Question

我正在使用带有弹簧的OAuth 2.0进行令牌生成，我想手动设置expire_in，因此令牌可以按照我的标准到期。有人帮帮我吗？

这是我的回答：

{
    access_token: "c7a6cb95-1506-40e7-87d1-ddef0a239f64"
    token_type: "bearer"
    expires_in: 43199
    scope: "read"
}

Answer 1

可以使用从ClientBuilder获得的ClientDetailsServiceConfigurer进行设置。

@Configuration
@EnableAuthorizationServer
public class OAuth2Config extends AuthorizationServerConfigurerAdapter {

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("client")
            .secret("secret")
            .authorizedGrantTypes("authorization_code", "refresh_token", "password")
            .scopes("app")
            .accessTokenValiditySeconds(30);
    }

    // ... additional configuration
}

或直接在DefaultTokenServices根据您的需要。

@Configuration
@EnableAuthorizationServer
public class OAuth2Config extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        // optionally here you could just get endpoints.getConsumerTokenService()
        // and cast to DefaultTokenServices and just set values needed

        DefaultTokenServices tokenServices = new DefaultTokenServices();
        tokenServices.setTokenStore(endpoints.getTokenStore());
        tokenServices.setSupportRefreshToken(true);
        tokenServices.setClientDetailsService(endpoints.getClientDetailsService());
        tokenServices.setTokenEnhancer(endpoints.getTokenEnhancer());
        tokenServices.setAccessTokenValiditySeconds(60);

        endpoints.tokenServices(tokenServices);            
    }
}

Answer 2

配置oauth配置，更改Bean TokenServices并设置 accessTokenValiditySeconds 属性：

<bean id="tokenServices"
    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <property name="accessTokenValiditySeconds" value="1" />
    <property name="tokenStore" ref="tokenStore" />
    <property name="supportRefreshToken" value="true" />
    <property name="clientDetailsService" ref="clientDetails" />
</bean>

Answer 3

您还可以在application.yaml file中配置DefaultTokenServices。

security:
  oauth2:
    client:
      clientId: client-id
      clientSecret: client-secret
      authorized-grant-types: authorization_code,refresh_token,password
      scope: openid
      access-token-validity-seconds: 30

Answer 4

创建自定义类AuthorizationCodeAccessTokenProvider并覆盖父

public method obtainAccessToken(OAuth2ProtectedResourceDetails details, AccessTokenRequest request)

在自定义类的重写方法中，调用其父类的程序逻辑：

DefaultOAuth2AccessToken token = super.obtainAccessToken(details, request);

这将返回一个AccessToken。现在，您只需通过提供过去的时间戳来直接操纵该令牌的过期值 token.setExpiresIn(int timestamp)

Answer 5

也在寻找这个答案，并尝试了DeezCashews提出的解决方案。但这对我不起作用，因为有一部分代码首先检查此值是否在access_token_validity表oauth_client_details列中设置，然后才从tokenServices中获取值。因此，如果在oauth_client_details表中设置了“ expires_in”，则需要在其中进行更改。

检查db中有效性属性的代码：

    protected int getAccessTokenValiditySeconds(OAuth2Request clientAuth) {
    if (clientDetailsService != null) {
        ClientDetails client = clientDetailsService.loadClientByClientId(clientAuth.getClientId());
        Integer validity = client.getAccessTokenValiditySeconds();
        if (validity != null) {
            return validity;
        }
    }
    return accessTokenValiditySeconds;
}

Answer 6

因此，我认为没有任何政策可以这样做。但是有一种方法可以导致成功。只需使用refresh_token API即可使当前的access_token无效。：D 很简单。

Answer 7

public interface OAuth2AccessToken {

    public static String BEARER_TYPE = "Bearer";

    public static String OAUTH2_TYPE = "OAuth2";

    /**
     * The access token issued by the authorization server. This value is REQUIRED.
     */
    public static String ACCESS_TOKEN = "access_token";

    /**
     * The type of the token issued as described in <a
     * href="http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-7.1">Section 7.1</a>. Value is case insensitive.
     * This value is REQUIRED.
     */
    public static String TOKEN_TYPE = "token_type";

    /**
     * The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will
     * expire in one hour from the time the response was generated. This value is OPTIONAL.
     */
    public static String EXPIRES_IN = "expires_in";

    /**
     * The refresh token which can be used to obtain new access tokens using the same authorization grant as described
     * in <a href="http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-6">Section 6</a>. This value is OPTIONAL.
     */
    public static String REFRESH_TOKEN = "refresh_token";

    /**
     * The scope of the access token as described by <a
     * href="http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-3.3">Section 3.3</a>
     */
    public static String SCOPE = "scope";

    /**
     * The additionalInformation map is used by the token serializers to export any fields used by extensions of OAuth.
     * @return a map from the field name in the serialized token to the value to be exported. The default serializers 
     * make use of Jackson's automatic JSON mapping for Java objects (for the Token Endpoint flows) or implicitly call 
     * .toString() on the "value" object (for the implicit flow) as part of the serialization process.
     */
    Map<String, Object> getAdditionalInformation();

    Set<String> getScope();

    OAuth2RefreshToken getRefreshToken();

    String getTokenType();

    boolean isExpired();

    Date getExpiration();

    int getExpiresIn();

    String getValue();

}

如何在OAUTH 2.0中设置expire_in？

7 个答案: