Question

我已经改编了here中的代码以调用MitreID OIDC服务器。

我的控制器：

    public final String home(Principal p) {
    final String username = SecurityContextHolder.getContext().getAuthentication().getName();
...

返回null，并且对于所有用户详细信息均为空。

我也尝试过：

public final String home(@AuthenticationPrincipal OpenIdConnectUserDetails user) {
        final String username = user.getUsername();

和

@RequestMapping(value = "/username", method = RequestMethod.GET)
    @ResponseBody
    public String currentUserNameSimple(HttpServletRequest request) {
        Principal principal = request.getUserPrincipal();
        return "username: " + principal.getName();
    }

所有内容均为空，但身份验证返回访问和用户令牌。

我的安全配置为：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private OAuth2RestTemplate restTemplate;

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**");
    }

    @Bean
    public OpenIdConnectFilter myFilter() {

        final OpenIdConnectFilter filter = new OpenIdConnectFilter("/openid_connect_login");
        filter.setRestTemplate(restTemplate);
        return filter;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        // @formatter:off
        http
        .addFilterAfter(new OAuth2ClientContextFilter(), AbstractPreAuthenticatedProcessingFilter.class)
        .addFilterAfter(myFilter(), OAuth2ClientContextFilter.class)
        .httpBasic().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/openid_connect_login"))
        .and()
        .authorizeRequests()
        .antMatchers("/","/index*").permitAll()
        .anyRequest().authenticated()
        ;

     // @formatter:on
    }
}

那为什么我的控制器无法访问用户详细信息？

编辑：根据要求，OpenIdConnectFilter：

 package org.baeldung.security;

import java.io.IOException;
import java.net.URL;
import java.security.interfaces.RSAPublicKey;
import java.util.Date;
import java.util.Map;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.jwt.Jwt;
import org.springframework.security.jwt.JwtHelper;
import org.springframework.security.jwt.crypto.sign.RsaVerifier;
import org.springframework.security.oauth2.client.OAuth2RestOperations;
import org.springframework.security.oauth2.client.OAuth2RestTemplate;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.common.exceptions.OAuth2Exception;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;

import com.auth0.jwk.Jwk;
import com.auth0.jwk.JwkProvider;
import com.auth0.jwk.UrlJwkProvider;
import com.fasterxml.jackson.databind.ObjectMapper;

public class OpenIdConnectFilter extends AbstractAuthenticationProcessingFilter {
    @Value("${oidc.clientId}")
    private String clientId;

    @Value("${oidc.issuer}")
    private String issuer;

    @Value("${oidc.jwkUrl}")
    private String jwkUrl;

    public OAuth2RestOperations restTemplate;

    public OpenIdConnectFilter(String defaultFilterProcessesUrl) {
        super(defaultFilterProcessesUrl);
        setAuthenticationManager(new NoopAuthenticationManager());
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {

        OAuth2AccessToken accessToken;
        logger.info("ewd here: b " );
        try {
            accessToken = restTemplate.getAccessToken();
        } catch (final OAuth2Exception e) {
            throw new BadCredentialsException("Could not obtain access token", e);
        }
        try {
            logger.info("ewd access token: " + accessToken);
            final String idToken = accessToken.getAdditionalInformation().get("id_token").toString();
            String kid = JwtHelper.headers(idToken)
                .get("kid");
            final Jwt tokenDecoded = JwtHelper.decodeAndVerify(idToken, verifier(kid));
            final Map<String, String> authInfo = new ObjectMapper().readValue(tokenDecoded.getClaims(), Map.class);
            verifyClaims(authInfo);
            final OpenIdConnectUserDetails user = new OpenIdConnectUserDetails(authInfo, accessToken);
            logger.info("ewd user token: " + tokenDecoded);
            return new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
        } catch (final Exception e) {
            throw new BadCredentialsException("Could not obtain user details from token", e);
        }

    }

    public void verifyClaims(Map claims) {
        int exp = (int) claims.get("exp");
        Date expireDate = new Date(exp * 1000L);
        Date now = new Date();
        if (expireDate.before(now) || !claims.get("iss").equals(issuer) || !claims.get("aud").equals(clientId)) {
            throw new RuntimeException("Invalid claims");
        }
    }


    private RsaVerifier verifier(String kid) throws Exception {
        JwkProvider provider = new UrlJwkProvider(new URL(jwkUrl));
        Jwk jwk = provider.get(kid);
        return new RsaVerifier((RSAPublicKey) jwk.getPublicKey());
    }

    public void setRestTemplate(OAuth2RestTemplate restTemplate2) {
        restTemplate = restTemplate2;

    }

    private static class NoopAuthenticationManager implements AuthenticationManager {

        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            throw new UnsupportedOperationException("No authentication should be done with this AuthenticationManager");
        }

    }
}

Answer 1

在您参考的教程中，使用了Google OpenId Connect。此服务还返回在以下位置读取的额外范围的电子邮件变量：

OpenIdConnectUserDetails.class

    public OpenIdConnectUserDetails(Map<String, String> userInfo, OAuth2AccessToken token) {
        this.userId = userInfo.get("sub");
        this.username = userInfo.get("email");
        this.token = token;
    }

不知道您的MitreID OIDC服务器的具体配置，也许openId服务器没有返回电子邮件变量

Answer 2

我是新的auth0用户，并且遇到相同的问题，试图在Spring Controller中获取一些用户信息。我可以使用此代码从令牌访问声明。

@GetMapping
public List<Task> getTasks(AuthenticationJsonWebToken authentication) {
    logger.debug("getTasks called.");
    DecodedJWT jwt = JWT.decode(authentication.getToken());
    Map<String, Claim> claims = jwt.getClaims();
    for (Object key: claims.keySet()) {
        logger.debug("key: {}, value: {}", key.toString(),  claims.get(key).asString());
    }

    return taskRepository.findAll();
}

希望这会有所帮助。

Answer 3

如果您需要用户名，您可以从 JwtAuthenticationToken 对象中获取，如下所示：

@GetMapping("/home")
public String home(JwtAuthenticationToken user) {
        String name = user.getName();

如果您需要用户个人资料中的其他信息，您可以使用访问令牌调用您的身份验证服务器的 /userinfo 端点，如下所示： 仅当您在 profile 调用中包含 authorize 范围时，才会获取信息。

@GetMapping("/home")
public String home(JwtAuthenticationToken user) {

        HttpHeaders headers = new HttpHeaders();
        headers.add(HttpHeaders.AUTHORIZATION, "Bearer "+user.getToken().getTokenValue());
        HttpEntity entity = new HttpEntity(headers);
        ResponseEntity<Map> userinfo = template.exchange("https://your-auth-server/default/v1/userinfo", HttpMethod.GET, entity, Map.class);
        String name = (String) userinfo.getBody().get("given_name");

您可以从此响应中检索所有个人资料属性。

如何在Spring Boot OIDC应用程序的控制器中获取用户详细信息？

3 个答案: