我有一个spring启动应用程序，其中包含mongo数据库和Spring Security 作为依赖项。它有两个服务，第一个用于身份验证，第二个用于应用程序资源（实体、服务控制器）。这是身份验证服务中的我的配置类：

@Configuration
@EnableWebSecurity
public class AuthServerSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
@Bean
protected UserDetailsService userDetailsService() {
    return new MongoUserDetailsService();
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService());
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable()
    .authorizeRequests().anyRequest().authenticated();
    System.out.println("auth");
}

@Override
public void configure(WebSecurity web) throws Exception {
    super.configure(web);
}

@Bean(name="authenticationManager")
@Lazy
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}
}

这是rest控制器：

@CrossOrigin(origins = "*", maxAge = 3600)
@RestController
@RequestMapping(value = "/api/users")
public class UserController {

@Autowired
UserServiceImpl userServiceImpl;

//Getting all users
@GetMapping(value = "")
public List<UserDTO> getAllUsers() {
    return userServiceImpl.getAllUsers();

}

//Getting a user by ID
@GetMapping(value = "/profil/{userId}")
public UserDTO getUserById(@PathVariable String userId) {
    return userServiceImpl.getUserById(userId);
}

//Getting a user by Username
@GetMapping(value = "/profil/username/{username}")
public UserDTO getUserByUsernameOrEmail(String username) {
    return userServiceImpl.getUserByUsernameOrEmail(username);
}

//Logout user and delete token
@PostMapping("/logout")
public void logout(HttpServletRequest request) {
     userServiceImpl.logout(request);

}

我将配置方法更改为：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .csrf().disable()
    .authorizeRequests() // authorize
    .anyRequest().authenticated() // all requests are authenticated
    .and()
    .httpBasic();

    http.cors();

}

现在我在访问受保护的资源时得到401未经授权。问题是，即使我在请求头中发送了正确的承载令牌，我仍然得到401未经授权的“访问此资源需要完全身份验证”
更新：我将我的项目架构从microservices更改为一个简单的springboot项目。这是类“authserversecurityconfig”的新代码

@Configuration
public class AuthServerSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
@Bean
protected UserDetailsService userDetailsService() {
    return new MongoUserDetailsService();
}

@Autowired
BCryptPasswordEncoder passwordEncoder;

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    //auth.userDetailsService(userDetailsService());
    auth.userDetailsService(userDetailsService()).passwordEncoder(passwordEncoder);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .csrf().disable()
    .anonymous().disable()
    .authorizeRequests()
    .antMatchers("/oauth/token").permitAll().and()
    .httpBasic();

    http.cors();
}

@Override
public void configure(WebSecurity web) throws Exception {
    super.configure(web);
}

@Bean(name="authenticationManager")
@Lazy
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}
}

下面是“resourceserverconfig”代码：

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

@Autowired private ResourceServerTokenServices tokenServices;

@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
    resources.resourceId("foo").tokenServices(tokenServices);
}

@Override
public void configure(HttpSecurity http) throws Exception {

        http
        .authorizeRequests() // authorize
        .antMatchers("/oauth/**").permitAll();

        http
        .authorizeRequests().antMatchers("/api/**").authenticated();

        http
        .headers().addHeaderWriter(new HeaderWriter() {
        @Override
        public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
            response.addHeader("Access-Control-Allow-Origin", "*");
            if (request.getMethod().equals("OPTIONS")) {
                response.setHeader("Access-Control-Allow-Methods", request.getHeader("Access-Control-Request-Method"));
                response.setHeader("Access-Control-Allow-Headers", request.getHeader("Access-Control-Request-Headers"));
            }
        }
    });
}
}

当我尝试访问受保护的资源时，我得到“错误”：“未经授权”，“错误描述”：“访问此资源需要完全身份验证”，这是正常行为。问题是现在我无法登录以获取用户访问令牌。
访问此端点时，我得到“401未经授权”http://localhost:8080/oauth/token?grant_type=password&username=user&password=user".
这些是默认的init用户凭据，并且该用户存在于my mongodatabase中，密码以“$2a”开头，格式正确，字符为“60”。
尝试登录时，我在控制台中输入“编码密码看起来不像bcrypt身份验证失败：密码与存储值不匹配”。