Question

我有单独的授权服务器和资源服务器。授权服务器指向单独的数据库。我使用CustomUserDetailService来获取用户相关信息。我使用CustomTokenEnhancer除了响应中的令牌之外还有其他信息。

@Configuration
public class OAuth2Configuration {


    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter implements EnvironmentAware {

        private static final String ENV_OAUTH = "authentication.oauth.";
        private static final String PROP_CLIENTID = "clientid";
        private static final String PROP_SECRET = "secret";
        private static final String PROP_TOKEN_VALIDITY_SECONDS = "tokenValidityInSeconds";

        private RelaxedPropertyResolver propertyResolver;

        @Autowired
        private DataSource dataSource;

        @Autowired
        private CustomUserDetailService userDetailsService;

        @Bean
        public TokenStore tokenStore() {
            return new CustomTokenStore(dataSource);
        }

        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints)
                throws Exception {
            endpoints
                    .tokenStore(tokenStore())
                    .userDetailsService(userDetailsService)

                    .tokenEnhancer(tokenEnhancer())
                    .accessTokenConverter(accessTokenConverter())

                    .authenticationManager(authenticationManager);
        }

        @Bean
        public TokenEnhancer tokenEnhancer() {
           return new CustomTokenEnhancer();
        }

        @Bean
        public DefaultAccessTokenConverter accessTokenConverter() {
            return new DefaultAccessTokenConverter();
        }


        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer)
                throws Exception {
            oauthServer
                .tokenKeyAccess("permitAll()")
                .checkTokenAccess("isAuthenticated()");
        }
    }

}

CustomUserDetailService类：

@Service
public class CustomUserDetailService implements UserDetailsService {


    @Autowired
    private AccountRepository accountRepository;

    @Override
    public UserDetails loadUserByUsername(String username) {

        Account account = accountRepository.getByEmail(username);

        if(account == null) {
            throw new UsernameNotFoundException(username);
        }

        return new MyUserPrincipal(account);

    }
}

CustomTokenEnhancer类：

public class CustomTokenEnhancer implements TokenEnhancer {

    @Override
    public OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {
        MyUserPrincipal user = (MyUserPrincipal) authentication.getPrincipal();
        final Map<String, Object> additionalInfo = new HashMap<>();

        additionalInfo.put("user_information", user.getAccount());

        ((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(additionalInfo);

        return accessToken;
    }

}

请求/响应

http://localhost:9191/authserver/oauth/token


{
    "access_token": "fddb571e-224e-4cd7-974e-65104dd24b41",
    "token_type": "bearer",
    "refresh_token": "eb412b00-9e4e-4d6c-86d8-324d999b5f08",
    "expires_in": 100,
    "scope": "read write",
    "account_information": {
        "id": 14,
        "firstname": "name",
        "lastname": "lastname",

    }
}

在资源服务器端，我使用RemoteTokenSerice来验证用户提供的令牌是否有效。

@Configuration
@EnableResourceServer
public class OAuthResourceConfig extends ResourceServerConfigurerAdapter {

    private TokenExtractor tokenExtractor = new BearerTokenExtractor();

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.addFilterAfter(new OncePerRequestFilter() {
            @Override
            protected void doFilterInternal(HttpServletRequest request,
                    HttpServletResponse response, FilterChain filterChain)
                    throws ServletException, IOException {
                if (tokenExtractor.extract(request) == null) {
                    SecurityContextHolder.clearContext();
                }
                filterChain.doFilter(request, response);
            }
        }, AbstractPreAuthenticatedProcessingFilter.class);
        http.csrf().disable();
        http.authorizeRequests().anyRequest().authenticated();
    }

    @Bean
    public AccessTokenConverter accessTokenConverter() {
        return new DefaultAccessTokenConverter();
    }

    @Bean
    @Primary
    public RemoteTokenServices remoteTokenServices(final @Value("${auth.server.url}") String checkTokenUrl,
            final @Value("${auth.server.clientId}") String clientId,
            final @Value("${auth.server.clientsecret}") String clientSecret) {


        final RemoteTokenServices remoteTokenServices = new RemoteTokenServices();
        remoteTokenServices.setCheckTokenEndpointUrl(checkTokenUrl+"?name=value");
        remoteTokenServices.setClientId(clientId);
        remoteTokenServices.setClientSecret(clientSecret);
        remoteTokenServices.setAccessTokenConverter(accessTokenConverter());
        return remoteTokenServices;
    }

    }

所以它正常工作，当我使用令牌向资源服务器发出请求时，如果令牌有效，它会处理请求。我的问题是我想在资源服务器中获取Account对象。我在下面尝试过：

 Account account = (Account)SecurityContextHolder.getContext().getAuthentication().getPrincipal()

但是它给出了字符串而不是完整的用户定义对象，因此它抛出了异常。如何在资源服务器的任何控制器中获取Account对象？

{
    "timestamp": 1499334657703,
    "status": 500,
    "error": "Internal Server Error",
    "exception": "java.lang.ClassCastException",
    "message": "java.lang.String cannot be cast to Account",
    "path": "/secure"
    }

我试过link但是可以注入两个令牌服务，RemoteTokenService和CustomUserInfoTokenServices吗？

此外，我认为spring在内部调用从Resource Server到Authorization Server（http://localhost:9191/authserver/oauth/check_token?token=d8dae984-7bd8-4aab-9990-a2c916dfe667）来验证令牌。

有没有办法在控制器中获取这些信息而无需再次调用此端点。

响应：

{
    "exp": 1499333294,
    "account_information": {
        "accountid": 14,
        "firstname": "fname",
        "lastname": "lname",

    },
    "user_name": "abc@abc.com",
    "client_id": "clientId",
    "scope": [
        "read",
        "write"
    ]
}

Answer 1

我已经覆盖了下面的方法，并添加了一些逻辑。

public class CustomAccessTokenConverter extends DefaultAccessTokenConverter{

    private UserAuthenticationConverter userTokenConverter = new DefaultUserAuthenticationConverter();

    @Override
    public OAuth2Authentication extractAuthentication(Map<String, ?> map) {
        Map<String, String> parameters = new HashMap<String, String>();
        @SuppressWarnings("unchecked")
        Set<String> scope = new LinkedHashSet<String>(map.containsKey(SCOPE) ? (Collection<String>) map.get(SCOPE)
                : Collections.<String>emptySet());
        Authentication user = userTokenConverter.extractAuthentication(map);
        String clientId = (String) map.get(CLIENT_ID);
        parameters.put(CLIENT_ID, clientId);
        parameters.put("account_information", String.valueOf((((Map) map.get("account_information")).get("accountid"))));
        @SuppressWarnings("unchecked")
        Set<String> resourceIds = new LinkedHashSet<String>(map.containsKey(AUD) ? (Collection<String>) map.get(AUD)
                : Collections.<String>emptySet());

        Map<String, Serializable> extensions = new HashMap<String, Serializable>();
        extensions.put("account_information", (HashMap) map.get("account_information"));

        OAuth2Request request = new OAuth2Request(parameters, clientId, null, true, scope, resourceIds, null, null,
                extensions);
        return new OAuth2Authentication(request, user);
    }

}

资源服务器类

@Bean
    public AccessTokenConverter accessTokenConverter() {
        //return new DefaultAccessTokenConverter();
        return new CustomAccessTokenConverter();
    }

    @Bean
    @Primary
    public RemoteTokenServices remoteTokenServices(final @Value("${auth.server.url}") String checkTokenUrl,
            final @Value("${auth.server.clientId}") String clientId,
            final @Value("${auth.server.clientsecret}") String clientSecret) {


        final RemoteTokenServices remoteTokenServices = new RemoteTokenServices();
        remoteTokenServices.setCheckTokenEndpointUrl(checkTokenUrl+"?name=value");
        remoteTokenServices.setClientId(clientId);
        remoteTokenServices.setClientSecret(clientSecret);
        remoteTokenServices.setAccessTokenConverter(accessTokenConverter());
        return remoteTokenServices;
    }

现在我可以在控制器中获得更多信息。

OAuth2Authentication authentication = (OAuth2Authentication)SecurityContextHolder.getContext().getAuthentication();

        Map<String, Serializable> map = authentication.getOAuth2Request().getExtensions();

Answer 2

我以这种方式使用。调用/ oauth / token之后，我可以进入下面，并且member_id是我添加的其他字段。 { "access_token": "this is access token", "token_type": "bearer", "refresh_token": this is refreshtoken", "expires_in": 3599, "scope": "web", "member_id": "d2lsbGlhbQ", "jti": "79b9b523-921d-45c1-ba97-d3565f1d68b7" } 解码访问令牌后，我可以在其中看到此自定义字段member_id。

以下是我在资源服务器中所做的事情。

在配置类中清除Bean DefaultTokenService

@Bean @Primary public DefaultTokenServices tokenServices() throws IOException { DefaultTokenServices defaultTokenServices = new DefaultTokenServices(); defaultTokenServices.setTokenStore(tokenStore()); return defaultTokenServices; }

在这里，我将资源注入控制器。

@Autowired private ResourceServerTokenServices resourceServerTokenServices;

@GetMapping("/addition") public Map<String, Object> addition() { Map<String, Object> response = new HashMap<>(); response.put("member_id", resourceServerTokenServices.readAccessToken(((OAuth2AuthenticationDetails) SecurityContextHolder.getContext().getAuthentication().getDetails()).getTokenValue()).getAdditionalInformation().get("member_id")); return response; }

然后我将其称为/addition，可以看到响应。 { "member_id": "d2lsbGlhbQ" }

我是使用JWT的oAuth2的较新手，所以我已经在Internet上进行了一些研究，但是找不到从资源服务器获取它的敏感方法。所以我尝试一些方法来做到这一点。希望它能起作用。

如何在spring-security-oauth2中获取资源服务器中的自定义UserDetailService对象？

2 个答案: