java - Spring 启动 oauth2 : No userInfo endpoint - How to load the authentication (Principal) from the JWT access token directly in the client

Question

我正在设置一个 oauth 2.0 客户端应用程序，它将用户重定向到外部 IDP(授权服务器)以登录。我的应用程序将接受常规的 oauth 2 授权代码授予流程 - 1) 重定向用户以登录。2)首先获取访问代码 3) 使用访问代码获取 token 。由于外部 IDP 仅使用 oauth 2 进行身份验证，因此他们不会提供用户信息端点 url(OIDC 提供商需要)来获取用户详细信息。相反，他们希望我们直接从 JWT token 中获取声明并在我们的应用程序中进行任何授权。
我无法找到正确的代码/配置，它不需要用户信息端点，而是直接解码 jwt 以加载身份验证。
在下面的演示代码中，如果我要从 OKTA 发布的 JWT token 中解码用户详细信息而不调用其 userInfo 端点，我该怎么做？

我正在使用 spring boot 2.x 版本，使用 spring 引用示例社交 oauth2 项目中提供的标准 oauth 客户端配置。

如果有人能指导我走正确的道路，我将不胜感激。谢谢!

梯度配置

buildscript {
ext {
    springBootVersion = '2.2.0.RELEASE'
}
repositories {
    mavenLocal()
    mavenCentral()
}
dependencies {
    classpath("org.springframework.boot:spring-boot-gradle-plugin:${springBootVersion}")
}
}
apply plugin: 'java'
apply plugin: 'org.springframework.boot'
sourceCompatibility = 1.8
targetCompatibility = 1.8
repositories {
mavenLocal()
mavenCentral()
}
configurations {
compile.exclude module: 'spring-boot-starter-logging'
}
dependencies {
compile("org.springframework.boot:spring-boot-starter-web:${springBootVersion}")
compile("org.springframework.boot:spring-boot-starter-log4j2:${springBootVersion}")
compile("org.springframework.boot:spring-boot-starter-security:${springBootVersion}")
compile("org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure:${springBootVersion}")
compile("org.webjars:jquery:2.1.1")
compile("org.webjars:bootstrap:3.2.0")
compile("org.webjars:webjars-locator-core:0.42")
}

应用程序.yml

github:
  client:
     clientId: <clientId>
     clientSecret: <clientSecret>
     accessTokenUri: https://github.com/login/oauth/access_token
     userAuthorizationUri: https://github.com/login/oauth/authorize
     tokenName: oauth_token
     authenticationScheme: query
     clientAuthenticationScheme: form
  resource:
     userInfoUri: https://api.github.com/user

okta:
  client:
   clientId: <clientId>
   clientSecret: <clientSecret>
   accessTokenUri: https://<okta-sub-domain>/oauth2/default/v1/token
   userAuthorizationUri: https://<okta-sub-domain>/oauth2/default/v1/authorize
   scope: openid profile email
 resource:
  userInfoUri: https://<okta-sub-domain>/oauth2/default/v1/userinfo

OAuth2Config.java

@Configuration
@EnableOAuth2Client
public class Oauth2Config extends WebSecurityConfigurerAdapter {

@Autowired
OAuth2ClientContext oauth2ClientContext;

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.antMatcher("/**").authorizeRequests()
    .antMatchers("/", "/login**", "/webjars/**", "/error**")
    .permitAll()
  .anyRequest()
    .authenticated()
            .and().logout().logoutSuccessUrl("/").permitAll()
            .and().addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class);;
    http.csrf().disable();
}

private Filter ssoFilter() {
    CompositeFilter filter = new CompositeFilter();
    List<Filter> filters = new ArrayList<>();

    OAuth2ClientAuthenticationProcessingFilter githubFilter = new OAuth2ClientAuthenticationProcessingFilter("/login/github");
    OAuth2RestTemplate githubTemplate = new OAuth2RestTemplate(github(), oauth2ClientContext);
    githubFilter.setRestTemplate(githubTemplate);
    UserInfoTokenServices tokenServices = new UserInfoTokenServices(githubResource().getUserInfoUri(), github().getClientId());
    tokenServices.setRestTemplate(githubTemplate);
    githubFilter.setTokenServices(tokenServices);
    filters.add(githubFilter);

    OAuth2ClientAuthenticationProcessingFilter oktaFilter = new OAuth2ClientAuthenticationProcessingFilter("/login/okta");
    OAuth2RestTemplate oktaTemplate = new OAuth2RestTemplate(okta(), oauth2ClientContext);
    oktaFilter.setRestTemplate(oktaTemplate);
    tokenServices = new UserInfoTokenServices(oktaResource().getUserInfoUri(), okta().getClientId());        
    tokenServices.setRestTemplate(oktaTemplate);
    oktaFilter.setTokenServices(tokenServices);
    filters.add(oktaFilter);

    filter.setFilters(filters);
    return filter;
}

//Client registration
@Bean
@ConfigurationProperties("github.client")
public AuthorizationCodeResourceDetails github() {
    return new AuthorizationCodeResourceDetails();
}

//user info endpoints
@Bean
@ConfigurationProperties("github.resource")
public ResourceServerProperties githubResource() {
    return new ResourceServerProperties();
}

@Bean
@ConfigurationProperties("okta.client")
public AuthorizationCodeResourceDetails okta() {
    return new AuthorizationCodeResourceDetails();
}

@Bean
@ConfigurationProperties("okta.resource")
public ResourceServerProperties oktaResource() {
    return new ResourceServerProperties();
}

//For Handling Redirects
@Bean
public FilterRegistrationBean<OAuth2ClientContextFilter> oauth2ClientFilterRegistration(OAuth2ClientContextFilter filter) {
    FilterRegistrationBean<OAuth2ClientContextFilter> registration = new FilterRegistrationBean<>();
    registration.setFilter(filter);
    registration.setOrder(-100);
    return registration;
}

}

带有 html 页面使用的端点的简单 Controller

@RestController
public class UserController {

@GetMapping("/user")
public Principal user(Principal principal) {        
    return principal;
}

}

@SpringBootApplication
public class Oauth2Application {

public static void main(String[] args) {
    SpringApplication.run(Oauth2Application.class, args);
}

}

Answer 1

DefaultReactiveOAuth2UserService查找用户信息。我们可以简单地介绍一个新的ReactiveOAuth2UserService从 token 中获取值的实现，例如:

@Service
public class GttOAuth2UserService implements ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User>  {

    @Override
    public Mono<OAuth2User> loadUser(OAuth2UserRequest oAuth2UserRequest) throws OAuth2AuthenticationException {
        final List<GrantedAuthority> authorities = Arrays.asList(new SimpleGrantedAuthority("authority"));
        final Map<String, Object> attributes = oAuth2UserRequest.getAdditionalParameters();
        final OAuth2User user = new DefaultOAuth2User(authorities, attributes, "email");
        return Mono.just(user);
    }
}

(在你的情况下，它可能是非 react 性的等价物)