Spring OAuth2 - 授权服务器 - 区分客户端上的用户

Question

我的应用程序卡住了。这听起来很简单：我在我的 OAuth AuthorizationServer 上注册了两个客户端和两个用户。用户 alpha 可以访问这两个应用程序（“androidapp”和“angularapp”），但用户 beta 只能访问其中一个应用程序（仅“angularapp”）。如何区分用户并阻止“androidapp”应用的测试版？

这是我的 AuthServer 的代码：

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter{

    @Autowired private DataSource dataSource;
    @Autowired private AuthenticationManager authenticationManager;

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security
            .tokenKeyAccess("permitAll()")
            .checkTokenAccess("isAuthenticated()")
            ;
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("angularapp")
        .secret(passwordEncoder.encode("12345"))
        .scopes("read", "write")
        .authorizedGrantTypes("password", "refresh_token")
        .accessTokenValiditySeconds(20000)
        .refreshTokenValiditySeconds(20000)
        .and()
        .withClient("androidapp")
        .secret(passwordEncoder.encode("67890"))
        .scopes("read", "write")
        .authorizedGrantTypes("password", "refresh_token")
        .accessTokenValiditySeconds(20000)
        .refreshTokenValiditySeconds(20000);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        endpoints
            .authenticationManager(authenticationManager)
            .tokenStore(tokenStore())
            .accessTokenConverter(accessTokenConverter())
            ;

    }

    @Bean
    public JwtTokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter jwt = new JwtAccessTokenConverter();
        jwt.setSigningKey(JwtConfig.RSA_PRIVATE_KEY);
        jwt.setVerifierKey(JwtConfig.RSA_PUBLIC_KEY);
        return jwt;
    }

}

提前感谢您的回答。

Answer 1

我的解决方案：

当loadClientByClientId方法被执行时，Principal对象 存储在SecurityContext 中尚不存在，但当 loadUserByUsername 方法的执行稍加观察： Principal 对象此时包含 client_id，而不是 username，导致自定义 UserDetailsService 对象 而不是ClientsDetailsService。然后，使用关系实体 (JPA) 我加入了client_id 和username，给出了预期的结果。

所以，UserDetailsService 实现的代码是：

@Service
public class UsuarioService implements IUsuarioService, UserDetailsService{

    private Logger logger = LoggerFactory.getLogger(UsuarioService.class);

    @Autowired
    private IUsuarioDao usuarioDao;

    @Override
    @Transactional(readOnly=true)
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        Usuario usuario = usuarioDao.findByUsername(username);
        if( usuario == null ) {
            logger.error("Login error: Username not found in storage");
            throw new UsernameNotFoundException("Login error: Username not found in storage");
        }
        List<GrantedAuthority> authorities = usuario.getRoles().stream().map( role -> new SimpleGrantedAuthority( role.getNombre() )).collect(Collectors.toList());

        Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        String applicationID = "";
        if (principal instanceof UserDetails) {
            applicationID = ((UserDetails)principal).getUsername();
        } else {
            applicationID = principal.toString();
        }
        logger.info("Application: {} ", applicationID);

        if( applicationID == null || applicationID.isEmpty() ) {
            logger.error("Application ID can't be empty");
            throw new InsufficientAuthenticationException("Application ID can't be empty");
        }

        OAuthClientDetails app = findApplicationByUsername( usuario.getClientes(), applicationID);
        if( app == null ) {
            logger.error("Unauthorized user for application {}", applicationID);
            throw new UnapprovedClientAuthenticationException("Unauthorized user for application " + applicationID);
        }

        return new User(username, usuario.getPassword(), usuario.getEnabled(), true, true, true, authorities);
    }

    private OAuthClientDetails findApplicationByUsername( final List<OAuthClientDetails> list, final String clientID ){
        return list.stream().filter( p -> p.getClientId().equals(clientID) ).findAny().orElse(null); } }

AuthorizationServer 配置是：

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter{

    @Autowired DataSource dataSource;
    @Autowired @Qualifier("authenticationManagerBean") private AuthenticationManager authenticationManager;

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security
            .tokenKeyAccess("permitAll()") 
            .checkTokenAccess("isAuthenticated()") 
            ;
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.jdbc(dataSource);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        endpoints
            .authenticationManager(authenticationManager)
            .tokenStore(tokenStore())
            .accessTokenConverter(accessTokenConverter())
            ;

    }

    @Bean
    public JwtTokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter jwt = new JwtAccessTokenConverter();
        jwt.setSigningKey(JwtConfig.RSA_PRIVATE_KEY);
        jwt.setVerifierKey(JwtConfig.RSA_PUBLIC_KEY);
        return jwt;
    }

}

非常感谢您的帮助和想法。

Answer 2

我过去解决的方法是创建ResourceOwnerPasswordTokenGranter的子类并覆盖这个方法：

protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

如果您从 Spring 源代码中复制原始方法，则在某个时刻您可以访问 client_id (client.getClientId()) 和用户 (userAuth.getPrincipal())。

如果用户的角色与客户端不匹配，我会抛出InsufficientAuthenticationException以避免用户无法登录。

如果 Spring Security 有某种回调以避免复制部分代码来执行此操作，那就太好了。我为此打开了https://github.com/spring-projects/spring-security-oauth/issues/791。