由网友(何必执着一张脸)分享简介：Postman has Authentication helpers to help with authenticated calls and I'm trying to use the OAuth 2.0 helper to call a REST server created by JHipster using S...

Postman has Authentication helpers to help with authenticated calls and I'm trying to use the OAuth 2.0 helper to call a REST server created by JHipster using Spring (Security, Social, etc).

I've tried a lot of configurations, this is the screen (client ID and Secret were masked):

For the Authorization URL I've tried:

http://127.0.0.1:8080/oauth/authorize http://127.0.0.1:8080/#/login (the app's login route)

The closer I get from receiving a token back to Postman is:

I don't know why it's erring like this. Maybe I'm setting the Callback URL incorrectly? Do I need to do this in the server or in the client (AngularJS)?

Does anyone have any idea of what's wrong? I appreciate your help.

解决方案

JHipster is currently setup to use the "password" oauth2 grant type. The helper oauth2 helper only seems to work with "authorization code" and "client credentials" grant types.

What you'll want to do is first call your app's token endpoint directly as the angular app does in src/main/webapp/scripts/components/auth/provider/auth.oauth2.service.js

POST http://localhost:8080/oauth/token?username=MY_USERNAME&password=MY_PASSWORD&grant_type=password&scope=read%20write

where your username and password can be "user" and "user" respectively, for example and with one header set:

Authorization: Basic AAAAAA

where AAAAAA is your (clientId + ":" + clientSecret)--all base64-encoded. You can use https://www.base64encode.org/. For example if your clientId is "jhipsterapp" and your clientSecret is "mySecretOAuthSecret", replace AAAAAA with "amhpcHN0ZXJhcHA6bXlTZWNyZXRPQXV0aFNlY3JldA==" since that is "jhipsterapp:mySecretOAuthSecret" base64-encoded.

That should return you an access_token. Now hit your API endpoints by calling them with the access_token from your password request in your header like this.

Authorization: Bearer access_token_from_earlier_token_request

Update: if you're using microservices and UAA, then see Niel's answer https://stackoverflow.com/a/45549789/1098564