spring-boot - Spring Boot OAuth2 invalid_user_info_response

Question

我正在使用 Azure 作为身份提供程序构建 webMVC 应用程序，但出现以下错误:

[invalid_user_info_response] 尝试检索 UserInfo 资源时发生错误:“https://graph.microsoft.com/oidc/userinfo”的 GET 请求出现 I/O 错误:graph.microsoft.com

[nio-8080-exec-3] o.s.web.client.RestTemplate              : HTTP GET https://graph.microsoft.com/oidc/userinfo
[nio-8080-exec-3] o.s.web.client.RestTemplate              : Accept=[application/json, application/*+json]
[nio-8080-exec-3] .s.a.DefaultAuthenticationEventPublisher : No event was found for the exception org.springframework.security.oauth2.core.OAuth2AuthenticationException
[nio-8080-exec-3] o.s.s.web.DefaultRedirectStrategy        : Redirecting to /login?error

我错过了什么吗？

spring.security.oauth2.client.provider.azure.issuer-uri=https://login.microsoftonline.com/XXXX/v2.0
spring.security.oauth2.client.registration.myapp.client-name=XXXX
spring.security.oauth2.client.registration.myapp.client-id=XXXX
spring.security.oauth2.client.registration.myapp.client-secret=XXXX
spring.security.oauth2.client.registration.myapp.provider=azure
spring.security.oauth2.client.registration.myapp.redirect-uri=http://localhost:8080/login/oauth2/code/
spring.security.oauth2.client.registration.myapp.scope=openid, profile, User.Read
spring.security.oauth2.client.registration.myapp.authorization-grant-type=authorization_code

Answer 1

我尝试通过 Postman 在我的环境中重现相同的结果，并得到以下结果:

我创建了一个 Azure AD 应用程序并授予了如下所示的权限:

为了获取代码，我使用了以下授权请求:

https://login.microsoftonline.com/tenantID/oauth2/v2.0/authorize?
client_id=client_id
&response_type=code
&redirect_uri=redirect_uri
&response_mode=query
&scope=openid profile user.read
&state=12345

当我在浏览器中运行上述请求时，我得到了同意屏幕，如下所示:

接受上述同意后，我在地址栏中收到如下代码:

为了生成访问 token ，我使用了以下参数并获得了如下 token :

POST https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

grant_type:authorization_code
client_id:client_id
client_secret:client_secret
scope:openid profile user.read
code:code
redirect_uri: redirect_uri

当我使用上述 token 获取用户信息数据时，我成功收到了响应，如下所示:

GET https://graph.microsoft.com/oidc/userinfo

回应:

在您的场景中，请确保在代码中包含以下参数，如下所示:

spring.security.oauth2.client.registration.azure.client-id: xxx
spring.security.oauth2.client.registration.azure.client-secret: xxx
spring.security.oauth2.client.registration.azure.client-name: App Name
spring.security.oauth2.client.registration.azure.client-authentication-method: basic
spring.security.oauth2.client.registration.azure.provider: azure
spring.security.oauth2.client.registration.azure.scope: openid profile user.read
spring.security.oauth2.client.registration.azure.redirect-uri: http://localhost:8080/login/oauth2/code/azure
spring.security.oauth2.client.registration.azure.authorization-grant-type: authorization_code

spring.security.oauth2.client.provider.azure.issuer-uri=https://login.microsoftonline.com/<tenant id>/v2.0
spring.security.oauth2.client.provider.azure.authorization-uri: https://login.microsoftonline.com/<tenant id>/oauth2/v2.0/authorize
spring.security.oauth2.client.provider.azure.user-info-uri: https://graph.microsoft.com/oidc/userinfo 
spring.security.oauth2.client.provider.azure.token-uri: https://login.microsoftonline.com/<tenant id>/oauth2/v2.0/token
spring.security.oauth2.client.provider.azure.jwk-set-uri: https://login.microsoftonline.com/<tenant id>/v2.0/keys
spring.security.oauth2.client.provider.azure.user-name-attribute: name

要了解更多详细信息，请引用以下链接:

Spring security using OAuth2 with Microsoft - AzureAD