StormPath春季启动认证Cookie生成

Question

我刚刚开始为我们正在构建的新的Rest平台使用stormpath-缺省弹簧启动程序库(1.2.0)。我期望在对用户进行身份验证时，由下面的代码生成访问cookie，以便随后的API调用可以由cookie进行身份验证。帐户是经过身份验证的，但是cookie没有生成。

AuthenticationRequest request = UsernamePasswordRequests.builder()
.setUsernameOrEmail(userId)
.setPassword(pwd)
.withResponseOptions(UsernamePasswordRequests.options().withAccount())
.build();
Account account = null;

try {
account = app.authenticateAccount(request).getAccount();
}
catch (ResourceException ex) {
throw(ex);
}

Following here is the property file entries,

stormpath.spring.security.enabled = false
security.basic.enabled = false

Help is much appreciated.

Answer 1

我想你可能在这里混在一起。

您提供的代码与直接使用Java而不使用集成时所需的手动代码类型类似，比如Stormpath Spring Boot集成。

当您使用Stormpath默认Spring时，您会自动获得一组端点，您可以使用这些端点进行身份验证并设置cookie。

例如，您有一个/login端点。

如果您启动了示例应用程序，您应该可以转到：

curl localhost:8080/login

您将得到一个如下所示的登录模型：

{
    "form": {
        "fields": [
            {
                "name": "login",
                "label": "Username or Email",
                "placeholder": "Username or Email",
                "required": true,
                "type": "text"
            },
            {
                "name": "password",
                "label": "Password",
                "placeholder": "Password",
                "required": true,
                "type": "password"
            }
        ]
    }
}

然后可以使用POST进行身份验证：

curl -v -H "Content-Type: application/json" -X POST \
-d '{"login": "<email>", "password": "<password>"}' \
http://localhost:8080/login

你会得到这样的回应：

> POST /login HTTP/1.1
> Host: localhost:8080
< HTTP/1.1 200
< Set-Cookie: access_token=eyJraWQiOiJSOTJTQkhKQzFVNERBSU1HUTNNSE9HVk1YIiwic3R0IjoiYWNjZXNzIiwiYWxnIjoiSFMyNTYifQ...;Max-Age=3600;path=/;HttpOnly
< Set-Cookie: refresh_token=eyJraWQiOiJSOTJTQkhKQzFVNERBSU1HUTNNSE9HVk1YIiwic3R0IjoicmVmcmVzaCIsImFsZyI6IkhTMjU2In0...;Max-Age=5184000;path=/;HttpOnly
< Content-Type: application/json
< Transfer-Encoding: chunked
< Date: Mon, 05 Dec 2016 05:30:25 GMT
<
* Connection #0 to host localhost left intact
{
    "account": {
        "href": "https://api.stormpath.com/v1/accounts/<account id>",
        "createdAt": "2016-03-04T06:29:48.506Z",
        "modifiedAt": "2016-08-17T18:01:07.812Z",
        "username": "<username>",
        "email": "<email>",
        "givenName": "<givenName>",
        "middleName": null,
        "surname": "<surname>",
        "status": "ENABLED",
        "fullName": "<full name>",
        "emailVerificationStatus": null,
        "passwordModifiedAt": "2016-05-24T02:14:01.000Z"
    }
}

响应包含access_token和refresh_token cookie以及包含帐户信息的JSON响应。

如果要使用OAuth2，则有一个既支持grant_type=password又支持grant_type=client_credentials流的/oauth/token端点：

curl -v -X POST \
-d grant_type=password -d username=<email> -d password=<password> \
http://localhost:8080/oauth/token

你会得到这样的回应：

> POST /oauth/token HTTP/1.1
> Host: localhost:8080
< HTTP/1.1 200
< Set-Cookie: access_token=eyJraWQiOiJSOTJTQkhKQzFVNERBSU1HUTNNSE9HVk1YIiwic3R0IjoiYWNjZXNzIiwiYWxnIjoiSFMyNTYifQ...;Max-Age=3600;path=/;HttpOnly
< Set-Cookie: refresh_token=eyJraWQiOiJSOTJTQkhKQzFVNERBSU1HUTNNSE9HVk1YIiwic3R0IjoicmVmcmVzaCIsImFsZyI6IkhTMjU2In0...;Max-Age=5184000;path=/;HttpOnly
< Cache-Control: no-store, no-cache
< Pragma: no-cache
< Content-Type: application/json;charset=ISO-8859-1
< Content-Length: 933
< Date: Mon, 05 Dec 2016 05:38:53 GMT
<
* Connection #0 to host localhost left intact
{
    "access_token": "eyJraWQiOiJSOTJTQkhKQzFVNERBSU1HUTNNSE9HVk1YIiwic3R0IjoiYWNjZXNzIiwiYWxnIjoiSFMyNTYifQ...",
    "refresh_token": "eyJraWQiOiJSOTJTQkhKQzFVNERBSU1HUTNNSE9HVk1YIiwic3R0IjoicmVmcmVzaCIsImFsZyI6IkhTMjU2In0...",
    "token_type": "Bearer",
    "expires_in": 3600
}

我希望这能帮到你!

充分披露:我是Stormpath的Java开发人员之一