我正在尝试通过 WebClient 调用升级到 spring security 5.5.1。
我发现 oauth2 clientId 和 secret 现在是在 AbstractWebClientReactiveOAuth2AccessTokenResponseClient
中编码的 URL,但是我的令牌提供程序不支持这个(例如,如果秘密包含+
字符,它仅在作为 +
而非 %2B
发送时才起作用)。
我知道这被视为 bug fix from spring-security side ),但我无法让令牌提供者轻松更改其行为。
所以我试图找到一种方法来解决这个问题。
有关如何自定义访问令牌请求的 [文档] (https://docs.spring.io/spring-security/site/docs/current/reference/html5/#customizing-the-access-token-request) 在您使用 WebClient 配置(这是我的情况)时似乎不适用。
为了删除 clientid/secret 编码,我不得不扩展和复制 AbstractWebClientReactiveOAuth2AccessTokenResponseClient
中的大部分现有代码以自定义 WebClientReactiveClientCredentialsTokenResponseClient
,因为其中大部分具有私有/默认可见性。
我在 spring-security 项目的 enhancement issue 中对此进行了跟踪。
是否有更简单的方法来自定义令牌请求的 Authorization 标头,以跳过 url 编码?
答案 0 :(得分:3)
围绕定制的一些 API 肯定有改进的空间,并且来自社区的这些类型的问题/请求/问题肯定会继续帮助突出这些领域。
特别是关于 AbstractWebClientReactiveOAuth2AccessTokenResponseClient
,目前无法覆盖内部方法以在 Authorization
标头中填充基本身份验证凭据。但是,您可以自定义用于进行 API 调用的 WebClient
。如果它在您的用例中是可以接受的(暂时,在解决行为更改和/或添加自定义选项时),您应该能够拦截 WebClient
中的请求。
以下配置将创建能够使用 WebClient
的 OAuth2AuthorizedClient
:
@Configuration
public class WebClientConfiguration {
@Bean
public WebClient webClient(ReactiveOAuth2AuthorizedClientManager authorizedClientManager) {
// @formatter:off
ServerOAuth2AuthorizedClientExchangeFilterFunction exchangeFilterFunction =
new ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
exchangeFilterFunction.setDefaultOAuth2AuthorizedClient(true);
return WebClient.builder()
.filter(exchangeFilterFunction)
.build();
// @formatter:on
}
@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
ReactiveClientRegistrationRepository clientRegistrationRepository,
ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {
// @formatter:off
WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setWebClient(createAccessTokenResponseWebClient());
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.clientCredentials(consumer ->
consumer.accessTokenResponseClient(accessTokenResponseClient)
.build())
.build();
DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
new DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository);
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
// @formatter:on
return authorizedClientManager;
}
protected WebClient createAccessTokenResponseWebClient() {
// @formatter:off
return WebClient.builder()
.filter((clientRequest, exchangeFunction) -> {
HttpHeaders headers = clientRequest.headers();
String authorizationHeader = headers.getFirst("Authorization");
Assert.notNull(authorizationHeader, "Authorization header cannot be null");
Assert.isTrue(authorizationHeader.startsWith("Basic "),
"Authorization header should start with Basic");
String encodedCredentials = authorizationHeader.substring("Basic ".length());
byte[] decodedBytes = Base64.getDecoder().decode(encodedCredentials);
String credentialsString = new String(decodedBytes, StandardCharsets.UTF_8);
Assert.isTrue(credentialsString.contains(":"), "Decoded credentials should contain a \":\"");
String[] credentials = credentialsString.split(":");
String clientId = URLDecoder.decode(credentials[0], StandardCharsets.UTF_8);
String clientSecret = URLDecoder.decode(credentials[1], StandardCharsets.UTF_8);
ClientRequest newClientRequest = ClientRequest.from(clientRequest)
.headers(httpHeaders -> httpHeaders.setBasicAuth(clientId, clientSecret))
.build();
return exchangeFunction.exchange(newClientRequest);
})
.build();
// @formatter:on
}
}
此测试表明凭据已针对内部访问令牌响应 WebClient
进行解码:
@ExtendWith(MockitoExtension.class)
public class WebClientConfigurationTests {
private WebClientConfiguration webClientConfiguration;
@Mock
private ExchangeFunction exchangeFunction;
@Captor
private ArgumentCaptor<ClientRequest> clientRequestCaptor;
@BeforeEach
public void setUp() {
webClientConfiguration = new WebClientConfiguration();
}
@Test
public void exchangeWhenBasicAuthThenDecoded() {
WebClient webClient = webClientConfiguration.createAccessTokenResponseWebClient()
.mutate()
.exchangeFunction(exchangeFunction)
.build();
when(exchangeFunction.exchange(any(ClientRequest.class)))
.thenReturn(Mono.just(ClientResponse.create(HttpStatus.OK).build()));
webClient.post()
.uri("/oauth/token")
.headers(httpHeaders -> httpHeaders.setBasicAuth("aladdin", URLEncoder.encode("open sesame", StandardCharsets.UTF_8)))
.retrieve()
.bodyToMono(Void.class)
.block();
verify(exchangeFunction).exchange(clientRequestCaptor.capture());
ClientRequest clientRequest = clientRequestCaptor.getValue();
String authorizationHeader = clientRequest.headers().getFirst("Authorization");
assertThat(authorizationHeader).isNotNull();
String encodedCredentials = authorizationHeader.substring("Basic ".length());
byte[] decodedBytes = Base64.getDecoder().decode(encodedCredentials);
String credentialsString = new String(decodedBytes, StandardCharsets.UTF_8);
String[] credentials = credentialsString.split(":");
assertThat(credentials[0]).isEqualTo("aladdin");
assertThat(credentials[1]).isEqualTo("open sesame");
}
}