Question

oauth2 /oauth/authorize 没有权限

/oauth/token 可以拿到access_token
但是通过access_token 去访问资源就没有权限了， 后台日志显示 访问/oauth/authorize 没有权限
11-13 17:04:19.191 DEBUG [o.s.s.w.access.intercept.FilterSecurityInterceptor] - Secure object: FilterInvocation: URL: /oauth/authorize?client_id=test&redirect_uri=http%3A%2F%2F10.5.4.250%3A1113%2Flogin&response_type=code&scope=server&state=W9ejN3; Attributes: [authenticated]
11-13 17:04:19.191 DEBUG [o.s.s.w.access.intercept.FilterSecurityInterceptor] - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@56f892e0: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 10.5.4.250; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
11-13 17:04:19.192 DEBUG [o.s.security.access.vote.AffirmativeBased] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@7a80525b, returned: -1
11-13 17:04:19.193 DEBUG [o.s.boot.actuate.audit.listener.AuditListener] - AuditEvent [timestamp=2018-11-13T09:04:19.193Z, principal=anonymousUser, type=AUTHORIZATION_FAILURE, data={details=org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 10.5.4.250; SessionId: null, type=org.springframework.security.access.AccessDeniedException, message=Access is denied}]
11-13 17:04:19.194 DEBUG [o.s.security.web.access.ExceptionTranslationFilter] - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)

Answer 1

在WebSecurityConfig的config方法中加上上面红色标记的代码