java - 如何使用 Java 配置在 Google OAuth2 AccountChooser 中设置托管域参数？

Question

目前我有使用以下 Java 配置的 OAuth2 身份验证流程:

@Configuration
@EnableOAuth2Client
@Import(SecurityWebAppInitializer.class)
public class OAuth2SecurityConfiguration {

    @Resource
    private GoogleClientSecrets googleClientSecrets;

    @Resource
    private AccessTokenRequest accessTokenRequest;

    @Bean
    public AuthorizationCodeResourceDetails googleResource() {
        AuthorizationCodeResourceDetails details = new AuthorizationCodeResourceDetails();
        GoogleClientSecrets.Details web = googleClientSecrets.getWeb();
        details.setId((String) web.get("project_id"));
        details.setClientId(web.getClientId());
        details.setClientSecret(web.getClientSecret());
        details.setAccessTokenUri(web.getTokenUri());
        details.setUserAuthorizationUri(web.getAuthUri());
        details.setTokenName((String) web.get("token_name"));

        String commaSeparatedScopes = (String) web.get("scope");
        details.setScope(parseScopes(commaSeparatedScopes));
        details.setPreEstablishedRedirectUri(web.getRedirectUris().get(0));
        details.setUseCurrentUri(false);
        details.setAuthenticationScheme(AuthenticationScheme.query);
        details.setClientAuthenticationScheme(AuthenticationScheme.form);
        return details;
    }

    private List<String> parseScopes(String commaSeparatedScopes) {
        List<String> scopes = newArrayList();
        Collections.addAll(scopes, commaSeparatedScopes.split(","));
        return scopes;
    }

    @Bean
    public OAuth2ClientAuthenticationProcessingFilter oAuth2AuthenticationProcessingFilter(
            OAuth2RestTemplate oAuth2RestTemplate, ResourceServerTokenServices resourceServerTokenServices) {
        OAuth2ClientAuthenticationProcessingFilter filter =
                new OAuth2ClientAuthenticationProcessingFilter("/googleLogin");
        filter.setRestTemplate(oAuth2RestTemplate);
        filter.setTokenServices(resourceServerTokenServices);
        return filter;
    }

    @Bean
    public UserAuthenticationConverter userTokenConverter() {
        return new DefaultUserAuthenticationConverter();
    }

    @Bean
    public AccessTokenConverter accessTokenConverter(UserAuthenticationConverter userTokenConverter) {
        GoogleAccessTokenConverter accessTokenConverter = new GoogleAccessTokenConverter();
        accessTokenConverter.setUserTokenConverter(userTokenConverter);
        return new GoogleAccessTokenConverter();
    }

    @Bean
    public GoogleTokenServices tokenServices(AccessTokenConverter accessTokenConverter) {
        GoogleTokenServices tokenServices = new GoogleTokenServices();
        GoogleClientSecrets.Details web = googleClientSecrets.getWeb();
        tokenServices.setCheckTokenEndpointUrl("https://www.googleapis.com/oauth2/v1/tokeninfo");
        tokenServices.setClientId(web.getClientId());
        tokenServices.setClientSecret(web.getClientSecret());
        tokenServices.setAccessTokenConverter(accessTokenConverter);
        return tokenServices;
    }

    @Bean
    public OAuth2RestTemplate googleRestTemplate() {
        return new OAuth2RestTemplate(googleResource(), new DefaultOAuth2ClientContext(accessTokenRequest));
    }

    @Bean
    public OAuth2ClientContextFilter oauth2ClientContextFilter() {
        return new OAuth2ClientContextFilter();
    }

    @Bean
    public LoginUrlAuthenticationEntryPoint clientAuthenticationEntryPoint() {
        return new LoginUrlAuthenticationEntryPoint("/googleLogin");
    }
}

我的 Google 服务的

和 client_secret.json:

{
  "web": {
    "client_id": "...",
    "project_id": "...",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://accounts.google.com/o/oauth2/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_secret": "...",
    "redirect_uris": [
      "http://localhost:8888/googleLogin",
      "http://localhost:8888/googleLogin/"
    ],
    "scope": "https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile",
    "token_name": "authorization_code"
  }
}

问题是我不知道在哪里设置hosted domain java代码中的参数。我试图通过 stackoverflow 寻找解决方案，但只看到了 JS 或 PHP 的解决方案。

Answer 1

我发现 AuthorizationCodeAccessTokenProvider#getRedirectForAuthorization 负责构造重定向 URI，但可用的参数有限，所以唯一的选择是将 HD 参数添加到 中的 auth_uri client_secrets.json:

    "auth_uri": "https://accounts.google.com/o/oauth2/auth?hd=<domain>",