java - 如何在 TokenEndPoint Spring oAuth2 中注入(inject) WebResponseExceptionTranslator

Question

我正在尝试自定义 Spring Security oAuth TokenEndpoint 类处理异常的方式。我想返回比 DefaultWebResponseExceptionTranslator 当前更加自定义的 JSON 响应。我不知道如何通过 XML 注入(inject)自定义转换器。这是我的代码片段:

spring-security.xml

<oauth:authorization-server
    client-details-service-ref="clientDetails" token-services-ref="tokenServices" 
    user-approval-handler-ref="userApprovalHandler" request-validator-ref="requestValidator" >
    <oauth:client-credentials />
    <oauth:password />
</oauth:authorization-server>

这里是AbstractServerBeanDefinitionParser的相关代码部分

    BeanDefinitionBuilder tokenEndpointBean = BeanDefinitionBuilder.rootBeanDefinition(TokenEndpoint.class);
    tokenEndpointBean.addPropertyReference("clientDetailsService", clientDetailsRef);
    tokenEndpointBean.addPropertyReference("tokenGranter", tokenGranterRef);
    authorizationEndpointBean.addPropertyReference("oAuth2RequestValidator", oAuth2RequestValidatorRef);
    parserContext.getRegistry()
            .registerBeanDefinition("oauth2TokenEndpoint", tokenEndpointBean.getBeanDefinition());
    if (StringUtils.hasText(oAuth2RequestFactoryRef)) {
        tokenEndpointBean.addPropertyReference("oAuth2RequestFactory", oAuth2RequestFactoryRef);
    }
    if (StringUtils.hasText(oAuth2RequestValidatorRef)) {
        tokenEndpointBean.addPropertyReference("oAuth2RequestValidator", oAuth2RequestValidatorRef);
    }

TokenEndpoint 扩展了 AbstractEndpoint，这是定义翻译器的地方。

@FrameworkEndpoint
public class TokenEndpoint extends AbstractEndpoint {

    @ExceptionHandler(Exception.class)
    public ResponseEntity<OAuth2Exception> handleException(Exception e) throws Exception {
        logger.info("Handling error: " + e.getClass().getSimpleName() + ", " + e.getMessage());
        return getExceptionTranslator().translate(e);
    }

这是来自 AbtractEndpoint 的片段

public class AbstractEndpoint implements InitializingBean {

   protected final Log logger = LogFactory.getLog(getClass());

   private WebResponseExceptionTranslator providerExceptionHandler = new DefaultWebResponseExceptionTranslator();

   public void setProviderExceptionHandler(WebResponseExceptionTranslator providerExceptionHandler) {
       this.providerExceptionHandler = providerExceptionHandler;
   }

所以我的问题是。如何调用 setProviderExceptionHandler 通过 spring-security.xml 传入我的自定义类？

Answer 1

为了自定义 spring-oauth 的异常处理程序，您必须定义 WebResponseExceptionTranslator 的实例:

@Bean
public WebResponseExceptionTranslator webResponseExceptionTranslator() {
     return new DefaultWebResponseExceptionTranslator() {

         @Override
         public ResponseEntity<OAuth2Exception> translate(Exception e) throws Exception {
             ResponseEntity<OAuth2Exception> responseEntity = super.translate(e);
             OAuth2Exception body = responseEntity.getBody();
             HttpHeaders headers = new HttpHeaders();
             headers.setAll(responseEntity.getHeaders().toSingleValueMap());
             // do something with header or response
             return new ResponseEntity<>(body, headers, responseEntity.getStatusCode());
         }
     };
 }

并将其传递给exceptionTranslator配置器的属性。我使用基于注释的配置，所以它看起来像这样:

@Configuration
@EnableAuthorizationServer
public class OAuth2ServerConfiguration extends AuthorizationServerConfigurerAdapter {
    // some config

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
                .pathMapping("/oauth/authorize", "/authorize")
                .pathMapping("/oauth/error", "/error")
                .exceptionTranslator(webResponseExceptionTranslator())
        ;
    }
}

只需检查 <oauth:authorization-server /> 可用的属性具有基于 xml 的配置。