Spring OAuth2 XML配置转Java配置（Activiti+Spring项目）

以下是对应你提供的XML配置的Java实现，分两种版本适配不同Spring Security版本：

适配Spring Security 5.7以下（基于WebSecurityConfigurerAdapter） #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
import org.springframework.security.oauth2.provider.resource.ResourceServerFilter;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationFilter;
import com.example.security.oauth2.wso2.TokenServiceWSO2;

@Configuration
@EnableWebSecurity
public class OAuth2ResourceServerConfig extends WebSecurityConfigurerAdapter {

    // 对应XML中id="tokenServices"的Bean
    @Bean
    public TokenServiceWSO2 tokenServices() {
        return new TokenServiceWSO2();
    }

    // 对应XML中id="authenticationEntryPoint"的Bean
    @Bean
    public OAuth2AuthenticationEntryPoint authenticationEntryPoint() {
        return new OAuth2AuthenticationEntryPoint();
    }

    // 对应XML中<security:authentication-manager alias="authenticationManager"/>
    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    // 对应XML中<oauth2:resource-server id="resourcesServerFilter" token-services-ref="tokenServices"/>
    @Bean
    public ResourceServerFilter resourcesServerFilter() {
        ResourceServerFilter filter = new ResourceServerFilter();
        filter.setTokenServices(tokenServices());
        return filter;
    }

    // 对应XML中<security:http>块的所有配置
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 匹配/services/**路径的请求
            .requestMatchers()
                .antMatchers("/services/**")
                .and()
            // 禁用会话，保持无状态
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            // 设置认证入口点
            .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint())
                .and()
            // 禁用匿名访问
            .anonymous().disable()
            // 将资源服务器过滤器放在PRE_AUTH_FILTER之前
            .addFilterBefore(resourcesServerFilter(), PreAuthenticatedAuthenticationFilter.class)
            // 允许所有/services/**路径的请求（对应IS_AUTHENTICATED_ANONYMOUSLY）
            .authorizeRequests()
                .antMatchers("/services/**").permitAll();
    }
}

适配Spring Security 5.7及以上（弃用WebSecurityConfigurerAdapter，使用SecurityFilterChain） #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
import org.springframework.security.oauth2.provider.resource.ResourceServerFilter;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationFilter;
import com.example.security.oauth2.wso2.TokenServiceWSO2;

@Configuration
@EnableWebSecurity
public class OAuth2ResourceServerConfig {

    @Bean
    public TokenServiceWSO2 tokenServices() {
        return new TokenServiceWSO2();
    }

    @Bean
    public OAuth2AuthenticationEntryPoint authenticationEntryPoint() {
        return new OAuth2AuthenticationEntryPoint();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public ResourceServerFilter resourcesServerFilter() {
        ResourceServerFilter filter = new ResourceServerFilter();
        filter.setTokenServices(tokenServices());
        return filter;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // 仅对/services/**路径应用此安全规则
            .securityMatcher("/services/**")
            // 无状态会话配置
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            // 设置认证入口点
            .exceptionHandling(ex -> ex.authenticationEntryPoint(authenticationEntryPoint()))
            // 禁用匿名访问
            .anonymous(AbstractHttpConfigurer::disable)
            // 添加资源服务器过滤器到指定位置
            .addFilterBefore(resourcesServerFilter(), PreAuthenticatedAuthenticationFilter.class)
            // 允许所有匹配路径的请求
            .authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
        
        return http.build();
    }
}

配置对应说明 #

• 所有Bean定义完全对应XML中的<bean>标签；
• securityMatcher/requestMatchers对应XML中的pattern="/services/**"；
• SessionCreationPolicy.STATELESS对应create-session="stateless"；
• anonymous().disable()对应<security:anonymous enabled="false"/>；
• addFilterBefore对应<security:custom-filter ref="resourcesServerFilter" before="PRE_AUTH_FILTER"/>；
• permitAll()等价于XML中的access="IS_AUTHENTICATED_ANONYMOUSLY"，均允许所有请求通过认证校验。

内容的提问来源于stack exchange，提问作者Vũ Bá Quang