我有一台基于Spring Boot 1.5(Spring Security v4)的Spring OAuth 2服务器,该服务器生成自定义令牌,并有一些与该授权服务器通信的资源服务器,它们通过配置{{ 1}}。
与授权服务器端上的令牌存储/检索有关的所有逻辑都是通过/oauth/check_token
完成的。
我正在构建一个新的Spring Boot 2应用程序,该应用程序是通过Spring webflux模块构建的,并尝试使用Spring Security 5.1.1使用现有的Authorization Server实现RemoteTokenServices
流。
我发现在5.1.0.RC1(https://spring.io/blog/2018/08/21/spring-security-5-1-0-rc1-released#oauth2-resource-servers)中添加了对资源服务器的支持,并在5.1.0.RC2(https://spring.io/blog/2018/09/10/spring-security-5-1-0-rc2-released#oauth2-resource-server)中对其进行了更新,但是看起来只能通过JWT支持对其进行配置。
我可能在这里弄乱了概念,但正在寻找更多信息以及一种将所有这些组件一起配置的方法。
答案 0 :(得分:3)
我和您的处境相同。我以另一种方式解决了这个问题,也许可以为您提供帮助:
spring-boot-starter-parent.version :2.1.1
spring-cloud-dependencies.version :格林威治R1
安全配置:
@EnableWebFluxSecurity
public class SecurityConfig {
@Autowired
private ReactiveAuthenticationManager manager; //custom implementation
@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
return http
.authorizeExchange()
.pathMatchers("/role").hasRole("ADMIN")
.pathMatchers("/test").access(new HasScope("server")) //custom implementation
.anyExchange().authenticated()
.and()
.httpBasic().disable()
.oauth2ResourceServer()
.jwt()
.authenticationManager(manager)
.and().and()
.build();
}
}
ReactiveAuthorizationManager(HasScope)实现: 允许在身份验证对象中搜索范围的助手
public class HasScope implements ReactiveAuthorizationManager<AuthorizationContext> {
public HasScope(String...scopes) {
this.scopes = Arrays.asList(scopes);
}
private final Collection<String> scopes;
@Override
public Mono<AuthorizationDecision> check(Mono<Authentication> authentication, AuthorizationContext object) {
return authentication
.flatMap(it -> {
OAuth2Authentication auth = (OAuth2Authentication) it;
Set<String> requestScopes = auth.getOAuth2Request().getScope();
boolean allow = requestScopes.containsAll(scopes);
return Mono.just(new AuthorizationDecision(allow));
});
}
}
ReactiveAuthenticationManager实现:
这是配置中创建 OAuth2Authentication 的主要组件。错误的access_token响应存在问题,它仅返回状态代码,没有主体响应。
@Component
public class ReactiveAuthenticationManagerImpl implements ReactiveAuthenticationManager {
private final ResourceServerProperties sso;
private final WebClient.Builder webClient;
private final ObjectMapper objectMapper;
private AuthoritiesExtractor authoritiesExtractor = new FixedAuthoritiesExtractor();
public ReactiveAuthenticationManagerImpl(ResourceServerProperties sso,
@Qualifier("loadBalancedWebClient") WebClient.Builder webClient, ObjectMapper objectMapper) {
this.sso = sso;
this.webClient = webClient;
this.objectMapper = objectMapper;
}
@Override
public Mono<Authentication> authenticate(Authentication authentication) {
return Mono.just(authentication)
.cast(BearerTokenAuthenticationToken.class)
.flatMap(it -> getMap(it.getToken()))
.flatMap(result -> Mono.just(extractAuthentication(result)));
}
private OAuth2Authentication extractAuthentication(Map<String, Object> map) {
Object principal = getPrincipal(map);
OAuth2Request request = getRequest(map);
List<GrantedAuthority> authorities = authoritiesExtractor.extractAuthorities(map);
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(principal, "N/A", authorities);
token.setDetails(map);
return new OAuth2Authentication(request, token);
}
private Object getPrincipal(Map<String, Object> map) {
if (map.containsKey("principal")) {
try {
//that is the case for user authentication
return objectMapper.convertValue(map.get("principal"), UserPrincipal.class);
} catch (IllegalArgumentException ex) {
//that is the case for client authentication
return objectMapper.convertValue(map.get("principal"), String.class);
}
}
return null;
}
@SuppressWarnings({"unchecked"})
private OAuth2Request getRequest(Map<String, Object> map) {
Map<String, Object> request = (Map<String, Object>) map.get("oauth2Request");
String clientId = (String) request.get("clientId");
Set<String> scope = new LinkedHashSet<>(request.containsKey("scope") ?
(Collection<String>) request.get("scope") : Collections.emptySet());
return new OAuth2Request(null, clientId, null, true, new HashSet<>(scope),
null, null, null, null);
}
private Mono<Map<String, Object>> getMap(String accessToken) {
String uri = sso.getUserInfoUri();
return webClient.build().get()
.uri(uri)
.accept(MediaType.APPLICATION_JSON)
.header("Authorization", "Bearer " + accessToken)
.exchange()
.flatMap(it -> it.bodyToMono(new ParameterizedTypeReference<Map<String, Object>>() {}))
.onErrorMap(InvalidTokenException.class, mapper -> new InvalidTokenException("Invalid token: " + accessToken));
}