Spring OAuth2:支持使用 SSO 和自定义身份验证服务器进行身份验证和资源访问

好的，在努力实现这种行为后，我坚持使用两个不同的库(Spring Social 和 OAuth2).我决定走自己的路，只用 Spring OAuth2:

Ok, so after struggling to implement such behavior I've stuck with two different libraries (Spring Social & OAuth2). I decided to go my own way and do it with just Spring OAuth2:

• 我有资源服务器、身份验证服务器和客户端(由 Java 备份并使用 OAuth2 客户端库，但它可以是任何其他客户端) - 我的资源只能使用我自己提供的 JWT 身份验证令牌使用我自己的身份验证服务器

• I have the resource server, authentication server and client(backed up by Java and uses OAuth2 Client library, but it can be any other client) - my resources can be consumed only with my own JWT auth token given by my own auth server

在自定义注册的情况下:客户端从 auth 服务器获取 JWT 令牌(带有刷新令牌)并将其发送到 res 服务器.资源服务器用公钥验证它并把资源还给

in a case of a custom registration: client obtains JWT token(with refresh token) from auth server and sends it to the res server. Res server validates it with public key and gives the resource back

在 SSO 的情况下:客户端获取 Facebook(或其他社交平台令牌)并将其与我的自定义身份验证服务器交换为我的自定义 JWT 令牌.我已经使用自定义 SocialTokenGranter 在我的身份验证服务器上实现了这一点(目前仅处理 facebook 社交令牌.对于每个社交网络，我都需要单独的授权类型).此类额外调用 facebook auth 服务器以验证令牌并获取用户信息.然后它从我的数据库中检索社交用户或创建新的并将 JWT 令牌返回给客户端.目前还没有完成用户合并.它现在超出了范围.

in a case of SSO: client obtains Facebook(or other social platform token) and exchanges it for my custom JWT token with my custom auth server. I've implemented this on my auth server using custom SocialTokenGranter(currently handles facebook social token only. For every social network I'll need separate grant type). This class makes an additional call to facebook auth server to validate token and obtain user info. Then it retrieves the social user from my db or creates new and returns JWT token back to the client. No user merging is done by now. it is out of scope for now.

public class SocialTokenGranter extends AbstractTokenGranter {

private static final String GRANT_TYPE = "facebook_social";    
GiraffeUserDetailsService giraffeUserDetailsService; // custom UserDetails service

SocialTokenGranter(
        GiraffeUserDetailsService giraffeUserDetailsService,
        AuthorizationServerTokenServices tokenServices,
        OAuth2RequestFactory defaultOauth2RequestFactory,
        ClientDetailsService clientDetailsService) {
    super(tokenServices, clientDetailsService, defaultOauth2RequestFactory, GRANT_TYPE);
    this.giraffeUserDetailsService = giraffeUserDetailsService;
}

@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails clientDetails, TokenRequest request) {

    // retrieve social token sent by the client
    Map<String, String> parameters = request.getRequestParameters();
    String socialToken = parameters.get("social_token");

    //validate social token and receive user information from external authentication server
    String url = "https://graph.facebook.com/me?access_token=" + socialToken;

    Authentication userAuth = null;
    try {    
        ResponseEntity<FacebookUserInformation> response = new RestTemplate().getForEntity(url, FacebookUserInformation.class);

        if (response.getStatusCode().is4xxClientError()) throw new GiraffeException.InvalidOrExpiredSocialToken();

        FacebookUserInformation userInformation = response.getBody();
        GiraffeUserDetails giraffeSocialUserDetails = giraffeUserDetailsService.loadOrCreateSocialUser(userInformation.getId(), userInformation.getEmail(), User.SocialProvider.FACEBOOK);

        userAuth = new UsernamePasswordAuthenticationToken(giraffeSocialUserDetails, "N/A", giraffeSocialUserDetails.getAuthorities());
    } catch (GiraffeException.InvalidOrExpiredSocialToken | GiraffeException.UnableToValidateSocialUserInformation e) {               
        // log the stacktrace
    }
    return new OAuth2Authentication(request.createOAuth2Request(clientDetails), userAuth);
}

private static class FacebookUserInformation {
    private String id;
    private String email;  

    // getters, setters, constructor
}    

}

来自扩展 AuthorizationServerConfigurerAdapter 的类:

And from class extending AuthorizationServerConfigurerAdapter:

private TokenGranter tokenGranter(AuthorizationServerEndpointsConfigurer endpoints) {
        List<TokenGranter> granters = new ArrayList<>(Arrays.asList(endpoints.getTokenGranter()));
        granters.add(new SocialTokenGranter(giraffeUserDetailsService, endpoints.getTokenServices(), endpoints.getOAuth2RequestFactory(), endpoints.getClientDetailsService()));
        return new CompositeTokenGranter(granters);
    }

@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
    oauthServer
            ...
            .allowFormAuthenticationForClients() // to allow sending parameters as form fields
            ...

}

每个 JWT 令牌请求都将发送到 'host:port +/oauth/token' url根据授权类型"，服务器将以不同的方式处理此类请求.目前我有密码"(默认)、refresh_token"和facebook_social"(自定义)授权类型

Every JWT token request is going to 'host:port + /oauth/token' url Depending on 'Grant type' the server will handle such requests differently. Currently I have 'password'(default), 'refresh_token' and 'facebook_social'(custom) grant types

对于默认的密码"授权类型，客户端应发送下一个参数:

For default 'password' Grant type the client should send next parameters:

• clientId

• clientId

clientSecret(取决于客户端类型.不适用于单页客户端)

clientSecret (depends of the client type. Not for single-page clients)

用户名

密码

范围(如果未在当前客户端的身份验证服务器配置中明确设置)

scope (if not explicitly set in auth server configuration for current client)

grantType

对于refresh_token"授权类型，客户端应发送下一个参数:

For 'refresh_token' Grant type the client should send next parameters:

• clientId

• clientId

clientSecret(取决于客户端类型.不适用于单页客户端)

clientSecret (depends of the client type. Not for single-page clients)

refresh_token

refresh_token

grantType

对于facebook_social"授权类型，客户端应发送下一个参数:

For 'facebook_social' Grant type the client should send next parameters:

• 客户端 ID

• clientId

facebook_social_token(自定义字段)

facebook_social_token (custom field)

授权类型

根据客户端设计，发送这些请求的方式会有所不同.在我使用 Spring OAuth2 库获取社交令牌的基于 Java 的测试客户端的情况下，我使用控制器中的重定向执行令牌交换过程(使用 facebook 开发页面配置中定义的 url 调用控制器).

Based on the client design the way to send these requests will be different. In my case with test Java based client which uses Spring OAuth2 library to obtain the social token I do the token exchange procedure with the redirect in controller(controller being invoked using url defined in facebook dev page configuration).

它可以分两个阶段处理:在获得 Facebook 社交令牌后，JavaScript 可以单独显式调用我的身份验证服务器以交换令牌.

It can be handled in two stages: after obtaining facebook social token JavaScript can make a separate explicit call to my auth server to exchange tokens.

您可以在此处查看 Java 客户端实现示例，但我怀疑您是否会在生产中使用 Java 客户端:https://spring.io/guides/tutorials/spring-boot-oauth2/

You can see Java client implementation examples here, but I doubt that you're going to use Java client in production:https://spring.io/guides/tutorials/spring-boot-oauth2/