升级Spring Boot 3.2后Spring Authorization Server无法正常工作求助

问题描述 #

升级至Spring Boot 3.2.0后，使用Spring Authorization Server的授权码流程进行认证时，出现错误：No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken，且采用的是官方「快速开始」文档中的最简配置。

问题原因 #

Spring Boot 3.2.0对Spring Security的自动配置逻辑进行了调整：默认不再自动配置基于内存的用户认证（InMemoryUserDetailsManager）。而官方快速开始文档暂未同步更新该变化，导致认证流程中找不到处理UsernamePasswordAuthenticationToken的AuthenticationProvider。

解决方案 #

手动配置用户认证信息，以下是两种常用实现方式：

方式一：独立配置UserDetailsService Bean #

创建配置类，手动定义内存用户和密码编码器：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
public class UserAuthConfig {

    @Bean
    public UserDetailsService userDetailsService() {
        // 自定义用户名、密码和角色
        UserDetails user = User.withUsername("user")
                .password(passwordEncoder().encode("password"))
                .roles("USER")
                .build();
        return new InMemoryUserDetailsManager(user);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

方式二：在SecurityFilterChain中整合用户配置 #

如果项目已有自定义的SecurityFilterChain，可直接在其中配置内存用户：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .formLogin(form -> form.permitAll());
        return http.build();
    }

    @Bean
    public InMemoryUserDetailsManager userDetailsManager() {
        UserDetails user = User.withUsername("user")
                .password(passwordEncoder().encode("password"))
                .roles("USER")
                .build();
        return new InMemoryUserDetailsManager(user);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

注意事项 #

确保项目已引入spring-boot-starter-security依赖，Spring Authorization Server依赖该组件提供认证基础能力。

内容的提问来源于stack exchange，提问作者Gerardo Roza