weblogic oauth 401 错误

叁歲伎倆 2022-05-22 04:08 242阅读 0赞

oauth服务。

原本在tomcat下运行正常。

改用weblogic后无端的包401错误。

官方解决方案：https://docs.oracle.com/cd/E12840\_01/wls/docs103/security/thin\_client.html\#understanding\_basic\_atn

### Understanding BASIC Authentication with Unsecured Resources ###

For WebLogic Server versions 9.2 and later, client requests that use HTTP BASIC authentication must pass WebLogic Server authentication, even if access control is not enabled on the target resource.

The setting of the Security Configuration MBean flag `enforce-valid-basic-auth-credentials` determines this behavior. (The DomainMBean can return the new Security Configuration MBean for the domain.) It specifies whether or not the system should allow requests with invalid HTTP BASIC authentication credentials to access unsecured resources.

<table style="margin-top:0px;margin-bottom:0em;margin-left:25.2969px;color:rgb(0,0,0);font-family:Verdana, Arial, Helvetica, sans-serif;font-size:12.8px;"> 
 <tbody> 
  <tr> 
   <td style="margin:.1in .15in 0px 0px;font-family:Verdana, Arial, Helvetica, sans-serif;font-size:10pt;color:rgb(0,0,0);"><strong>Note:</strong></td> 
   <td style="margin:.1in .15in 0px 0px;font-family:Verdana, Arial, Helvetica, sans-serif;font-size:10pt;color:rgb(0,0,0);">The Security Configuration MBean provides domain-wide security configuration information. The enforce-valid-basic-auth-credentials flag effects the entire domain.</td> 
  </tr> 
 </tbody> 
</table>

The `enforce-valid-basic-auth-credentials` flag is true by default, and WebLogic Server authentication is performed. If authentication fails, the request is rejected. WebLogic Server must therefore have knowledge of the user and password.

You may want to change the default behavior if you rely on an alternate authentication mechanism. For example, you might use a backend web service to authenticate the client, and WebLogic Server does not need to know about the user. With the default authentication enforcement enabled, the web service can do its own authentication, but only if WebLogic Server authentication first succeeds.

If you explicitly set the `enforce-valid-basic-auth-credentials` flag to false, WebLogic Server does not perform authentication for HTTP BASIC authentication client requests for which access control was not enabled for the target resource.

In the previous example of a backend web service that authenticates the client, the web service can then perform its own authentication without WebLogic Server having knowledge of the user.

#### Setting the enforce-valid-basic-auth-credentials Flag ####

To set the e` enforce-valid-basic-auth-credentials` flag, perform the following steps:

1.  Add the `<enforce-valid-basic-auth-credentials>` element to `config.xml` within the `<security-configuration>` element.

<enforce-valid-basic-auth-credentials>false</enforce-valid-basic-auth-credentials>

</security-configuration>

Start or restart all of the servers in the domain.