Trying to match using Ant [pattern='/**', GET]
[2m2017-03-23 21:18:56.820[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Request '/oauth/token' matched by universal pattern '/**'
[2m2017-03-23 21:18:56.820[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.util.matcher.AndRequestMatcher [0;39m [2m:[0;39m Trying to match using NegatedRequestMatcher [requestMatcher=Ant [pattern='/**/favicon.ico']]
[2m2017-03-23 21:18:56.820[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.u.matcher.AntPathRequestMatcher [0;39m [2m:[0;39m Checking match of request : '/oauth/token'; against '/**/favicon.ico'
[2m2017-03-23 21:18:56.820[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.u.matcher.NegatedRequestMatcher [0;39m [2m:[0;39m matches = true
[2m2017-03-23 21:18:56.820[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.util.matcher.AndRequestMatcher [0;39m [2m:[0;39m Trying to match using NegatedRequestMatcher [requestMatcher=MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager#78e22d35, matchingMediaTypes=[application/json], useEquals=false, ignoredMediaTypes=[*/*]]]
[2m2017-03-23 21:18:56.825[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.u.m.MediaTypeRequestMatcher [0;39m [2m:[0;39m httpRequestMediaTypes=[]
[2m2017-03-23 21:18:56.826[0;39m [32mDEBUG[0;39m [35m7000[0;39m [2m---[0;39m [2m[nio-7777-exec-1][0;39m [36mo.s.s.w.u.m.MediaTypeRequestMatcher [0;39m [2m:[0;39m Did not match any media types
here is my code
#SpringBootApplication
//#EnableResourceServer
#RestController
public class AuthServiceApplication {
#RequestMapping("/user")
public Principal user(Principal user) {
return user;
}
public static void main(String[] args) {
SpringApplication.run(AuthServiceApplication.class, args);
}
}
WebSecurityConfig
#Configuration
#EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
// #Autowired
// private DataSource dataSource;
// #Autowired
// public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
// auth
// .jdbcAuthentication()
// .dataSource(dataSource);//设置为从数据库读取用户认证信息(JdbcUserdetailsService)
// }
#Override
protected void configure(HttpSecurity http) throws Exception {
// http.anonymous().disable()
// .authorizeRequests()
// .anyRequest().authenticated();
// http
// .csrf().disable()
//// .exceptionHandling()
//// .authenticationEntryPoint((request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
// .and()
// .authorizeRequests()
// .antMatchers("/**").authenticated()
// .and()
// .httpBasic();
http.authorizeRequests().antMatchers("/oauth/**", "/login", "/signup", "/forgotPassword").permitAll()
.anyRequest().authenticated()
.and()
.formLogin().permitAll();
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
// TODO Auto-generated method stub
// super.configure(auth);
auth
// .parentAuthenticationManager(authenticationManagerBean())
.inMemoryAuthentication()
.withUser("reader")
.password("reader")
// .authorities("FOO_READ")
.roles("USERS")
.and()
.withUser("writer")
.password("writer")
.authorities("FOO_READ", "FOO_WRITE");
}
#Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/hystrix.stream/**", "/info", "/error");
}
// #Bean
// #Override
// protected AuthenticationManager authenticationManager() throws Exception {
// // TODO Auto-generated method stub
// return super.authenticationManager();
// }
#Bean
#Override
public AuthenticationManager authenticationManagerBean() throws Exception {
// TODO Auto-generated method stub
return super.authenticationManagerBean();
}
}
AuthServerConfig
#Configuration
#EnableAuthorizationServer
public class OAuth2Config extends AuthorizationServerConfigurerAdapter {
// Logger logger = Logger.getLogger(this.getClass().getName());
#Autowired
#Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;
// #Autowired
// InMemoryTokenStore tokenStore;
// #Bean
// public TokenStore tokenStore() {
// return new InMemoryTokenStore();
// }
#Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
// TODO Auto-generated method stub
// super.configure(endpoints);
endpoints
// .tokenStore(tokenStore())
.authenticationManager(authenticationManager);
}
#Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
// TODO Auto-generated method stub
// super.configure(clients);
clients.inMemory() // 使用in-memory存储
.withClient("client") // client_id
.secret("secret") // client_secret
.authorizedGrantTypes("implicit", "authorization_code", "refresh_token", "password");// 该client允许的授权类型
// .scopes("read", "write", "trust"); // 允许的授权范围
}
#Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
// TODO Auto-generated method stub
// super.configure(security);
security.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
// security.tokenKeyAccess("permitAll()");//公开/oauth/token的接口
}
}

Answer 1

Did you try removing roles and authorities?