User must be authenticated with Spring Security before authorization can be completed

问题描述

利用Spring cloud oauth2实现Oauth 2权限控制时，调用/oauth/authorize获取授权码，抛出了User must be authenticated with Spring Security before authorization can be completed异常？

请求接口：

控制台异常信息为： 

 

 接口部分源码为：

@RequestMapping(value = "/oauth/authorize")
	public ModelAndView authorize(Map model, @RequestParam Map parameters,
			SessionStatus sessionStatus, Principal principal) {

		// Pull out the authorization request first, using the OAuth2RequestFactory. All further logic should
		// query off of the authorization request instead of referring back to the parameters map. The contents of the
		// parameters map will be stored without change in the AuthorizationRequest object once it is created.
		AuthorizationRequest authorizationRequest = getOAuth2RequestFactory().createAuthorizationRequest(parameters);

		Set responseTypes = authorizationRequest.getResponseTypes();

		if (!responseTypes.contains("token") && !responseTypes.contains("code")) {
			throw new UnsupportedResponseTypeException("Unsupported response types: " + responseTypes);
		}

		if (authorizationRequest.getClientId() == null) {
			throw new InvalidClientException("A client id must be provided");
		}

		try {

			if (!(principal instanceof Authentication) || !((Authentication) principal).isAuthenticated()) {
				throw new InsufficientAuthenticationException(
						"User must be authenticated with Spring Security before authorization can be completed.");
			}
        ...

		}
		catch (RuntimeException e) {
			sessionStatus.setComplete();
			throw e;
		}

	}

 实际debug我们可以看到，授权信息为空，导致抛出了InsufficientAuthenticationException异常。

深究原因

1.在网上查了资料，一种说法是在security的http配置中，需要把/oauth/authorize配置为允许permitAll

 protected void configure(HttpSecurity http) throws Exception {
        http
                .formLogin().loginPage("/login").and()
                .logout().addLogoutHandler(sysLogoutHandler).logoutSuccessHandler(sysLogoutSuccessHandler)
                .and()
                // 由于使用的是JWT，我们这里不需要csrf
                .csrf().disable().cors().and()
                .authorizeRequests()
                .antMatchers("/login", "/oauth/authorize").permitAll()
                // 除上面外的所有请求全部需要鉴权认证
                .anyRequest().authenticated();

    }

我在配置完以后，再次请求接口还是报同样的错误，说明，我遇到这个错误不是由于配置引起的。

经过了很久的尝试，我看到了控制台报错的信息。

 GlobalExceptionTranslator部分代码如下：

@RestControllerAdvice
@Slf4j
public class GlobalExceptionTranslator {
    @ExceptionHandler(InsufficientAuthenticationException.class)
    public BaseResponse