春季启动OAuth2Client，回调后用户未通过身份验证：SecurityContext为空或内容为匿名

Question

我正在配置一个Spring Boot应用程序，它将使用OAuth2和OpenID Connect对用户进行身份验证。对于实现，我在这里遵循以下参考：https://docs.spring.io/spring-security/site/docs/current/reference/html5/#oauth2

完成AuthorizationCode后，不对用户进行身份验证。如何验证用户？

我依赖的OpenID服务器需要一个用于授权端点的附加参数（acr_values = {value}）。

我能够使用AuthorizationRequestResolver添加参数并调用授权端点，然后服务器在我的回调中重定向我，但用户未通过身份验证。在跟踪中，SecurityContext为空，不保存在httpsession中。 我在日志中看到对令牌端点的POST请求已发送，并且得到响应200。

MySecurityConfig

docker container inspect d8af01990363

以及 MyClientApplication

test

package com.uta.security.edc.config;

import java.util.ArrayList;
import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.client.DefaultOAuth2ClientContext;
import org.springframework.security.oauth2.client.OAuth2RestTemplate;
import org.springframework.security.oauth2.client.endpoint.DefaultAuthorizationCodeTokenResponseClient;
import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequest;
import org.springframework.security.oauth2.client.http.OAuth2ErrorResponseErrorHandler;
import org.springframework.security.oauth2.client.registration.ClientRegistration;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.resource.OAuth2ProtectedResourceDetails;
import org.springframework.security.oauth2.client.token.DefaultAccessTokenRequest;
import org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeResourceDetails;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableOAuth2Client;
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
import org.springframework.web.client.RestTemplate;

import com.uta.security.edc.oauth2.MyAuthorizationRequestResolver;
import com.uta.security.edc.oauth2.MyTokenResponseConverter;

@Configuration
@EnableOAuth2Client
public class MySecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private ClientRegistrationRepository clientRegistrationRepository;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/", "/connect/**", "/test/**", "/assets/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .oauth2Login()
                .loginPage("/connect/login")
                .authorizationEndpoint()
                    .baseUri("/connect/authorization")
                    .authorizationRequestResolver(this.authorizationRequestResolver())
                    .and()
                .redirectionEndpoint()
                    .baseUri("/connect/callback")
                    .and()
                .tokenEndpoint()
                    .accessTokenResponseClient(this.accessTokenResponseClient())
                    .and()
                .userInfoEndpoint()
                    .and()
                .defaultSuccessUrl("/")
                .failureUrl("/connect/loginFailure")
                .and()
            .oauth2Client();
    }

    @Bean 
    public MyAuthorizationRequestResolver authorizationRequestResolver()
    {
        return new MyAuthorizationRequestResolver(this.clientRegistrationRepository);
    }

    @Bean
    public OAuth2RestTemplate oauth2RestTemplate()
    {
        return new OAuth2RestTemplate(resource(), new DefaultOAuth2ClientContext(new DefaultAccessTokenRequest()));
    }

    @Bean
    protected OAuth2ProtectedResourceDetails resource() {
        ClientRegistration clientRegistration = clientRegistrationRepository.findByRegistrationId("my-connect");
        AuthorizationCodeResourceDetails resource = new AuthorizationCodeResourceDetails();
        List<String> scopes = new ArrayList<String>(1);
        scopes.add("uta-poc-edc");
        resource.setAccessTokenUri(clientRegistration.getProviderDetails().getTokenUri());
        resource.setClientId(clientRegistration.getClientId());
        resource.setClientSecret(clientRegistration.getClientSecret());
        resource.setScope(scopes);
        return resource;
    }

    @Bean
    public OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient()
    {        
        DefaultAuthorizationCodeTokenResponseClient accessTokenResponseClient = new DefaultAuthorizationCodeTokenResponseClient(); 

        OAuth2AccessTokenResponseHttpMessageConverter tokenResponseHttpMessageConverter = new OAuth2AccessTokenResponseHttpMessageConverter(); 
        tokenResponseHttpMessageConverter.setTokenResponseConverter(new MyTokenResponseConverter()); 

        RestTemplate restTemplate = this.oauth2RestTemplate();
        //RestTemplate restTemplate = new RestTemplate(Arrays.asList(new FormHttpMessageConverter(), tokenResponseHttpMessageConverter)); 
        restTemplate.setErrorHandler(new OAuth2ErrorResponseErrorHandler()); 
        accessTokenResponseClient.setRestOperations(restTemplate); 

        return accessTokenResponseClient;
    }

    /*@Bean
    public OAuth2AuthorizedClientManager authorizedClientManager(ClientRegistrationRepository clientRegistrationRepository, OAuth2AuthorizedClientRepository authorizedClientRepository)
    {
        OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
                        .authorizationCode()
                        .refreshToken()
                        .build();

        DefaultOAuth2AuthorizedClientManager authorizedClientManager = new DefaultOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientRepository);
        authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

        return authorizedClientManager;
    }*/
}

我需要对用户进行身份验证并将其身份验证信息保存在其httpsession中，以便请求资源服务器。

谢谢您的帮助！