SpringBootは、私は春のブートを使用してシステムを構築していると私は二つの方法でユーザーを認証したい

Question

を発行します。

• フォーム認証
• のOAuth2認証

1）Oauth2でログインしているユーザーは/ api/** urlsを呼び出せますが、/ admin/**セクションにはアクセスできません。

2）私はフォームを通じてログインする帽子ユーザーは/ admin/**セクションにアクセスできますが、/ api/**にはアクセスできません。

最初のケースでは、認証はたとえばCURLコールを介して行われます。形。

spring-bootを設定すると、どちらの方法でも認証できますが、一緒に作業したことはありません。私がformLoginを設定すると、私はOauth2とviceversaで認証できません。私はまた、私は（.authenticated変更たとえばいくつかの変更を行うことを試みたWebSecurityConfigurerAdapter

@Configuration 
@EnableWebSecurity 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private UserDetailsService userDetailsService; 

    @Bean 
    public PasswordEncoder passwordEncoder() { 
     return new StandardPasswordEncoder(); 
    } 

    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 

     auth 
       .userDetailsService(userDetailsService) 
       .passwordEncoder(passwordEncoder()); 

    } 

    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web 
       .ignoring() 
       .antMatchers("/resources/**"); 
    } 

    @Order(1) 
    @Override 
    public void configure(HttpSecurity http) throws Exception { 
     http 
       .csrf().disable().authorizeRequests() 
       .and() 
       .formLogin() 
       .loginProcessingUrl("/login") 
       .permitAll() 
       .and() 
       .logout() 
       .logoutUrl("/logout") 
       .deleteCookies("JSESSIONID") 
       .permitAll() 
       .and() 
       .exceptionHandling(); 
    } 

    @Override 
    @Bean 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 

    @EnableGlobalMethodSecurity(prePostEnabled = true, jsr250Enabled = true) 
    public static class GlobalSecurityConfiguration extends GlobalMethodSecurityConfiguration { 
     @Override 
     protected MethodSecurityExpressionHandler createExpressionHandler() { 
      return new OAuth2MethodSecurityExpressionHandler(); 
     } 

    } 

} 

とOAuth2Configuration

@Configuration 
public class OAuth2Configuration { 

    @Order(2) 
    @Configuration 
    @EnableResourceServer 
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter { 

     private static final String RESOURCE_ID = "bancadati"; 

     @Autowired 
     private CustomAuthenticationEntryPoint customAuthenticationEntryPoint; 

     @Autowired 
     private CustomLogoutSuccessHandler customLogoutSuccessHandler; 

     @Override 
     public void configure(HttpSecurity http) throws Exception { 
      http 
        .exceptionHandling() 
        .authenticationEntryPoint(customAuthenticationEntryPoint) 
        .and() 
        .logout() 
        .logoutUrl("/oauth/logout") 
        .logoutSuccessHandler(customLogoutSuccessHandler) 
        .and() 
        .csrf() 
        .requireCsrfProtectionMatcher(new AntPathRequestMatcher("/oauth/authorize")) 
        .disable() 
        .headers() 
        .frameOptions() 
        .disable() 
        .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
        .and().authorizeRequests() 
        .antMatchers("/api/**").authenticated(); 


     } 
     @Override 
     public void configure(ResourceServerSecurityConfigurer resources) throws Exception { 
      resources.resourceId(RESOURCE_ID); 
     } 

    } 

    @Configuration 
    @EnableAuthorizationServer 
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter implements EnvironmentAware { 

     private static final String ENV_OAUTH = "authentication.oauth."; 

     private RelaxedPropertyResolver propertyResolver; 

     @Autowired 
     private DataSource dataSource; 

     @Bean 
     public TokenStore tokenStore() { 
      return new JdbcTokenStore(dataSource); 
     } 

     @Autowired 
     @Qualifier("authenticationManagerBean") 
     private AuthenticationManager authenticationManager; 

     @Override 
     public void configure(AuthorizationServerEndpointsConfigurer endpoints) 
       throws Exception { 
      endpoints 
        .tokenStore(tokenStore()) 
        .authenticationManager(authenticationManager); 
     } 

     @Override 
     public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
      clients.jdbc(dataSource); 
     } 

     @Override 
     public void setEnvironment(Environment environment) { 
      this.propertyResolver = new RelaxedPropertyResolver(environment, ENV_OAUTH); 
     } 

    }} 

以下

）.fullyAuthenticatedに（）でResourceServerConfigurerAdapterただし、何も変更されていません。私はこの例にも従ってみたhttps://github.com/rynkowsw/web-and-oauth2-security運がない！

私が間違っていることを理解するのに役立つことができますか？

ありがとうございます。

@Configuration 
@EnableResourceServer 
public class ResourceConfiguration extends ResourceServerConfigurerAdapter { 

    private static final String RESOURCE_ID = "resource_id"; 

    @Override 
    public void configure(HttpSecurity http) throws Exception { 
    http 
      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
      .and() 
      .authorizeRequests() 
      .antMatchers(HttpMethod.GET, "/api/**").access("#oauth2.hasScope('read')") 
      .antMatchers(HttpMethod.POST, "/api/**").access("#oauth2.hasScope('write')"); 
    } 

    @Override 
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception { 
    resources.resourceId(RESOURCE_ID); 
    } 
} 

認証サーバの設定

@Configuration 
public class AuthorizationConfiguration { 
@Configuration 
@Order(-20) 
static class LoginConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private UserDetailsService userDetailsService; 

    @Bean 
    public PasswordEncoder passwordEncoder() { 
     return new StandardPasswordEncoder(); 
    } 

    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 

     auth 
       .userDetailsService(userDetailsService) 
       .passwordEncoder(passwordEncoder()); 

    } 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
       .formLogin().loginPage("/login").permitAll() 
       .and().logout().logoutUrl("/logout").permitAll() 
       .and() 
       .requestMatchers() 
       .antMatchers("/", "/login", "/oauth/authorize", "/oauth/confirm_access") 
       .and() 
       .authorizeRequests() 
       .anyRequest().authenticated(); 
    } 

    @Override 
    @Bean 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 
} 

@Configuration 
@EnableAuthorizationServer 
static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter implements EnvironmentAware { 

    private static final String ENV_OAUTH = "authentication.oauth."; 

    private RelaxedPropertyResolver propertyResolver; 

    @Autowired 
    private DataSource dataSource; 

    @Bean 
    public TokenStore tokenStore() { 
     return new JdbcTokenStore(dataSource); 
    } 

    @Autowired 
    @Qualifier("authenticationManagerBean") 
    private AuthenticationManager authenticationManager; 

    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) 
      throws Exception { 
     endpoints 
       .tokenStore(tokenStore()) 
       .authenticationManager(authenticationManager); 
    } 

    @Override 
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
     clients.jdbc(dataSource); 
    } 


    @Override 
    public void setEnvironment(Environment environment) { 
     this.propertyResolver = new RelaxedPropertyResolver(environment, ENV_OAUTH); 
    } 
} 
} 

：私は

は誰か他の人のコードの下に助けることができるかもしれ解決策を見つけた

Answer 1