尝试访问登录URL

Question

我正在使用Spring Security OAuth2（Spring Boot 2.0.2 + Spring Cloud Finchley）并尝试启动隐式登录。浏览器将我重定向到/ login URL但我收到错误“访问此资源需要完全身份验证”。如何允许显示登录页面但仍允许保护所有REST URL？

我的配置如下：

App.java

@SpringBootApplication
@RestController
@EnableResourceServer
@EnableAuthorizationServer
public class App {

    public static void main(String[] args) {
        SpringApplication.run(App.class, args);
    }
}

OAuth2Config.java

@Configuration
public class OAuth2Config extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;


    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("XXXXX")
                .secret("XXXXX")
                .authorizedGrantTypes("refresh_token", "password", "client_credentials")
                .scopes("webclient", "mobileclient");
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
      endpoints
        .authenticationManager(authenticationManager)
        .userDetailsService(userDetailsService);
    }
}

WebSecurityConfigurer.java

@Configuration
@Order(-20) // EDIT
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

   @Override
    @Bean
    public UserDetailsService userDetailsServiceBean() throws Exception {
        return super.userDetailsServiceBean();
    }


    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .inMemoryAuthentication()  
                .withUser("XXXXX"). password("XXXXXX").roles("USER");
    }

    // EDIT

    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin().permitAll()
        .and().httpBasic().and()
        .requestMatchers()
        //specify urls handled
        .antMatchers("/login", "/oauth/authorize", "/oauth/confirm_access")
        .antMatchers("/fonts/**", "/js/**", "/css/**")
        .and()
        .authorizeRequests()
        .antMatchers("/fonts/**", "/js/**", "/css/**").permitAll()
        .anyRequest().authenticated();
    }
}
}