Spring Security OAuth2 事件日志

Question

我们要求在我们的应用程序中包含 OAuth2。为此，我们选择了 Spring Security 作为一种方法。我已经从 spring 安全项目页面查看了 Spraklr2 和 Tonr2 示例项目。它工作正常。

我们的新要求是，作为 outh2 提供者，我们必须保存每个请求日志（来自资源所有者的请求）。我们必须保存客户端 ID、资源所有者用户名、请求的 url（资源服务器上的资源）、授权等..

我搜索了一段时间，但没有找到任何线索。

有人可以帮助我实现这一目标吗..

提前致谢

Answer 1

当用户使用 Spring Oauth 进行身份验证时，它会向 AuthenticationEventPublisher 发布一个事件。您可以创建一个实现AuthenticationEventPublisher的组件，如下所示：

@Component
public class AuditEvent implements AuthenticationEventPublisher{
    @Override
    public void publishAuthenticationSuccess(Authentication authentication) {
        if(authentication instanceof UsernamePasswordAuthenticationToken) {
            log(authentication.getName(), "Authentication successful");
        }
    }

    @Override
    public void publishAuthenticationFailure(AuthenticationException exception, Authentication authentication) {
        log(authentication.getName(),"Authentication Failure:");
    }
}

并检查身份验证是否为UsernamePasswordAuthenticationToken 类型。这将为您提供登录事件，您可以根据需要登录。

Answer 2

如果您的意思是要将所有请求记录到 /oauth/authorize 和 /oauth/token，您可以通过实现自己的端点来实现，这会将调用分别委托给 AuthorizationEndpoint 和 TokenEndpoint。

当然，您必须在 XML 文件中配置它...

Answer 3

如果你还没有找到答案，下面是我用来拦截请求的方法..

 <http  path-type="regex" 
    create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
    access-decision-manager-ref="accessDecisionManager" 
    use-expressions="true"     
    xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false" />
    <custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="myFilterSecurityInterceptor" />
    <intercept-url pattern="/soap/*" access="isAnonymous()" method="GET" />
    <intercept-url pattern="/advisor/[0-9a-zA-Z_]/all/clients/[0-9]/[0-9]" access="isFullyAuthenticated()"/>
    <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
    <expression-handler ref="oauthWebExpressionHandler" />
</http>


<bean id="myFilterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="accessDecisionManager" ref="affirmativeBasedAccessDecisionManager"/>
    <property name="securityMetadataSource" ref="myCustomBean"/>
</bean>

<bean id="affirmativeBasedAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <constructor-arg>
        <list>
            <bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter"/>
            <bean id="authenticatedVoter" class="org.springframework.security.access.vote.AuthenticatedVoter"/>
        </list>
    </constructor-arg>
</bean>

<bean id="myCustomBean" class="MyCustomClass">
    <constructor-arg>
        <util:map />
    </constructor-arg>
</bean>

<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
  <authentication-provider>
    <jdbc-user-service data-source-ref="dataSource"
      users-by-username-query=
        "select username,password, enabled from oauth_users where username=?"
      authorities-by-username-query=
        "select username, role from oauth_user_roles where username =?  " />
  </authentication-provider>
</authentication-manager>

<bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <property name="realmName" value="realm" />
</bean>

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" xmlns="http://www.springframework.org/schema/beans">
  <constructor-arg>
    <list>
      <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
      <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
      <bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>
    </list>
  </constructor-arg>
</bean>

    <bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

<oauth:web-expression-handler id="oauthWebExpressionHandler" />

公共类 MyCustomClass 扩展 DefaultFilterInvocationSecurityMetadataSource {

public APILibSecurityMetadataSource(
        LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap) { 
    super(requestMap);
}

@Override
public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
System.out.println(" My code in MyCustomClass Interceptor");    
}

}