hs-web/hsweb-framework · error · UnsupportedOperationException

不支持的授权请求:

Error message

不支持的授权请求:

What it means

EmbedAuthenticationProperties implements an embedded (config-file based) AuthorizationServer. Its authenticate(request) method only supports the embedded token/username-password request styles; any other GrantRequest type falls through to the final statement and throws UnsupportedOperationException including the request's toString.

Solutions

1. Only send username/password or token-based grant requests to the embedded authorization server.
2. Use the full OAuth2 authorization server implementation for other grant types instead of EmbedAuthenticationProperties.
3. Inspect the request object printed in the message and adjust the client code to construct a supported request type.
4. Catch UnsupportedOperationException and fall back to the appropriate authentication service.

Example fix

// before
Authentication auth = embedAuthorizationServer.authenticate(
    new ClientCredentialsGrantRequest(clientId, clientSecret)); // throws
// after
Authentication auth = embedAuthorizationServer.authenticate(
    new UsernamePasswordAuthenticationRequest(username, password));

if (!(request instanceof PasswordAuthRequest) && !(request instanceof TokenAuthRequest)) {
    throw new IllegalArgumentException("embed server only supports password/token requests");
}

boolean isSupportedGrant(GrantRequest r) {
    return r instanceof PasswordAuthRequest || r instanceof TokenAuthRequest;
}

try {
    return embedServer.authenticate(request);
} catch (UnsupportedOperationException e) {
    log.warn("unsupported auth request for embed server: {}", e.getMessage());
    return delegateFullServer.authenticate(request); // fallback
}

When it happens

Trigger: Calling embedAuthorizationServer.authenticate(...) with a request type other than the supported embedded ones — e.g. an OAuth2 client-credentials or refresh-token request instead of embedded username/password or token authentication.

Common situations: Pointing a generic OAuth2 client at the embedded authorization server; sending new request types after an hsweb upgrade; wiring the embed server where a full OAuth2 authorization server is expected.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• 不支持的验证规则:
• unsupported dialect :
• parentId
• join class [" + clazz + "] not found!
• join alias [" + alias + "] not found!

AI-assisted analysis of hs-web/hsweb-framework@b2cfc85a57 (2026-09-13). Data as JSON: /api/errors/02a00c76ef63b4be. Report an issue: GitHub.

Appendix: source

Thrown at hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/embed/EmbedAuthenticationProperties.java:83

    public Authentication authenticate(AuthenticationRequest request) {
        if (MapUtils.isEmpty(users)) {
            return null;
        }
        if (request instanceof PlainTextUsernamePasswordAuthenticationRequest) {
            PlainTextUsernamePasswordAuthenticationRequest pwdReq = ((PlainTextUsernamePasswordAuthenticationRequest) request);
            for (EmbedAuthenticationInfo user : users.values()) {
                if (pwdReq.getUsername().equals(user.getUsername())) {
                    if (pwdReq.getPassword().equals(user.getPassword())) {
                        return user.toAuthentication(dataAccessConfigBuilderFactory);
                    }
                    return null;
                }
            }
            return null;
        }

        throw new UnsupportedOperationException("不支持的授权请求:" + request);
    }

    public Optional<Authentication> getAuthentication(String userId) {
        return Optional.ofNullable(authentications.get(userId));
    }


}

View on GitHub (pinned to b2cfc85a57)