Spring Security Oauth2 alle URLs sind erlaubt

Question

Ich möchte einige URLs meiner API öffentlich machen. Aber sobald ich eine einzige URL konfiguriere, werden alle meine APIs ohne Berechtigung freigelegt.

Unter meiner configure Methode der ResourceServerConfiguration Klasse:

@Override 
public void configure(HttpSecurity http) throws Exception { 

     http 
    .authorizeRequests() 
       .antMatchers("/api/books","/api/plainOffers","/api/offers","/api/public/*").permitAll(); 
} 

ResourceServer Konfiguration:

@Configuration 
@EnableResourceServer 
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter { 


@Override 
public void configure(HttpSecurity http) throws Exception { 


     http.authorizeRequests().antMatchers("/api/books").permitAll(); 
     http.authorizeRequests().antMatchers("/api/plainOffers").permitAll(); 
     http.authorizeRequests().antMatchers("/api/offers").permitAll(); 
     http.authorizeRequests().antMatchers("/api/public/*").permitAll();  
     //http.authorizeRequests().anyRequest().authenticated().and().httpBasic(); 
} 
}                         

Autorisierungsserver:

@CrossOrigin 
@Configuration 
@EnableAuthorizationServer 
public class AuthorizationServerConfig 
    extends AuthorizationServerConfigurerAdapter{ 

@Autowired 
@Qualifier("userDetailsService") 
private UserDetailsService userDetailsService; 


@Autowired 
private AuthenticationManager authenticationManager; 

@Value("${api.oauth.tokenTimeout:3600}") 
private int expiration; 

@Override 
public void configure(AuthorizationServerEndpointsConfigurer configurer) throws Exception { 
    configurer.authenticationManager(authenticationManager); 
    configurer.userDetailsService(userDetailsService); 
} 

@Override 
public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
    clients.inMemory() 
    .withClient("api") 
    .secret("secret") 
    .accessTokenValiditySeconds(expiration) 
    .scopes("read", "write") 
    .authorizedGrantTypes("password", "refresh_token") 
    .resourceIds("oauth2-resource"); 
} 
} 

Answer 1

Ich glaube, dass Sie die erforderlichen restricions hinzufügen müssen auf anderen URLs:

http.authorizeRequests().antMatchers("/api/books","/api/plainOffers","/api/offers","/api/public/*").permitAll(); 
http.authorizeRequests().anyRequest().authenticated().and().httpBasic();