OAuth 2 登录提示‘bad credentials’问题排查求助

你的配置中InMemoryUserDetailsManager的Bean方法名为user()，而Spring Security默认会自动查找**名为userDetailsService**的UserDetailsService类型Bean来加载用户认证数据。当前Bean命名不匹配，导致框架无法正确获取你配置的用户信息，因此无论输入何种用户名密码都会返回"无效凭据"。

解决方法一：修改Bean方法名（推荐） #

将InMemoryUserDetailsManager的Bean方法名改为userDetailsService，让Spring Security自动识别：

package Config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

import static org.springframework.security.config.Customizer.*;

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    
    @Bean
    public InMemoryUserDetailsManager userDetailsService() {
        return new InMemoryUserDetailsManager(
                User.withUsername("name")
                    .password("{noop}senha")
                    .authorities("read")
                    .build()
        );
    }
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception{
        return http
                .csrf(csrf -> csrf.disable())
                .authorizeHttpRequests(auth -> auth
                        .anyRequest().authenticated()
                )
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .httpBasic(withDefaults())
                .build();   
    }
}

解决方法二：显式指定UserDetailsService #

如果不想修改Bean方法名，可以在SecurityFilterChain配置中手动注入并指定使用你的自定义Bean：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http, InMemoryUserDetailsManager user) throws Exception{
    return http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                    .anyRequest().authenticated()
            )
            .userDetailsService(user) // 显式绑定自定义的UserDetailsService
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .httpBasic(withDefaults())
            .build();   
}

验证 #

重启应用后，使用用户名name、密码senha通过HTTP Basic认证登录，即可正常通过验证。

内容的提问来源于stack exchange，提问作者Matheus