spring-security - token 过期时 Spring OAuth2 重定向

Question

我正在努力在 Spring 中做这件简单的事情:当访问 token 过期时重定向到登录页面。

我有:

• 用于路由的边缘服务器 (Zuul)。
• OAuth2 授权/认证服务器。
• 提供静态文件的资源服务器。

出于特定的安全原因，我不想要任何刷新 token ，当我的 token 过期时，我希望用户再次登录。

根据我的理解，资源服务器应该是处理此机制的服务器(如果我错了请纠正我)。

我一直在尝试不同的不成功的方法:

• 在 OAuth2AuthenticationProcessingFilter 之后添加过滤器并检查 Token 有效性和 sendRedirect
• 将自定义 OAuth2AuthenticationEntryPoint 添加到我的应用程序(扩展 ResourceServerConfigurerAdapter)
• 添加带有自定义处理程序/入口点的 .exceptionHandling()。

在我的安全配置之下。

Auth 服务器安全配置:

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerOAuthConfig extends AuthorizationServerConfigurerAdapter {
    ....

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
                .authenticationManager(this.authenticationManager)
                .accessTokenConverter(accessTokenConverter())
                .approvalStore(approvalStore())
                .authorizationCodeServices(authorizationCodeServices())
                .tokenStore(tokenStore());
    }

    /**
      * Configure the /check_token endpoint.
      * This end point will be accessible for the resource servers to verify the token validity
      * @param securityConfigurer
      * @throws Exception
      */
    @Override
    public void configure(AuthorizationServerSecurityConfigurer securityConfigurer) throws Exception {
        securityConfigurer
            .tokenKeyAccess("permitAll()")
            .checkTokenAccess("hasAuthority('ROLE_TRUSTED_CLIENT')");
    }
}

@Configuration
@Order(-20)
public class AuthorizationServerSecurityConfig extends WebSecurityConfigurerAdapter {

    private static final Logger log = LoggerFactory.getLogger(AuthorizationServerSecurityConfig.class);

    @Autowired
    private DataSource oauthDataSource;

    @Autowired
    private AuthenticationFailureHandler eventAuthenticationFailureHandler;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws UserDetailsException {
        try {
            log.debug("Updating AuthenticationManagerBuilder to use userDetailService with a BCryptPasswordEncoder");
            auth.userDetailsService(userDetailsService()).passwordEncoder(new BCryptPasswordEncoder());
        } catch (Exception e) {
            throw new UserDetailsException(e);
        }
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    public UserDetailsService userDetailsService() {
        return this.userDetailsService;
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        log.debug("Updating HttpSecurity configuration");

        // @formatter:off
        http
            .requestMatchers()
                .antMatchers("/login*", "/login?error=true", "/oauth/authorize", "/oauth/confirm_access")
                .and()
            .authorizeRequests()
                .antMatchers("/login*", "/oauth/authorize", "/oauth/confirm_access").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .failureUrl("/login?error=true")
                .failureHandler(eventAuthenticationFailureHandler);
        // @formatter:on
    }

它的application.yml

server:
    port: 9999
    contextPath: /uaa

eureka:
    client:
        serviceUrl:
            defaultZone: http://localhost:8761/eureka/

security:
    user:
        password: password

spring:
    datasource_oauth:
        driverClassName: com.mysql.jdbc.Driver
        url: jdbc:mysql://localhost:3306/oauth2_server
        username: abc
        password: 123
    jpa:
        ddl-create: true
    timeleaf:
        cache: false
        prefix: classpath:/templates

logging:
    level:
        org.springframework.security: DEBUG

authentication:
    attempts:
        maximum: 3

资源服务器安全配置 - 更新:

@EnableResourceServer
@EnableEurekaClient
@SpringBootApplication
public class Application extends ResourceServerConfigurerAdapter {

    private CustomAuthenticator customFilter = new CustomAuthenticator();

    /**
     * Launching Spring Boot
     * @param args
     */
    public static void main(String[] args) {
        SpringApplication.run(Application.class, args); //NOSONAR
    }

    /**
     * Configuring Token converter
     * @return
     */
    @Bean
    public AccessTokenConverter accessTokenConverter() {
        return new DefaultAccessTokenConverter();
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.authenticationManager(customFilter);
    }

    /**
     * Configuring HTTP Security
     * @param http
     * @throws Exception
     */
    @Override
    public void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http
            .authorizeRequests().antMatchers("/**").authenticated()
            .and()
                .csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .and()
                .addFilterBefore(customFilter, AbstractPreAuthenticatedProcessingFilter.class);

        // @formatter:on
    }

    protected static class CustomAuthenticator extends OAuth2AuthenticationManager implements Filter {

        private static Logger logger = LoggerFactory.getLogger(CustomAuthenticator.class);
        private TokenExtractor tokenExtractor = new BearerTokenExtractor();
        private AuthenticationManager authenticationManager;
        private AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new OAuth2AuthenticationDetailsSource();
        private boolean inError = false;

        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            try {
                return super.authenticate(authentication);
            }
            catch (Exception e) {
                inError = true;
                return new CustomAuthentication(authentication.getPrincipal(), authentication.getCredentials());
            }
        }

        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
                throws ServletException, IOException {

            logger.debug("Token Error redirecting to Login page");

            if(this.inError) {
                logger.debug("In error");

                RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

                final HttpServletRequest req = (HttpServletRequest) request;
                final HttpServletResponse res = (HttpServletResponse) response;

                redirectStrategy.sendRedirect(req, res, "http://localhost:8765/login");

                this.inError = false;
                return;
            } else {
                filterChain.doFilter(request, response);
            }
        }

        @Override
        public void destroy() {
        }

        @Override
        public void init(FilterConfig arg0) throws ServletException {
        }

        @SuppressWarnings("serial")
        protected static class CustomAuthentication extends PreAuthenticatedAuthenticationToken {

            public CustomAuthentication(Object principal, Object credentials) {
                super(principal, credentials);
            }

        }

    }
}

它的application.yml:

server:
    port: 0

eureka:
    client:
        serviceUrl:
            defaultZone: http://localhost:8761/eureka/

security:
    oauth2:
        resource:
            userInfoUri: http://localhost:9999/uaa/user

logging:
    level:
        org.springframework.security: DEBUG

边缘服务器配置:

@SpringBootApplication
@EnableEurekaClient
@EnableZuulProxy
@EnableOAuth2Sso
public class EdgeServerApplication extends WebSecurityConfigurerAdapter {

    /**
     * Configuring Spring security
     * @return
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http.logout()
            .and()
                .authorizeRequests().antMatchers("/**").authenticated()
            .and()
                .csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
        // @formatter:on
    }

    /**
     * Launching Spring Boot
     * @param args
     */
    public static void main(String[] args) {
        SpringApplication.run(EdgeServerApplication.class, args); //NOSONAR
    }
}

其application.yml配置:

server:
    port: 8765

eureka:
    client:
        serviceUrl:
            defaultZone: http://localhost:8761/eureka/

security:
    user:
        password: none
    oauth2:
        client:
            accessTokenUri: http://localhost:9999/uaa/oauth/token
            userAuthorizationUri: http://localhost:9999/uaa/oauth/authorize
            clientId: spa
            clientSecret: spasecret
        resource:
            userInfoUri: http://localhost:9999/uaa/user

zuul:
    debug:
        request: true
    routes:
        authorization-server:
            path: /uaa/**
            stripPrefix: false
        fast-funds-service:
            path: /**

logging:
    level:
        org.springframework.security: DEBUG

感谢帮助

Answer 1

尝试将刷新 token 的有效性设置为 0 或 1 秒。

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory()
           .withClient("javadeveloperzone")
           .secret("secret")
           .accessTokenValiditySeconds(2000)        // expire time for access token
           .refreshTokenValiditySeconds(-1)         // expire time for refresh token
           .scopes("read", "write")                         // scope related to resource server
           .authorizedGrantTypes("password", "refresh_token");      // grant type

https://javadeveloperzone.com/spring-security/spring-security-oauth2-success-or-failed-event-listener/#22_SecurityOAuth2Configuration