java restapi和FaignClient+spring security 5+oauth2。来自自定义提供程序的0

Question

我读过很多帖子、文章和文档，但我对这些都很困惑。 我试着用springboot做一个Apiret，使用FaignClient，我必须在请愿书中发送一个不记名令牌，我从一个定制提供商那里得到这个不记名令牌

我的客户机类与Faign类似：

@FeignClient(name="test-client", url = "https://testurl/")
public interface TestClient {
    @GetMapping("/auth/me")
    public ResponseEntity<String> testLoginInformation() throws FeignException;
}

我的申请。属性：

server.port=8082
spring.security.oauth2.client.registration.custom.client-id=mylargeID
spring.security.oauth2.client.registration.custom.client-secret=mylargePassword
spring.security.oauth2.client.registration.custom.authorization-grant-type=client_credentials
spring.security.oauth2.client.registration.custom.scope=access_token_only
spring.security.oauth2.client.registration.custom.provider=custom-provider
spring.security.oauth2.client.registration.custom.client-authentication-method=basic

spring.security.oauth2.client.provider.custom-provider.authorization-uri=https://testurl/auth/token
spring.security.oauth2.client.provider.custom-provider.token-uri=https://testurl/auth/token

其中，我想我指出了请求者获取令牌所需的所有数据。。。我不明白“授权uri”和“令牌uri”之间有什么区别

在我的springboot应用程序主类中，我只有以下两个注释：

@SpringBootApplication
@EnableFeignClients

最后但并非最不重要的是，我的pom文件中的依赖项如下所示：

<properties>
    <java.version>1.8</java.version>
        <spring-cloud.version>Hoxton.SR1</spring-cloud.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter</artifactId>
            <version>2.3.4-RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-openfeign</artifactId>
            <version>2.2.1-RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-oauth2</artifactId>
            <version>2.2.0-RELEASE</version>
        </dependency>
        <dependency>
          <groupId>org.springframework.security</groupId>
          <artifactId>spring-security-oauth2-client</artifactId>
            <version>5.3.4-RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-rest</artifactId>
            <version>2.3.4-RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.json</groupId>
            <artifactId>json</artifactId>
            <version>20190722</version>
        </dependency>
    </dependencies>

现在，我得到的是Id为custom的客户端注册的无效授权授予类型（客户端\u凭据）

我做错了什么

Answer 1

1. 授权url

The /authorization endpoint is used to interact with the resource owner and get the authorization to access the protected resource. To better understand this, imagine that you want to log in to a service using your Google account. First, the service redirects you to Google in order to authenticate (if you are not already logged in) and then you will get a consent screen, where you will be asked to authorize the service to access some of your data (protected resources); for example, your email address and your list of contacts.

1. 令牌url

An access token is an opaque string or a JWT that denotes who has authorized which permissions (scopes) to which application. It is meant to be exchanged with an access token at the /oauth/token endpoint.

查看此处了解更多信息：https://auth0.com/docs/protocols/protocol-oauth2