[질문] Spring Boot Oauth2 + Zuul Gateway

Question

Oauth2와 Zuul을 연동해서 구현했습니다.Access Token을 가져올때는 문제가 없는데 Resource Server에 접근하면 에러가 나고 있습니다. curl --location --request POST 'http://localhost:8080/oauth/token?grant_type&#61;password&username&#61;john&password&#61;123' \--header 'Authorization: Basic Zm9vQ2xpZW50SWRQYXNzd29yZDpzZWNyZXQ&#61;' \--data-raw '' { &#34;access_token&#34;: &#34;eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJqb2huIiwic2NvcGUiOlsiZm9vIiwicmVhZCIsIndyaXRlIl0sIm9yZ2FuaXphdGlvbiI6ImpvaG5DalNDIiwiZXhwIjoxNjAwNjE1NjIzLCJhdXRob3JpdGllcyI6WyJST0xFX1VTRVIiXSwianRpIjoiOWJmNGU4ZjctYmZkMy00ZTYyLTkwMGItYmNiZTg4Zjk3YjMwIiwiY2xpZW50X2lkIjoiZm9vQ2xpZW50SWRQYXNzd29yZCJ9.Y-UdQg-PFJ6uZR328DAD4oaJBv_c06HGzIVHp6o2RYzDaqBLqCHXK-g_6gJO5dxQ9Q-Yb5eH_xQS5fm4jqiqQa_T4L3kVG7PgMfMq3gj2L1j98Bc-I4dQKDW8Qmmcy7cg1wqb1JnqdAXHfzeU8YjQ0w0dohJW_Ypug_yg07LcHxFSWb5m2V0ncpVUaXn0ghMD_ZMWcR85kesj82jeGjwEopoXKUmzHgLf8QUqmOnrJ5w0-jJpzphvMT1kpmpKctvnOz0Jy5NCGmpD-jpISbz8unGVRvdn-unBBr4E5Qd9O6NQaVpiTjfy36z1BiIEE6BqcHIihRAzAeYg-KT42wxJw&#34;, &#34;token_type&#34;: &#34;bearer&#34;, &#34;refresh_token&#34;: &#34;eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJqb2huIiwic2NvcGUiOlsiZm9vIiwicmVhZCIsIndyaXRlIl0sIm9yZ2FuaXphdGlvbiI6ImpvaG5DalNDIiwiYXRpIjoiOWJmNGU4ZjctYmZkMy00ZTYyLTkwMGItYmNiZTg4Zjk3YjMwIiwiZXhwIjoxNjAzMjA0MDIzLCJhdXRob3JpdGllcyI6WyJST0xFX1VTRVIiXSwianRpIjoiNDkxYmNiMDAtNTYxZS00Nzc5LTgwNWUtNzNlYzVkMGQ0NDA0IiwiY2xpZW50X2lkIjoiZm9vQ2xpZW50SWRQYXNzd29yZCJ9.g1ve27IkqA-BoTRU69Ud8YF2kUEVxQejNg0xA97SYq7GK722qE-Uh9-VMRZB5DFDcGi5ZVTY3tofr60ix9Noflf5VgzgRJ-HwMbIAiRl_XG6nas4vYnSwQY15HU7ERG7ZZUuYv_UgoVDdx1FRIU7Yz5CevJlKBqIVRbN4qcQgRmg7iCkupxuK5Iu6ZHFMkQlgiZGh3TbrMMoX0htneHq3dv3eFD3cuo9lf3pWED4cs-1X_r5RYF9W_vizpalXhiKdTVp-R6gx-Q1wrw4ya1V-BlyI-Dh2a7uS_2yuoyfyfuPO-3K5IBrNUcZCvTUGa5irzxcWfN8BaRVKuIhOuEe3Q&#34;, &#34;expires_in&#34;: 3599, &#34;scope&#34;: &#34;foo read write&#34;, &#34;organization&#34;: &#34;johnCjSC&#34;, &#34;jti&#34;: &#34;9bf4e8f7-bfd3-4e62-900b-bcbe88f97b30&#34;} curl --location --request GET 'http://localhost:8080/spring-security-oauth-resource/foos/15' \--header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJqb2huIiwic2NvcGUiOlsiZm9vIiwicmVhZCIsIndyaXRlIl0sIm9yZ2FuaXphdGlvbiI6ImpvaG5DalNDIiwiZXhwIjoxNjAwNjE1NjIzLCJhdXRob3JpdGllcyI6WyJST0xFX1VTRVIiXSwianRpIjoiOWJmNGU4ZjctYmZkMy00ZTYyLTkwMGItYmNiZTg4Zjk3YjMwIiwiY2xpZW50X2lkIjoiZm9vQ2xpZW50SWRQYXNzd29yZCJ9.Y-UdQg-PFJ6uZR328DAD4oaJBv_c06HGzIVHp6o2RYzDaqBLqCHXK-g_6gJO5dxQ9Q-Yb5eH_xQS5fm4jqiqQa_T4L3kVG7PgMfMq3gj2L1j98Bc-I4dQKDW8Qmmcy7cg1wqb1JnqdAXHfzeU8YjQ0w0dohJW_Ypug_yg07LcHxFSWb5m2V0ncpVUaXn0ghMD_ZMWcR85kesj82jeGjwEopoXKUmzHgLf8QUqmOnrJ5w0-jJpzphvMT1kpmpKctvnOz0Jy5NCGmpD-jpISbz8unGVRvdn-unBBr4E5Qd9O6NQaVpiTjfy36z1BiIEE6BqcHIihRAzAeYg-KT42wxJw' { &#34;error&#34;: &#34;invalid_token&#34;, &#34;error_description&#34;: &#34;Cannot convert access token to JSON&#34;} 아래에 Configuration 추가 하였습니다.. Zuul Configpackage org.sjm.config; import java.io.IOException; import org.springframework.core.io.Resource; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Primary; import org.springframework.core.io.ClassPathResource; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer; import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter; import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer; import org.springframework.security.oauth2.provider.token.DefaultTokenServices; import org.springframework.security.oauth2.provider.token.TokenStore; import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter; import org.springframework.security.oauth2.provider.token.store.JwtTokenStore; import io.micrometer.core.instrument.util.IOUtils; &#64;Configuration &#64;EnableResourceServer public class GatewayConfiguration extends ResourceServerConfigurerAdapter { &#64;Autowired private CustomAccessTokenConverter customAccessTokenConverter; &#64;Override public void configure(final HttpSecurity http) throws Exception { http.authorizeRequests().antMatchers(&#34;/oauth/**&#34;).permitAll().antMatchers(&#34;/**&#34;) .access(&#34;hasAuthority('ROLE_USER') and #oauth2.hasScope('read')&#34;); // authenticated(); } &#64;Override public void configure(final ResourceServerSecurityConfigurer config) { config.tokenServices(tokenServices()); } &#64;Bean &#64;Primary public DefaultTokenServices tokenServices() { final DefaultTokenServices defaultTokenServices &#61; new DefaultTokenServices(); defaultTokenServices.setTokenStore(tokenStore()); return defaultTokenServices; } &#64;Bean public TokenStore tokenStore() { return new JwtTokenStore(accessTokenConverter()); } /* * &#64;Bean public TokenStore tokenStore() { return new * JwtTokenStore(accessTokenConverter()); } */ &#64;Bean public JwtAccessTokenConverter accessTokenConverter() { JwtAccessTokenConverter converter &#61; new JwtAccessTokenConverter(); Resource resource &#61; new ClassPathResource(&#34;public.txt&#34;); String publicKey &#61; null; try { publicKey &#61; IOUtils.toString(resource.getInputStream()); } catch (final IOException e) { throw new RuntimeException(e); } converter.setVerifierKey(publicKey); return converter; } } Authorization Server Configpackage com.sjm.config; import java.util.Arrays; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Primary; import org.springframework.core.io.ClassPathResource; import org.springframework.core.io.FileSystemResource; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer; import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter; import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer; import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer; import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer; import org.springframework.security.oauth2.provider.token.DefaultTokenServices; import org.springframework.security.oauth2.provider.token.TokenEnhancer; import org.springframework.security.oauth2.provider.token.TokenEnhancerChain; import org.springframework.security.oauth2.provider.token.TokenStore; import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter; import org.springframework.security.oauth2.provider.token.store.JwtTokenStore; import org.springframework.security.oauth2.provider.token.store.KeyStoreKeyFactory; /** * &#64;EnableAuthorizationServer * oauth에 필요한 기본 설정 세팅 * (/oauth/token, /oauth/authorize 등 endpoint 생성) * * &#64;author 6792291 * */ &#64;Configuration &#64;EnableAuthorizationServer public class OAuth2AuthorizationServerConfigJwt extends AuthorizationServerConfigurerAdapter { &#64;Autowired &#64;Qualifier(&#34;authenticationManagerBean&#34;) private AuthenticationManager authenticationManager; /** * 토큰 엔트포인터(/oauth/token)에 대한 보안 설정을 할 수 있다. */ &#64;Override public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception { oauthServer.tokenKeyAccess(&#34;permitAll()&#34;).checkTokenAccess(&#34;isAuthenticated()&#34;); } /** * ClienDetailServiceConfigurer * 클라이언트에 대한 설정을 할 수 있다 (DB, Inmemory) * 클라이언트 별 제공할 Scope 나 권한을 정의 */ &#64;Override public void configure(final ClientDetailsServiceConfigurer clients) throws Exception { // &#64;formatter:off clients.inMemory() .withClient(&#34;sampleClientId&#34;) .authorizedGrantTypes(&#34;implicit&#34;) .scopes(&#34;read&#34;, &#34;write&#34;, &#34;foo&#34;, &#34;bar&#34;) .autoApprove(false) .accessTokenValiditySeconds(3600) .redirectUris(&#34;http://localhost:8083/&#34;,&#34;http://localhost:8086/&#34;) .and() .withClient(&#34;fooClientIdPassword&#34;) .secret(passwordEncoder().encode(&#34;secret&#34;)) .authorizedGrantTypes(&#34;password&#34;, &#34;authorization_code&#34;, &#34;refresh_token&#34;, &#34;client_credentials&#34;) .scopes(&#34;foo&#34;, &#34;read&#34;, &#34;write&#34;) .accessTokenValiditySeconds(3600) // 1 hour .refreshTokenValiditySeconds(2592000) // 30 days .redirectUris(&#34;http://www.example.com&#34;,&#34;http://localhost:8089/&#34;,&#34;http://localhost:8080/login/oauth2/code/custom&#34;,&#34;http://localhost:8080/ui-thymeleaf/login/oauth2/code/custom&#34;, &#34;http://localhost:8080/authorize/oauth2/code/bael&#34;, &#34;http://localhost:8080/login/oauth2/code/bael&#34;) .and() .withClient(&#34;barClientIdPassword&#34;) .secret(passwordEncoder().encode(&#34;secret&#34;)) .authorizedGrantTypes(&#34;password&#34;, &#34;authorization_code&#34;, &#34;refresh_token&#34;) .scopes(&#34;bar&#34;, &#34;read&#34;, &#34;write&#34;) .accessTokenValiditySeconds(3600) // 1 hour .refreshTokenValiditySeconds(2592000) // 30 days .and() .withClient(&#34;testImplicitClientId&#34;) .authorizedGrantTypes(&#34;implicit&#34;) .scopes(&#34;read&#34;, &#34;write&#34;, &#34;foo&#34;, &#34;bar&#34;) .autoApprove(true) .redirectUris(&#34;http://www.example.com&#34;); } // &#64;formatter:on /** * 인증, 토큰 엔드포인트, 토큰 서비스를 정의 */ &#64;Override public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception { final TokenEnhancerChain tokenEnhancerChain &#61; new TokenEnhancerChain(); tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(), accessTokenConverter())); endpoints.tokenStore(tokenStore()).tokenEnhancer(tokenEnhancerChain).authenticationManager(authenticationManager); } &#64;Bean public TokenStore tokenStore() { return new JwtTokenStore(accessTokenConverter()); } &#64;Bean public JwtAccessTokenConverter accessTokenConverter() { final JwtAccessTokenConverter converter &#61; new JwtAccessTokenConverter(); KeyStoreKeyFactory keyStoreKeyFactory &#61; new KeyStoreKeyFactory(new FileSystemResource(&#34;src/main/resources/oauth2jwt.jks&#34;), &#34;oauth2jwtpass&#34;.toCharArray()); converter.setKeyPair(keyStoreKeyFactory.getKeyPair(&#34;oauth2jwt&#34;)); return converter; } &#64;Bean public TokenEnhancer tokenEnhancer() { return new CustomTokenEnhancer(); } &#64;Bean &#64;Primary public DefaultTokenServices tokenServices() { final DefaultTokenServices defaultTokenServices &#61; new DefaultTokenServices(); defaultTokenServices.setTokenStore(tokenStore()); defaultTokenServices.setSupportRefreshToken(true); return defaultTokenServices; } &#64;Bean public BCryptPasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } } Resource Server Configpackage com.sjm.config; import org.apache.commons.io.IOUtils; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Primary; import org.springframework.core.io.ClassPathResource; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer; import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter; import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer; import org.springframework.security.oauth2.provider.token.DefaultTokenServices; import org.springframework.security.oauth2.provider.token.TokenStore; import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter; import org.springframework.security.oauth2.provider.token.store.JwtTokenStore; import java.io.IOException; import org.springframework.core.io.Resource; &#64;Configuration &#64;EnableResourceServer public class OAuth2ResourceServerConfigJwt extends ResourceServerConfigurerAdapter { &#64;Autowired private CustomAccessTokenConverter customAccessTokenConverter; &#64;Override public void configure(final HttpSecurity http) throws Exception { // &#64;formatter:off http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) .and() .authorizeRequests().anyRequest().permitAll(); // &#64;formatter:on } &#64;Override public void configure(final ResourceServerSecurityConfigurer config) { config.tokenServices(tokenServices()); } &#64;Bean public TokenStore tokenStore() { return new JwtTokenStore(accessTokenConverter()); } &#64;Bean public JwtAccessTokenConverter accessTokenConverter() { final JwtAccessTokenConverter converter &#61; new JwtAccessTokenConverter(); converter.setAccessTokenConverter(customAccessTokenConverter); final Resource resource &#61; new ClassPathResource(&#34;public.txt&#34;); String publicKey &#61; null; try { publicKey &#61; IOUtils.toString(resource.getInputStream()); } catch (final IOException e) { throw new RuntimeException(e); } converter.setVerifierKey(publicKey); converter.setSigningKey(publicKey); return converter; } &#64;Bean &#64;Primary public DefaultTokenServices tokenServices() { final DefaultTokenServices defaultTokenServices &#61; new DefaultTokenServices(); defaultTokenServices.setTokenStore(tokenStore()); return defaultTokenServices; } }

[질문] Spring Boot Oauth2 + Zuul Gateway

0개의 답변

Q&A 목록