Oauth2 and Spring-Security: Fail on authentication using Oauth2 and spring-security

问题

I want to use Oauth2 and Spring-security with rest web service. I am new for this, i am trying to create configuration with the help of some websites. Still, i clearly not understand how and what is the flow for oauth authenticate for rest service. i am using latest dependencies Click on the link for see my configurations. I am using database for store clients information and tokens. when i trying to access the token, using follwoing url with post request and post body:

http://localhost:8080/empirecl-api/oauth/token
grant_type=password&username=a@a.com&password=password&client_id=my-client-with-secret&client_secret=ak_secret

The basic authentication pop-up box will appear. I am using chrome rest postman client. I have user table in my database where i store, username and password, when i enter those username and password, the authentication fail, If i use i my client_id and client_secret as a username and password, the authentication is fail. When i cancel the pop of basic authentication following json is return:

{
"error": "unauthorized",
"error_description": "No client with requested id: a@a.com"
}

I am unable to figure out what will happen.

When i trying to access following url with get reqquest:

http://localhost:8080/empirecl-api/oauth/authorize?grant_type=password&username=a@a.com&password=password

The following error will return:

{
"error": {
    "error": "invalid_client",
    "error_description": "Bad client credentials"
}
}

When i check the error in console, of eclipse, the follwoing error is display:

AuthorizationEndpoint:436 - Handling ClientRegistrationException error: No client with requested id: null

How i resolve this problem and how to use Oauth with my rest api. I also want to secure my all rest url with Oauth.

回答1:

There are a couple of things wrong here.

1. You are using the wrong endpoint - the request should be to the token endpoint, not the authorization endpoint.
2. It should be a POST request - you shouldn't be passing the parameters in the URL
3. You are confusing when the user has to authenticate and when the client does - the server was looking for Basic credentials from the client but you were entering the username.

See the oauth2 spec section on using the resource owner password grant.

The client needs to authenticate and, as porterhead points out, you can do this using Basic authentication. The spec does also allow passing of the client id and secret as post parameters, but prefers Basic authentication.

You should probably make sure you understand a bit more about how OAuth2 works, and perhaps expand your question to explain why you want to use it and why you've chosen this particular grant type.

回答2:

You need to pass your client username and password as a Base64 encoded Authorization header.

Try using curl. Here is an example:

curl -v -X POST \
-H "Content-Type: application/json" \
-H "Authorization: Basic MzUzYjMwMmM0NDU3NGY1NjUwNDU2ODdlNTM0ZTdkNmE6Mjg2OTI0Njk3ZTYxNWE2NzJhNjQ2YTQ5MzU0NTY0NmM=" \
'http://localhost:8080/empirecl-api/oauth/token?grant_type=password&username=a@a.com&password=password'

I have a working example described here

来源：https://stackoverflow.com/questions/24930830/oauth2-and-spring-security-fail-on-authentication-using-oauth2-and-spring-secur