带有Spring Boot REST应用程序的OAuth2-无法使用令牌访问资源

我想将OAuth2用于我的RESTSpring Boot项目。使用一些示例，我为OAuth2创建了配置：

@Configuration
public class OAuth2Configuration {

    private static final String resource_id = "restservice";

    @Configuration
    @EnableresourceServer
    protected static class resourceServerConfiguration extends
          resourceServerConfigurerAdapter {

        @Override
        public void configure(resourceServerSecurityConfigurer resources) {
            // @formatter:off
            resources
                    .resourcEID(resource_id);
            // @formatter:on
        }

        @Override
        public void configure(httpSecurity http) throws Exception {
            // @formatter:off
            http
                    .anonymous().disable()
                    .authorizerequests().anyrequest().authenticated();
            // @formatter:on
        }

    }

    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends
             AuthorizationServerConfigurerAdapter {

        private TokenStore tokenStore = new InMemoryTokenStore();

        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;

        @Autowired
        private UserDetailsserviceImpl userDetailsservice;

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints)
            throws Exception {
          // @formatter:off
          endpoints
                  .tokenStore(this.tokenStorE)
                  .authenticationManager(this.authenticationManager)
                  .userDetailsservice(userDetailsservicE);
          // @formatter:on
        }

        @Override
        public void configure(ClientDetailsserviceConfigurer clients) throws Exception {
            // @formatter:off
            clients
                  .inMemory()
                  .withClient("clientapp")
                  .authorizedGrantTypes("password","@R_607_7017@h_token","trust")
                  .authorities("USER")
                  .scopes("read","write")
                  .resourcEIDs(resource_id)
                  .secret("clientsecret")
                  .accessTokenValiditySeconds(1200)
                  .@R_607_7017@hTokenValiditySeconds(3600);
            // @formatter:on
        }

        @Bean
        @PriMary
        public DefaultTokenservices tokenservices() {
            DefaultTokenservices tokenservices = new DefaultTokenservices();
            tokenservices.setSupport@R_607_7017@hToken(true);
            tokenservices.setTokenStore(this.tokenStorE);
            return tokenservices;
        }
    }
}

这是我的SecurityConfiguration类：

@Configuration
@EnableWebSecurity
@Order(1)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsservice userDetailsservice;

    @Override
    protected void configure(httpSecurity http) throws Exception {
        http.csrf().disable();
        http
                .authorizerequests().antMatchers("/api/register").permitAll()
                .and()
                .authorizerequests().antMatchers("/api/free").permitAll()
                .and()
                .authorizerequests().antMatchers("/oauth/token").permitAll()
                .and()
                .authorizerequests().antMatchers("/api/secured").hasRole("USER")
                .and()
                .authorizerequests().anyrequest().authenticated();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public passwordEncoder passwordEncoder() {
        return new BCryptpasswordEncoder();
    }

}

我尝试通过2个简单的请求检查我的应用程序：

@requestMapping(value = "/api/secured",method = requestMethod.GET)
public String checkSecured(){
    return "Authorization is ok";
}

@requestMapping(value = "/api/free",method = requestMethod.GET)
public String checkFree(){
    return "Free from authorization";
}

首先，我检查了两个请求：

/ api / free 返回代码200和字符串“免授权”

/ api / secured
返回{“时间戳”：1487451065106，“状态”：403，“错误”：“禁止”，“消息”：“访问被拒绝”，“路径”：“ / api /
secured”}

看来它们工作正常。

然后我得到了access_token（使用我的用户数据库中的凭据）

/ oauth / token？grant_type = password＆username = emaila＆password = emailo

响应：

{“ access_token”：“ 3344669f-c66c-4161-9516-d7e2f31a32e8”，“ token_type”：“
bearer”，“ @R_607_7017@h_token”：“ c71c17e4-45ba-458c-9d98-574de33d1859”，“
expires_in”：1199，“范围” ：“读写”}

然后，我尝试发送一个请求（使用获得的令牌）以请求需要身份验证的资源：

/ api / secured？access_token = 3344669f-c66c-4161-9516-d7e2f31a32e8

这是回应：

{“ timestamp”：1487451630224，“ status”：403，“ Error”：“ Forbidden”，“ message”：“
Access Denied”，“ path”：“ / api / secured”}

我不明白为什么访问被拒绝。我不确定配置，似乎它们是不正确的。另外，我仍然不清楚在扩展 WebSecurityConfigurerAdapter的*
类和在另一个扩展 resourceServerConfigurerAdapter的 类中的 configure（httpSecurity
http） 方法的关系。感谢您的任何帮助！ ***