刚开始用springboot1.5集成oauth2没问题,现在升级成springboot2.1踩了不少坑,下面列举下:
Possible CSRF detected - state parameter was required but no state could be found
客户端代码
@EnableOAuth2Sso @Configuration public class UiSecurityConfig extends WebSecurityConfigurerAdapter { @Override public void configure(HttpSecurity http) throws Exception { http.antMatcher("/**") .authorizeRequests() .antMatchers("/", "/login**") .permitAll() .anyRequest() .authenticated(); } }
在获取到code后一直停留在登陆页面上
在网上找了下有以下方案:
1、配置server.servlet.session.cookie.name=UPSESSIONID
但是这个试了没效果
2、设置code策略authCodeProvider.setStateMandatory(false);
这里改动了很多代码
@Configuration @EnableOAuth2Client @EnableGlobalMethodSecurity(prePostEnabled=true)//开启@PreAuthorize注解 public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private OAuth2ClientContext oauth2ClientContext; @Override protected void configure(HttpSecurity http) throws Exception { // // @formatter:off http.authorizeRequests() .anyRequest().authenticated().and() .formLogin().loginPage("/login").permitAll().and() .exceptionHandling().and() .logout().logoutSuccessUrl("/login").permitAll() .and().headers().frameOptions().sameOrigin() .and().csrf() .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and() .addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class);//这里需要配置在basic前 } @Bean public FilterRegistrationBean oauth2ClientFilterRegistration(OAuth2ClientContextFilter filter) { FilterRegistrationBean registration = new FilterRegistrationBean(); registration.setFilter(filter); registration.setOrder(-100); return registration; } @Bean @ConfigurationProperties("security.oauth2") public ClientResources trina() { return new ClientResources(); } private Filter ssoFilter() { CompositeFilter filter = new CompositeFilter(); List<Filter> filters = new ArrayList<Filter>(); filters.add(ssoFilter(trina(), "/login")); filter.setFilters(filters); return filter; } private Filter ssoFilter(ClientResources client, String path) { OAuth2ClientAuthenticationProcessingFilter oAuth2ClientAuthenticationFilter = new OAuth2ClientAuthenticationProcessingFilter( path); OAuth2RestTemplate oAuth2RestTemplate = new OAuth2RestTemplate(client.getClient(), this.oauth2ClientContext); oAuth2ClientAuthenticationFilter.setRestTemplate(oAuth2RestTemplate); AuthorizationCodeAccessTokenProvider authCodeProvider = new AuthorizationCodeAccessTokenProvider(); authCodeProvider.setStateMandatory(false); AccessTokenProviderChain provider = new AccessTokenProviderChain( Arrays.asList(authCodeProvider)); oAuth2RestTemplate.setAccessTokenProvider(provider); UserInfoTokenServices tokenServices = new UserInfoTokenServices(client.getResource().getUserInfoUri(), client.getClient().getClientId()); tokenServices.setRestTemplate(oAuth2RestTemplate); oAuth2ClientAuthenticationFilter.setTokenServices(tokenServices); return oAuth2ClientAuthenticationFilter; } } class ClientResources { @NestedConfigurationProperty private AuthorizationCodeResourceDetails client = new AuthorizationCodeResourceDetails(); @NestedConfigurationProperty private ResourceServerProperties resource = new ResourceServerProperties(); public AuthorizationCodeResourceDetails getClient() { return client; } public ResourceServerProperties getResource() { return resource; } }
修改后访问呢连接,登陆后成功跳转到指定页面。