devbox
2023面试高手
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

spring security webflux 三方用户授权登录说明_webflux响应式 oauth授权登录

作者：2023面试高手 | 2024-02-08 11:29:53

赞

踩

webflux响应式 oauth授权登录

spring security webflux 三方用户授权说明

 

spring security 默认整合了github、google、facebook、okta三方登录功能，直接配置client-id、client-secret等参数就可自动登录；

其他三方授权方（如gitee、微博等）需要实现相关的接口

 

 

*************************

相关类及接口

 

CommonOAuth2Provider：默认集成的三方授权提供方

  1. public enum CommonOAuth2Provider {
  2.     GOOGLE {
  3.         public Builder getBuilder(String registrationId) {
  4.             Builder builder = this.getBuilder(registrationId, ClientAuthenticationMethod.BASIC, "{baseUrl}/{action}/oauth2/code/{registrationId}");
  5.             builder.scope(new String[]{"openid", "profile", "email"});
  6.             builder.authorizationUri("https://accounts.google.com/o/oauth2/v2/auth");
  7.             builder.tokenUri("https://www.googleapis.com/oauth2/v4/token");
  8.             builder.jwkSetUri("https://www.googleapis.com/oauth2/v3/certs");
  9.             builder.userInfoUri("https://www.googleapis.com/oauth2/v3/userinfo");
  10.             builder.userNameAttributeName("sub");
  11.             builder.clientName("Google");
  12.             return builder;
  13.         }
  14.     },
  15.     GITHUB {
  16.         public Builder getBuilder(String registrationId) {
  17.             Builder builder = this.getBuilder(registrationId, ClientAuthenticationMethod.BASIC, "{baseUrl}/{action}/oauth2/code/{registrationId}");
  18.             builder.scope(new String[]{"read:user"});
  19.             builder.authorizationUri("https://github.com/login/oauth/authorize");
  20.             builder.tokenUri("https://github.com/login/oauth/access_token");
  21.             builder.userInfoUri("https://api.github.com/user");
  22.             builder.userNameAttributeName("id");
  23.             builder.clientName("GitHub");
  24.             return builder;
  25.         }
  26.     },
  27.     FACEBOOK {
  28.         public Builder getBuilder(String registrationId) {
  29.             Builder builder = this.getBuilder(registrationId, ClientAuthenticationMethod.POST, "{baseUrl}/{action}/oauth2/code/{registrationId}");
  30.             builder.scope(new String[]{"public_profile", "email"});
  31.             builder.authorizationUri("https://www.facebook.com/v2.8/dialog/oauth");
  32.             builder.tokenUri("https://graph.facebook.com/v2.8/oauth/access_token");
  33.             builder.userInfoUri("https://graph.facebook.com/me?fields=id,name,email");
  34.             builder.userNameAttributeName("id");
  35.             builder.clientName("Facebook");
  36.             return builder;
  37.         }
  38.     },
  39.     OKTA {
  40.         public Builder getBuilder(String registrationId) {
  41.             Builder builder = this.getBuilder(registrationId, ClientAuthenticationMethod.BASIC, "{baseUrl}/{action}/oauth2/code/{registrationId}");
  42.             builder.scope(new String[]{"openid", "profile", "email"});
  43.             builder.userNameAttributeName("sub");
  44.             builder.clientName("Okta");
  45.             return builder;
  46.         }
  47.     };
  48.  
  49.     private static final String DEFAULT_REDIRECT_URL = "{baseUrl}/{action}/oauth2/code/{registrationId}";
  50.  
  51.     private CommonOAuth2Provider() {
  52.     }
  53.  
  54.     protected final Builder getBuilder(String registrationId, ClientAuthenticationMethod method, String redirectUri) {
  55.         Builder builder = ClientRegistration.withRegistrationId(registrationId);
  56.         builder.clientAuthenticationMethod(method);
  57.         builder.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE);
  58.         builder.redirectUriTemplate(redirectUri);
  59.         return builder;
  60.     }
  61.  
  62.     public abstract Builder getBuilder(String var1);
  63. }

 

 

ServerHttpSecurity：oauth2配置入口类

  1. public class ServerHttpSecurity {
  2.  
  3.  
  4. ******************
  5. 内部类：ServerHttpSecurity.OAuth2LoginSpec
  6.  
  7.     public class OAuth2LoginSpec {
  8.         private ReactiveClientRegistrationRepository clientRegistrationRepository;  //存储授权提供方
  9.         private ServerOAuth2AuthorizedClientRepository authorizedClientRepository;  //存储授权客户端
  10.         private ServerAuthorizationRequestRepository<OAuth2AuthorizationRequest>  authorizationRequestRepository;  //授权请求操作
  11.         private ReactiveAuthenticationManager authenticationManager;                //获取access_token，成功后加载OAuth2User
  12.  
  13.         private ServerSecurityContextRepository securityContextRepository;
  14.         private ServerAuthenticationConverter authenticationConverter;
  15.         private ServerOAuth2AuthorizationRequestResolver authorizationRequestResolver;
  16.         private ServerWebExchangeMatcher authenticationMatcher;
  17.         private ServerAuthenticationSuccessHandler authenticationSuccessHandler;
  18.         private ServerAuthenticationFailureHandler authenticationFailureHandler;
  19.  
  20.         public ServerHttpSecurity.OAuth2LoginSpec authenticationManager(ReactiveAuthenticationManager authenticationManager) {
  21.         public ServerHttpSecurity.OAuth2LoginSpec securityContextRepository(ServerSecurityContextRepository securityContextRepository) {
  22.         public ServerHttpSecurity.OAuth2LoginSpec authenticationSuccessHandler(ServerAuthenticationSuccessHandler authenticationSuccessHandler) {
  23.         public ServerHttpSecurity.OAuth2LoginSpec authenticationFailureHandler(ServerAuthenticationFailureHandler authenticationFailureHandler) {
  24.  
  25.         private ReactiveAuthenticationManager getAuthenticationManager() {
  26.             if (this.authenticationManager == null) {
  27.                 this.authenticationManager = this.createDefault();
  28.             }//如果没有设置authenticationManager，则创建默认的authenticationManager
  29.  
  30.             return this.authenticationManager;
  31.         }
  32.  
  33.         private ReactiveAuthenticationManager createDefault() {
  34.             ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> client = this.getAccessTokenResponseClient();
  35.                                                 //获取access_token客户端，如果不存在则创建WebClientReactiveAuthorizationCodeTokenResponseClient
  36.  
  37.             ReactiveAuthenticationManager result = new OAuth2LoginReactiveAuthenticationManager(client, this.getOauth2UserService());
  38.                                                 //创建OAuth2LoginReactiveAuthenticationManager，该对象可同时获取access_token、oauth2User（如果不存在，默认为DefaultReactiveOAuth2UserService对象）
  39.  
  40.             boolean oidcAuthenticationProviderEnabled = ClassUtils.isPresent("org.springframework.security.oauth2.jwt.JwtDecoder", this.getClass().getClassLoader());
  41.             if (oidcAuthenticationProviderEnabled) {
  42.                 OidcAuthorizationCodeReactiveAuthenticationManager oidc = new OidcAuthorizationCodeReactiveAuthenticationManager(client, this.getOidcUserService());
  43.                 ResolvableType type = ResolvableType.forClassWithGenerics(ReactiveJwtDecoderFactory.class, new Class[]{ClientRegistration.class});
  44.                 ReactiveJwtDecoderFactory<ClientRegistration> jwtDecoderFactory = (ReactiveJwtDecoderFactory)ServerHttpSecurity.this.getBeanOrNull(type);
  45.                 if (jwtDecoderFactory != null) {
  46.                     oidc.setJwtDecoderFactory(jwtDecoderFactory);
  47.                 }
  48.  
  49.                 result = new DelegatingReactiveAuthenticationManager(new ReactiveAuthenticationManager[]{oidc, (ReactiveAuthenticationManager)result});
  50.             }
  51.  
  52.             return (ReactiveAuthenticationManager)result;
  53.         }
  54.  
  55.         public ServerHttpSecurity.OAuth2LoginSpec authenticationConverter(ServerAuthenticationConverter authenticationConverter) {
  56.             this.authenticationConverter = authenticationConverter;
  57.             return this;
  58.         }
  59.  
  60.         private ServerAuthenticationConverter getAuthenticationConverter(ReactiveClientRegistrationRepository clientRegistrationRepository) {
  61.             if (this.authenticationConverter == null) {
  62.                 ServerOAuth2AuthorizationCodeAuthenticationTokenConverter authenticationConverter = new ServerOAuth2AuthorizationCodeAuthenticationTokenConverter(clientRegistrationRepository);
  63.                 authenticationConverter.setAuthorizationRequestRepository(this.getAuthorizationRequestRepository());
  64.                 this.authenticationConverter = authenticationConverter;
  65.             }
  66.  
  67.             return this.authenticationConverter;
  68.         }
  69.  
  70.         public ServerHttpSecurity.OAuth2LoginSpec clientRegistrationRepository(ReactiveClientRegistrationRepository clientRegistrationRepository) {
  71.             this.clientRegistrationRepository = clientRegistrationRepository;
  72.             return this;
  73.         }
  74.  
  75.         public ServerHttpSecurity.OAuth2LoginSpec authorizedClientService(ReactiveOAuth2AuthorizedClientService authorizedClientService) {
  76.             this.authorizedClientRepository = new AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository(authorizedClientService);
  77.             return this;
  78.         }
  79.  
  80.         public ServerHttpSecurity.OAuth2LoginSpec authorizedClientRepository(ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {
  81.         public ServerHttpSecurity.OAuth2LoginSpec authorizationRequestRepository(ServerAuthorizationRequestRepository<OAuth2AuthorizationRequest> authorizationRequestRepository) {
  82.         public ServerHttpSecurity.OAuth2LoginSpec authorizationRequestResolver(ServerOAuth2AuthorizationRequestResolver authorizationRequestResolver) {
  83.         public ServerHttpSecurity.OAuth2LoginSpec authenticationMatcher(ServerWebExchangeMatcher authenticationMatcher) {
  84.  
  85.         private ServerWebExchangeMatcher getAuthenticationMatcher() {
  86.             if (this.authenticationMatcher == null) {
  87.                 this.authenticationMatcher = this.createAttemptAuthenticationRequestMatcher();
  88.             }  //如果没有设置authenticationManager，则创建默认的authenticationManager
  89.  
  90.             return this.authenticationMatcher;
  91.         }
  92.  
  93.         public ServerHttpSecurity and() {
  94.             return ServerHttpSecurity.this;
  95.         }
  96.  
  97.         protected void configure(ServerHttpSecurity http) {
  98.             ReactiveClientRegistrationRepository clientRegistrationRepository = this.getClientRegistrationRepository();  //获取clientRegistration
  99.             ServerOAuth2AuthorizedClientRepository authorizedClientRepository = this.getAuthorizedClientRepository();    //获取authorizedClient
  100.  
  101.  
  102.             OAuth2AuthorizationRequestRedirectWebFilter oauthRedirectFilter = this.getRedirectWebFilter();  //认证请求跳转过滤器，获取授权码
  103.             ServerAuthorizationRequestRepository<OAuth2AuthorizationRequest> authorizationRequestRepository = this.getAuthorizationRequestRepository();
  104.             oauthRedirectFilter.setAuthorizationRequestRepository(authorizationRequestRepository);
  105.             oauthRedirectFilter.setRequestCache(http.requestCache.requestCache);
  106.  
  107.  
  108.             ReactiveAuthenticationManager manager = this.getAuthenticationManager();   //获取access_token、oauth2User
  109.             AuthenticationWebFilter authenticationFilter = new OAuth2LoginAuthenticationWebFilter(manager, authorizedClientRepository);
  110.             authenticationFilter.setRequiresAuthenticationMatcher(this.getAuthenticationMatcher());
  111.             authenticationFilter.setServerAuthenticationConverter(this.getAuthenticationConverter(clientRegistrationRepository));
  112.             authenticationFilter.setAuthenticationSuccessHandler(this.getAuthenticationSuccessHandler(http));
  113.             authenticationFilter.setAuthenticationFailureHandler(this.getAuthenticationFailureHandler());
  114.             authenticationFilter.setSecurityContextRepository(this.securityContextRepository);
  115.  
  116.  
  117.             this.setDefaultEntryPoints(http);
  118.             http.addFilterAt(oauthRedirectFilter, SecurityWebFiltersOrder.HTTP_BASIC);
  119.             http.addFilterAt(authenticationFilter, SecurityWebFiltersOrder.AUTHENTICATION);
  120.         }
  121.  
  122.         private void setDefaultEntryPoints(ServerHttpSecurity http) {
  123.             String defaultLoginPage = "/login";
  124.             Map<String, String> urlToText = http.oauth2Login.getLinks();
  125.             String providerLoginPage = null;
  126.             if (urlToText.size() == 1) {
  127.                 providerLoginPage = (String)urlToText.keySet().iterator().next();
  128.             }
  129.  
  130.             MediaTypeServerWebExchangeMatcher htmlMatcher = new MediaTypeServerWebExchangeMatcher(new MediaType[]{MediaType.APPLICATION_XHTML_XML, new MediaType("image", "*"), MediaType.TEXT_HTML, MediaType.TEXT_PLAIN});
  131.             htmlMatcher.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
  132.             ServerWebExchangeMatcher xhrMatcher = (exchange) -> {
  133.                 return exchange.getRequest().getHeaders().getOrEmpty("X-Requested-With").contains("XMLHttpRequest") ? MatchResult.match() : MatchResult.notMatch();
  134.             };
  135.             ServerWebExchangeMatcher notXhrMatcher = new NegatedServerWebExchangeMatcher(xhrMatcher);
  136.             ServerWebExchangeMatcher defaultEntryPointMatcher = new AndServerWebExchangeMatcher(new ServerWebExchangeMatcher[]{notXhrMatcher, htmlMatcher});
  137.             if (providerLoginPage != null) {
  138.                 ServerWebExchangeMatcher loginPageMatcher = new PathPatternParserServerWebExchangeMatcher(defaultLoginPage);
  139.                 ServerWebExchangeMatcher faviconMatcher = new PathPatternParserServerWebExchangeMatcher("/favicon.ico");
  140.                 ServerWebExchangeMatcher defaultLoginPageMatcher = new AndServerWebExchangeMatcher(new ServerWebExchangeMatcher[]{new OrServerWebExchangeMatcher(new ServerWebExchangeMatcher[]{loginPageMatcher, faviconMatcher}), defaultEntryPointMatcher});
  141.                 ServerWebExchangeMatcher matcher = new AndServerWebExchangeMatcher(new ServerWebExchangeMatcher[]{notXhrMatcher, new NegatedServerWebExchangeMatcher(defaultLoginPageMatcher)});
  142.                 RedirectServerAuthenticationEntryPoint entryPoint = new RedirectServerAuthenticationEntryPoint(providerLoginPage);
  143.                 entryPoint.setRequestCache(http.requestCache.requestCache);
  144.                 http.defaultEntryPoints.add(new DelegateEntry(matcher, entryPoint));
  145.             }
  146.  
  147.             RedirectServerAuthenticationEntryPoint defaultEntryPoint = new RedirectServerAuthenticationEntryPoint(defaultLoginPage);
  148.             defaultEntryPoint.setRequestCache(http.requestCache.requestCache);
  149.             http.defaultEntryPoints.add(new DelegateEntry(defaultEntryPointMatcher, defaultEntryPoint));
  150.         }
  151.  
  152.         private ServerAuthenticationSuccessHandler getAuthenticationSuccessHandler(ServerHttpSecurity http) {
  153.             if (this.authenticationSuccessHandler == null) {
  154.                 RedirectServerAuthenticationSuccessHandler handler = new RedirectServerAuthenticationSuccessHandler();
  155.                 handler.setRequestCache(http.requestCache.requestCache);
  156.                 this.authenticationSuccessHandler = handler;
  157.             }
  158.  
  159.             return this.authenticationSuccessHandler;
  160.         }
  161.  
  162.         private ServerAuthenticationFailureHandler getAuthenticationFailureHandler() {
  163.             if (this.authenticationFailureHandler == null) {
  164.                 this.authenticationFailureHandler = new RedirectServerAuthenticationFailureHandler("/login?error");
  165.             }
  166.  
  167.             return this.authenticationFailureHandler;
  168.         }
  169.  
  170.         private ServerWebExchangeMatcher createAttemptAuthenticationRequestMatcher() {
  171.             return new PathPatternParserServerWebExchangeMatcher("/login/oauth2/code/{registrationId}");
  172.         }
  173.  
  174.         private ReactiveOAuth2UserService<OidcUserRequest, OidcUser> getOidcUserService() {
  175.             ResolvableType type = ResolvableType.forClassWithGenerics(ReactiveOAuth2UserService.class, new Class[]{OidcUserRequest.class, OidcUser.class});
  176.             ReactiveOAuth2UserService<OidcUserRequest, OidcUser> bean = (ReactiveOAuth2UserService)ServerHttpSecurity.this.getBeanOrNull(type);
  177.             return (ReactiveOAuth2UserService)(bean == null ? new OidcReactiveOAuth2UserService() : bean);
  178.         }
  179.  
  180.         private ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> getOauth2UserService() {
  181.                                          //获取认证用户操作类
  182.             ResolvableType type = ResolvableType.forClassWithGenerics(ReactiveOAuth2UserService.class, new Class[]{OAuth2UserRequest.class, OAuth2User.class});
  183.             ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> bean = (ReactiveOAuth2UserService)ServerHttpSecurity.this.getBeanOrNull(type);
  184.             return (ReactiveOAuth2UserService)(bean == null ? new DefaultReactiveOAuth2UserService() : bean);
  185.         }
  186.  
  187.         private Map<String, String> getLinks() {
  188.             Iterable<ClientRegistration> registrations = (Iterable)ServerHttpSecurity.this.getBeanOrNull(ResolvableType.forClassWithGenerics(Iterable.class, new Class[]{ClientRegistration.class}));
  189.             if (registrations == null) {
  190.                 return Collections.emptyMap();
  191.             } else {
  192.                 Map<String, String> result = new HashMap();
  193.                 registrations.iterator().forEachRemaining((r) -> {
  194.                     String var10000 = (String)result.put("/oauth2/authorization/" + r.getRegistrationId(), r.getClientName());
  195.                 });
  196.                 return result;
  197.             }
  198.         }
  199.  
  200.         private ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> getAccessTokenResponseClient() {
  201.             ResolvableType type = ResolvableType.forClassWithGenerics(ReactiveOAuth2AccessTokenResponseClient.class, new Class[]{OAuth2AuthorizationCodeGrantRequest.class});
  202.             ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> bean = (ReactiveOAuth2AccessTokenResponseClient)ServerHttpSecurity.this.getBeanOrNull(type);
  203.             return (ReactiveOAuth2AccessTokenResponseClient)(bean == null ? new WebClientReactiveAuthorizationCodeTokenResponseClient() : bean);
  204.         }
  205.  
  206.         private ReactiveClientRegistrationRepository getClientRegistrationRepository() {
  207.             if (this.clientRegistrationRepository == null) {
  208.                 this.clientRegistrationRepository = (ReactiveClientRegistrationRepository)ServerHttpSecurity.this.getBeanOrNull(ReactiveClientRegistrationRepository.class);
  209.             }
  210.  
  211.             return this.clientRegistrationRepository;
  212.         }
  213.  
  214.         private OAuth2AuthorizationRequestRedirectWebFilter getRedirectWebFilter() {
  215.             OAuth2AuthorizationRequestRedirectWebFilter oauthRedirectFilter;
  216.             if (this.authorizationRequestResolver == null) {
  217.                 oauthRedirectFilter = new OAuth2AuthorizationRequestRedirectWebFilter(this.getClientRegistrationRepository());
  218.             } else {
  219.                 oauthRedirectFilter = new OAuth2AuthorizationRequestRedirectWebFilter(this.authorizationRequestResolver);
  220.             }
  221.  
  222.             return oauthRedirectFilter;
  223.         }
  224.  
  225.         private ServerOAuth2AuthorizedClientRepository getAuthorizedClientRepository() {
  226.             ServerOAuth2AuthorizedClientRepository result = this.authorizedClientRepository;
  227.             if (result == null) {
  228.                 result = (ServerOAuth2AuthorizedClientRepository)ServerHttpSecurity.this.getBeanOrNull(ServerOAuth2AuthorizedClientRepository.class);
  229.             }
  230.  
  231.             if (result == null) {
  232.                 ReactiveOAuth2AuthorizedClientService authorizedClientService = this.getAuthorizedClientService();
  233.                 if (authorizedClientService != null) {
  234.                     result = new AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository(authorizedClientService);
  235.                 }
  236.             }
  237.  
  238.             return (ServerOAuth2AuthorizedClientRepository)result;
  239.         }
  240.  
  241.         private ServerAuthorizationRequestRepository<OAuth2AuthorizationRequest> getAuthorizationRequestRepository() {
  242.             if (this.authorizationRequestRepository == null) {
  243.                 this.authorizationRequestRepository = new WebSessionOAuth2ServerAuthorizationRequestRepository();
  244.             }
  245.  
  246.             return this.authorizationRequestRepository;
  247.         }
  248.  
  249.         private ReactiveOAuth2AuthorizedClientService getAuthorizedClientService() {
  250.             ReactiveOAuth2AuthorizedClientService service = (ReactiveOAuth2AuthorizedClientService)ServerHttpSecurity.this.getBeanOrNull(ReactiveOAuth2AuthorizedClientService.class);
  251.             if (service == null) {
  252.                 service = new InMemoryReactiveOAuth2AuthorizedClientService(this.getClientRegistrationRepository());
  253.             }
  254.  
  255.             return (ReactiveOAuth2AuthorizedClientService)service;
  256.         }
  257.  
  258.         private OAuth2LoginSpec() {
  259.         }
  260.     }

 

 

*****************

ReactiveClientRegistrationRepository

 

ReactiveClientRegistrationRepository：存储授权提供方

  1. public interface ReactiveClientRegistrationRepository {
  2.     Mono<ClientRegistration> findByRegistrationId(String var1);
  3. }

 

InMemoryReactiveClientRegistrationRepository：内存中存储clientRegistration

  1. public final class InMemoryReactiveClientRegistrationRepository implements ReactiveClientRegistrationRepository, Iterable<ClientRegistration> {
  2.     private final Map<String, ClientRegistration> clientIdToClientRegistration;
  3.  
  4.     public InMemoryReactiveClientRegistrationRepository(ClientRegistration... registrations) {
  5.         this(toList(registrations));
  6.     }
  7.  
  8.     private static List<ClientRegistration> toList(ClientRegistration... registrations) {
  9.         Assert.notEmpty(registrations, "registrations cannot be null or empty");
  10.         return Arrays.asList(registrations);
  11.     }
  12.  
  13.     public InMemoryReactiveClientRegistrationRepository(List<ClientRegistration> registrations) {
  14.         this.clientIdToClientRegistration = toUnmodifiableConcurrentMap(registrations);
  15.     }
  16.  
  17.     public Mono<ClientRegistration> findByRegistrationId(String registrationId) {
  18.         return Mono.justOrEmpty(this.clientIdToClientRegistration.get(registrationId));
  19.     }
  20.  
  21.     public Iterator<ClientRegistration> iterator() {
  22.         return this.clientIdToClientRegistration.values().iterator();
  23.     }
  24.  
  25.     private static Map<String, ClientRegistration> toUnmodifiableConcurrentMap(List<ClientRegistration> registrations) {
  26.         Assert.notEmpty(registrations, "registrations cannot be null or empty");
  27.         ConcurrentHashMap<String, ClientRegistration> result = new ConcurrentHashMap();
  28.         Iterator var2 = registrations.iterator();
  29.  
  30.         while(var2.hasNext()) {
  31.             ClientRegistration registration = (ClientRegistration)var2.next();
  32.             Assert.notNull(registration, "no registration can be null");
  33.             if (result.containsKey(registration.getRegistrationId())) {
  34.                 throw new IllegalStateException(String.format("Duplicate key %s", registration.getRegistrationId()));
  35.             }
  36.  
  37.             result.put(registration.getRegistrationId(), registration);
  38.         }
  39.  
  40.         return Collections.unmodifiableMap(result);
  41.     }
  42. }

 

clientRegistration：clientRegistration属性

  1. public final class ClientRegistration implements Serializable {
  2.     private static final long serialVersionUID = 530L;
  3.     private String registrationId;
  4.     private String clientId;
  5.     private String clientSecret;
  6.     private ClientAuthenticationMethod clientAuthenticationMethod;
  7.     private AuthorizationGrantType authorizationGrantType;
  8.     private String redirectUriTemplate;
  9.     private Set<String> scopes;
  10.     private ClientRegistration.ProviderDetails providerDetails;
  11.     private String clientName;
  12.  
  13.  
  14. ***********
  15. 内部类：ClientRegistration.ProviderDetails
  16.  
  17.     public class ProviderDetails implements Serializable {
  18.         private static final long serialVersionUID = 530L;
  19.         private String authorizationUri;
  20.         private String tokenUri;
  21.         private ClientRegistration.ProviderDetails.UserInfoEndpoint userInfoEndpoint;
  22.         private String jwkSetUri;
  23.         private Map<String, Object> configurationMetadata;

 

 

*****************

authenticationManager

 

ReactiveAuthenticationManager：认证authentication接口

  1. @FunctionalInterface
  2. public interface ReactiveAuthenticationManager {
  3.     Mono<Authentication> authenticate(Authentication var1);
  4. }

 

OAuth2LoginReactiveAuthenticationManager：认证autentication，认证成功后加载认证用户

  1. public class OAuth2LoginReactiveAuthenticationManager implements ReactiveAuthenticationManager {
  2.     private final ReactiveAuthenticationManager authorizationCodeManager;
  3.     private final ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> userService;
  4.     private GrantedAuthoritiesMapper authoritiesMapper = (authorities) -> {
  5.         return authorities;
  6.     };
  7.  
  8.     public OAuth2LoginReactiveAuthenticationManager(ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient, ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> userService) {
  9.         Assert.notNull(accessTokenResponseClient, "accessTokenResponseClient cannot be null");
  10.         Assert.notNull(userService, "userService cannot be null");
  11.         this.authorizationCodeManager = new OAuth2AuthorizationCodeReactiveAuthenticationManager(accessTokenResponseClient);
  12.         this.userService = userService;
  13.     }
  14.  
  15.     public Mono<Authentication> authenticate(Authentication authentication) {
  16.                                 //认证authentication
  17.  
  18.         return Mono.defer(() -> {
  19.             OAuth2AuthorizationCodeAuthenticationToken token = (OAuth2AuthorizationCodeAuthenticationToken)authentication;
  20.             return token.getAuthorizationExchange().getAuthorizationRequest().getScopes().contains("openid") ? Mono.empty() : this.authorizationCodeManager.authenticate(token).onErrorMap(OAuth2AuthorizationException.class, (e) -> {
  21.                 return new OAuth2AuthenticationException(e.getError(), e.getError().toString());
  22.             }).cast(OAuth2AuthorizationCodeAuthenticationToken.class).flatMap(this::onSuccess);
  23.         });
  24.     }
  25.  
  26.     private Mono<OAuth2LoginAuthenticationToken> onSuccess(OAuth2AuthorizationCodeAuthenticationToken authentication) {
  27.                                  //认证成功后，加载认证用户
  28.         OAuth2AccessToken accessToken = authentication.getAccessToken();
  29.         Map<String, Object> additionalParameters = authentication.getAdditionalParameters();
  30.         OAuth2UserRequest userRequest = new OAuth2UserRequest(authentication.getClientRegistration(), accessToken, additionalParameters);
  31.         return this.userService.loadUser(userRequest).map((oauth2User) -> {
  32.             Collection<? extends GrantedAuthority> mappedAuthorities = this.authoritiesMapper.mapAuthorities(oauth2User.getAuthorities());
  33.             OAuth2LoginAuthenticationToken authenticationResult = new OAuth2LoginAuthenticationToken(authentication.getClientRegistration(), authentication.getAuthorizationExchange(), oauth2User, mappedAuthorities, accessToken, authentication.getRefreshToken());
  34.             return authenticationResult;
  35.         });
  36.     }
  37. }

 

ReactiveOAuth2UserService：加载认证用户接口

  1. @FunctionalInterface
  2. public interface ReactiveOAuth2UserService<R extends OAuth2UserRequest, U extends OAuth2User> {
  3.     Mono<U> loadUser(R var1) throws OAuth2AuthenticationException;
  4. }

 

DefaultReactiveOAuth2UserService：默认加载认证用户实现类

  1. public class DefaultReactiveOAuth2UserService implements ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> {
  2.     private static final String INVALID_USER_INFO_RESPONSE_ERROR_CODE = "invalid_user_info_response";
  3.     private static final String MISSING_USER_INFO_URI_ERROR_CODE = "missing_user_info_uri";
  4.     private static final String MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE = "missing_user_name_attribute";
  5.     private WebClient webClient = WebClient.create();
  6.  
  7.     public DefaultReactiveOAuth2UserService() {
  8.     }
  9.  
  10.     public Mono<OAuth2User> loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
  11.                             //加载认证用户
  12.         return Mono.defer(() -> {
  13.             Assert.notNull(userRequest, "userRequest cannot be null");
  14.             String userInfoUri = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri();
  15.             if (!StringUtils.hasText(userInfoUri)) {
  16.                 OAuth2Error oauth2Error = new OAuth2Error("missing_user_info_uri", "Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: " + userRequest.getClientRegistration().getRegistrationId(), (String)null);
  17.                 throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
  18.             } else {
  19.                 String userNameAttributeName = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName();
  20.                 if (!StringUtils.hasText(userNameAttributeName)) {
  21.                     OAuth2Error oauth2Errorx = new OAuth2Error("missing_user_name_attribute", "Missing required \"user name\" attribute name in UserInfoEndpoint for Client Registration: " + userRequest.getClientRegistration().getRegistrationId(), (String)null);
  22.                     throw new OAuth2AuthenticationException(oauth2Errorx, oauth2Errorx.toString());
  23.                 } else {
  24.                     ParameterizedTypeReference<Map<String, Object>> typeReference = new ParameterizedTypeReference<Map<String, Object>>() {
  25.                     };
  26.                     AuthenticationMethod authenticationMethod = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getAuthenticationMethod();
  27.                     RequestHeadersSpec requestHeadersSpec;
  28.                     if (AuthenticationMethod.FORM.equals(authenticationMethod)) {
  29.                         requestHeadersSpec = ((RequestBodySpec)((RequestBodySpec)((RequestBodySpec)this.webClient.post().uri(userInfoUri, new Object[0])).header("Accept", new String[]{"application/json"})).header("Content-Type", new String[]{"application/x-www-form-urlencoded"})).syncBody("access_token=" + userRequest.getAccessToken().getTokenValue());
  30.                     } else {
  31.                         requestHeadersSpec = this.webClient.get().uri(userInfoUri, new Object[0]).header("Accept", new String[]{"application/json"}).headers((headers) -> {
  32.                             headers.setBearerAuth(userRequest.getAccessToken().getTokenValue());
  33.                         });
  34.                     }
  35.  
  36.                     Mono<Map<String, Object>> userAttributes = requestHeadersSpec.retrieve().onStatus((s) -> {
  37.                         return s != HttpStatus.OK;
  38.                     }, (response) -> {
  39.                         return parse(response).map((userInfoErrorResponse) -> {
  40.                             String description = userInfoErrorResponse.getErrorObject().getDescription();
  41.                             OAuth2Error oauth2Error = new OAuth2Error("invalid_user_info_response", description, (String)null);
  42.                             throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
  43.                         });
  44.                     }).bodyToMono(typeReference);
  45.                     return userAttributes.map((attrs) -> {
  46.                         GrantedAuthority authority = new OAuth2UserAuthority(attrs);
  47.                         Set<GrantedAuthority> authorities = new HashSet();
  48.                         authorities.add(authority);
  49.                         OAuth2AccessToken token = userRequest.getAccessToken();
  50.                         Iterator var6 = token.getScopes().iterator();
  51.  
  52.                         while(var6.hasNext()) {
  53.                             String scope = (String)var6.next();
  54.                             authorities.add(new SimpleGrantedAuthority("SCOPE_" + scope));
  55.                         }
  56.  
  57.                         return new DefaultOAuth2User(authorities, attrs, userNameAttributeName);
  58.                     }).onErrorMap((e) -> {
  59.                         return e instanceof IOException;
  60.                     }, (t) -> {
  61.                         return new AuthenticationServiceException("Unable to access the userInfoEndpoint " + userInfoUri, t);
  62.                     }).onErrorMap((t) -> {
  63.                         return !(t instanceof AuthenticationServiceException);
  64.                     }, (t) -> {
  65.                         OAuth2Error oauth2Error = new OAuth2Error("invalid_user_info_response", "An error occurred reading the UserInfo Success response: " + t.getMessage(), (String)null);
  66.                         return new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), t);
  67.                     });
  68.                 }
  69.             }
  70.         });
  71.     }
  72.  
  73.     public void setWebClient(WebClient webClient) {
  74.         Assert.notNull(webClient, "webClient cannot be null");
  75.         this.webClient = webClient;
  76.     }
  77.  
  78.     private static Mono<UserInfoErrorResponse> parse(ClientResponse httpResponse) {
  79.         String wwwAuth = httpResponse.headers().asHttpHeaders().getFirst("WWW-Authenticate");
  80.         if (!StringUtils.isEmpty(wwwAuth)) {
  81.             return Mono.fromCallable(() -> {
  82.                 return UserInfoErrorResponse.parse(wwwAuth);
  83.             });
  84.         } else {
  85.             ParameterizedTypeReference<Map<String, String>> typeReference = new ParameterizedTypeReference<Map<String, String>>() {
  86.             };
  87.             return httpResponse.bodyToMono(typeReference).map((body) -> {
  88.                 return new UserInfoErrorResponse(ErrorObject.parse(new JSONObject(body)));
  89.             });
  90.         }
  91.     }
  92. }

 

 

*****************

获取 access_token

 

WebClientReactiveAuthorizationCodeTokenResponseClient：获取access_token的客户端

  1. public class WebClientReactiveAuthorizationCodeTokenResponseClient extends AbstractWebClientReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> {
  2.     public WebClientReactiveAuthorizationCodeTokenResponseClient() {
  3.     }
  4.  
  5.     ClientRegistration clientRegistration(OAuth2AuthorizationCodeGrantRequest grantRequest) {
  6.         return grantRequest.getClientRegistration();
  7.     }
  8.  
  9.     Set<String> scopes(OAuth2AuthorizationCodeGrantRequest grantRequest) {
  10.         return Collections.emptySet();
  11.     }
  12.  
  13.     Set<String> defaultScopes(OAuth2AuthorizationCodeGrantRequest grantRequest) {
  14.         return grantRequest.getAuthorizationExchange().getAuthorizationRequest().getScopes();
  15.     }
  16.  
  17.     FormInserter<String> populateTokenRequestBody(OAuth2AuthorizationCodeGrantRequest grantRequest, FormInserter<String> body) {
  18.         super.populateTokenRequestBody(grantRequest, body);
  19.         OAuth2AuthorizationExchange authorizationExchange = grantRequest.getAuthorizationExchange();
  20.         OAuth2AuthorizationResponse authorizationResponse = authorizationExchange.getAuthorizationResponse();
  21.         body.with("code", authorizationResponse.getCode());
  22.         String redirectUri = authorizationExchange.getAuthorizationRequest().getRedirectUri();
  23.         if (redirectUri != null) {
  24.             body.with("redirect_uri", redirectUri);
  25.         }
  26.  
  27.         String codeVerifier = (String)authorizationExchange.getAuthorizationRequest().getAttribute("code_verifier");
  28.         if (codeVerifier != null) {
  29.             body.with("code_verifier", codeVerifier);
  30.         }
  31.  
  32.         return body;
  33.     }
  34. }

 

AbstractWebClientOAuth2ReactiveAccessTokenResponseClient：使用webClient获取acccess_token

  1. abstract class AbstractWebClientReactiveOAuth2AccessTokenResponseClient<T extends AbstractOAuth2AuthorizationGrantRequest> implements ReactiveOAuth2AccessTokenResponseClient<T> {
  2.     private WebClient webClient = WebClient.builder().build();
  3.  
  4.     AbstractWebClientReactiveOAuth2AccessTokenResponseClient() {
  5.     }
  6.  
  7.     public Mono<OAuth2AccessTokenResponse> getTokenResponse(T grantRequest) {
  8.         Assert.notNull(grantRequest, "grantRequest cannot be null");
  9.         return Mono.defer(() -> {
  10.             return ((RequestBodySpec)((RequestBodySpec)this.webClient.post().uri(this.clientRegistration(grantRequest).getProviderDetails().getTokenUri(), new Object[0])).headers((headers) -> {
  11.                 this.populateTokenRequestHeaders(grantRequest, headers);
  12.             })).body(this.createTokenRequestBody(grantRequest)).exchange().flatMap((response) -> {
  13.                 return this.readTokenResponse(grantRequest, response);
  14.             });
  15.         });
  16.     }
  17.  
  18.     abstract ClientRegistration clientRegistration(T var1);
  19.  
  20.     private void populateTokenRequestHeaders(T grantRequest, HttpHeaders headers) {
  21.         ClientRegistration clientRegistration = this.clientRegistration(grantRequest);
  22.         headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
  23.         headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
  24.         if (ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
  25.             headers.setBasicAuth(clientRegistration.getClientId(), clientRegistration.getClientSecret());
  26.         }
  27.  
  28.     }
  29.  
  30.     private FormInserter<String> createTokenRequestBody(T grantRequest) {
  31.         FormInserter<String> body = BodyInserters.fromFormData("grant_type", grantRequest.getGrantType().getValue());
  32.         return this.populateTokenRequestBody(grantRequest, body);
  33.     }
  34.  
  35.     FormInserter<String> populateTokenRequestBody(T grantRequest, FormInserter<String> body) {
  36.         ClientRegistration clientRegistration = this.clientRegistration(grantRequest);
  37.         if (!ClientAuthenticationMethod.BASIC.equals(clientRegistration.getClientAuthenticationMethod())) {
  38.             body.with("client_id", clientRegistration.getClientId());
  39.         }
  40.  
  41.         if (ClientAuthenticationMethod.POST.equals(clientRegistration.getClientAuthenticationMethod())) {
  42.             body.with("client_secret", clientRegistration.getClientSecret());
  43.         }
  44.  
  45.         Set<String> scopes = this.scopes(grantRequest);
  46.         if (!CollectionUtils.isEmpty(scopes)) {
  47.             body.with("scope", StringUtils.collectionToDelimitedString(scopes, " "));
  48.         }
  49.  
  50.         return body;
  51.     }
  52.  
  53.     abstract Set<String> scopes(T var1);
  54.  
  55.     Set<String> defaultScopes(T grantRequest) {
  56.         return this.scopes(grantRequest);
  57.     }
  58.  
  59.     private Mono<OAuth2AccessTokenResponse> readTokenResponse(T grantRequest, ClientResponse response) {
  60.         return ((Mono)response.body(OAuth2BodyExtractors.oauth2AccessTokenResponse())).map((tokenResponse) -> {
  61.             return this.populateTokenResponse(grantRequest, tokenResponse);
  62.         });
  63.     }
  64.  
  65.     OAuth2AccessTokenResponse populateTokenResponse(T grantRequest, OAuth2AccessTokenResponse tokenResponse) {
  66.         if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
  67.             Set<String> defaultScopes = this.defaultScopes(grantRequest);
  68.             tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse).scopes(defaultScopes).build();
  69.         }
  70.  
  71.         return tokenResponse;
  72.     }
  73.  
  74.     public void setWebClient(WebClient webClient) {
  75.         Assert.notNull(webClient, "webClient cannot be null");
  76.         this.webClient = webClient;
  77.     }
  78. }

 

 

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/2023面试高手/article/detail/68887
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号