在 Spring OAuth2 客户端中从 SSO 更改经过身份验证的用户的权限/角色答案

【问题标题】：Change Authorities/Roles of Authenticated User from SSO in Spring OAuth2 Client在 Spring OAuth2 客户端中从 SSO 更改经过身份验证的用户的权限/角色
【发布时间】：2017-04-05 23:13:16
【问题描述】：

我正在尝试对来自 facebook 的用户进行身份验证并存储其用户名，并向将成为我的应用程序管理员的用户子集提供自定义权限。我的问题是，如何在 Oauth2Client 中向经过身份验证的用户提供“管理员”等自定义角色并对其进行授权。

@Configuration
class WebSecurityConfiguration extends GlobalAuthenticationConfigurerAdapter {

@Autowired
UserRepository userRepository;

@Override
public void init(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService());

}

@Bean
UserDetailsService userDetailsService() {
    return new UserDetailsService() {
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            User account = userRepository.findOne(username);
            if (account != null) {
                List<String> rolesList = userRepository.getRoles(username);
                String[] roles = new String[rolesList.size()];


                 // userRepository.findRoles List<String> roles =
                 //account.getUserroles().;
                 User user = new User(account.getUserssoid(), account.getSecretKey(), true, true, true, true,
                        AuthorityUtils.createAuthorityList(rolesList.toArray(roles)));

                return user;
            } else {
                throw new UsernameNotFoundException("could not find the user '" + username + "'");
            }
        }
    };
}
}

我想使用 OAuth2 客户端做类似的事情。

谢谢

【问题讨论】：

标签： spring spring-security spring-boot spring-oauth2

【解决方案1】：

您需要的是自定义 UserInfoTokenServices 实现，使用您的 ersistence 存储库作为参数，然后在您的 facebook 过滤器中使用自定义 UserInfoTokenServices insted of defaul，如下所示：

    private Filter ssoFilter() {
    CompositeFilter filter = new CompositeFilter();
    List<Filter> filters = new ArrayList<>();
    filters.add(ssoFilter(facebook(), "/login/facebook"));
    filters.add(ssoFilter(google(), "/login/google"));
    filter.setFilters(filters);
    return filter;
}

private Filter ssoFilter(ClientResources client, String path) {
    OAuth2ClientAuthenticationProcessingFilter filter = new OAuth2ClientAuthenticationProcessingFilter(path);
    OAuth2RestTemplate template = new OAuth2RestTemplate(client.getClient(), oauth2ClientContext);
    filter.setRestTemplate(template);
    CustomSocialUserInfoTokenServices tokenServices = new CustomSocialUserInfoTokenServices(
            client.getResource().getUserInfoUri(), client.getClient().getClientId(), userRepository);
    tokenServices.setRestTemplate(template);
    filter.setTokenServices(tokenServices);

    return filter;
}

除了你的自定义 UserInfoTokenServices 你可以像这样添加你的自定义 AuthoritiesExtractor private AuthoritiesExtractor authoritiesExtractor = new CustomSocialAuthoritiesExtractor(); 在那里，您可以运行您的数据库查询或任何逻辑来获取您的自定义权限并传递给您的客户。

希望对你有帮助

【讨论】：

【解决方案2】：

您不一定需要 CustomSocialUserInfoTokenServices。相反，您可以使用现有的 UserInfoTokenServices 并设置您的 CustomSocialAuthoritiesExtractor。

private Filter ssoFilter(ClientResources client, String path) {
    ...
    UserInfoTokenServices tokenServices = new UserInfoTokenServices(client.getResource().getUserInfoUri(), client.getClient().getClientId());
    tokenServices.setRestTemplate(template);
    tokenServices.setAuthoritiesExtractor(new CustomSocialAuthoritiesExtractor());
    filter.setTokenServices(tokenServices);

return filter;

}

public class CustomSocialAuthoritiesExtractor implements AuthoritiesExtractor {
  @Override
  public List<GrantedAuthority> extractAuthorities(Map<String, Object> map) {
    String authorities = "ROLE_CUSTOMUSER";

    return AuthorityUtils.commaSeparatedStringToAuthorityList(authorities);
  }
}

【讨论】：

【解决方案3】：

当您不想提供自己的 UserInfoTokenServices 时，您可以做的更简单。只需在您的安全配置中提供一个 AuthoritiesExtractor bean。

@Bean
public AuthoritiesExtractor customAuthoritiesExtractor() {
    return new CustomAuthoritiesExtractor();
}

public class CustomAuthoritiesExtractor implements AuthoritiesExtractor {

    @Override
    public List<GrantedAuthority> extractAuthorities(Map<String, Object> map) {

        // map contains information from your OAuth profile provider

        boolean userExist = true; // TODO
        if (!userExist) {
            throw new BadCredentialsException("User does not exists");
        }

        String authorities = "ROLE_ADMIN"; // TODO your own roles
        return AuthorityUtils.commaSeparatedStringToAuthorityList(authorities);
    }
}

更多详情请参考本教程：https://spring.io/guides/tutorials/spring-boot-oauth2/#_social_login_logout

【讨论】：