提问人：Jordi 提问时间：11/17/2023 最后编辑：durJordi 更新时间：11/18/2023 访问量：28
Spring 安全性：允许 .well-known/openid-configuration
Spring security: Allow .well-known/openid-configuration
问：
这里我的安全配置到我的服务中：spring-boot-starter-oauth2-authorization-server
@EnableWebSecurity
@Configuration
public class SecurityConfiguration {
@Bean
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
return http
.csrf(csrfCustomizer -> csrfCustomizer.disable())
.authorizeHttpRequests(
authorize -> authorize
.requestMatchers(
EndpointRequest.to(InfoEndpoint.class, HealthEndpoint.class, EnvironmentEndpoint.class,
ConfigurationPropertiesReportEndpoint.class))
.permitAll().anyRequest().authenticated())
.formLogin(cr -> cr.disable())
.build();
}
}
当我尝试时，我得到：GET _/.well-known/openid-configuration
❯ http http://des.oauthz.espaidoc-keycloak.apps.ocpdes.t-systems.es/.well-known/openid-configuration
HTTP/1.1 403
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
date: Fri, 17 Nov 2023 11:48:16 GMT
expires: 0
pragma: no-cache
set-cookie: JSESSIONID=B8C183A7F9A2CC582B88B1D15C203D08; Path=/; HttpOnly
set-cookie: 324dc6a705237c000a7da99ab87ee12a=3af96fc0f36107d20bb560a118c624e0; path=/; HttpOnly
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 0
答：
0赞
DingHao
11/17/2023
#1
您需要添加授权服务器配置，如下所示
@Bean
@Order(Ordered.HIGHEST_PRECEDENCE)
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class).oidc(withDefaults());
return http.oauth2ResourceServer(resourceServer -> resourceServer.jwt(withDefaults()))
.exceptionHandling(exceptions -> exceptions.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login"))).build();
}
评论
1赞
Jordi
11/17/2023
谢谢@DingHao。为什么建议添加 .我只需要构建一个授权服务器。http.oauth2ResourceServer
0赞
DingHao
11/17/2023
我个人认为可以删除它，但我在OAuth2AuthorizationServerWebSecurityConfiguration中看到它并直接复制了它。到目前为止，我还没有看到效果。也许它会有用。
0赞
Willy De Keyser
11/22/2023
#2
以下配置对于使用 OpenId 非常重要。
http.getConfigurer（OAuth2AuthorizationServerConfigurer.class） .oidc（Customizer.withDefaults（））;启用 OpenID Connect 1.0
评论