如何访问令牌additionalInformation以验证基于表达式的访问控制

Question

我user_id通过实现a 成功地在授权服务器端添加了生成的令牌的附加信息TokenEnhancer.这是一个生成的令牌:

{"access_token":"ccae1713-00d4-49c2-adbf-e699c525d53e","token_type":"bearer","expires_in":31512,"scope":"end-user","user_id":2}

现在,在资源服务器端,这是一个通过a进行通信的完全独立的spring项目RemoteTokenServices,我想在方法中使用这些信息expression-based access control.例如,我想使用添加的user_id数据(Spring Data JPA存储库用于Spring Data Rest):

@PreAuthorize("#oauth2.hasScope('admin') or #id == authentication.principal.user_id") @Override UserAccount findOne (@P("id") Integer id);

在#oauth2.hasScope('admin')按预期工作,但#id == authentication.principal.user_id"部分显然不是.

如何在基于表达式的访问控制中访问添加到令牌的其他数据？

Answer 1

所以我找到了自己.关键接口是UserAuthenticationConverter.

使用默认提供的DefaultUserAuthenticationConverter类,我们可以设置一个UserDetailsService用于使用authentication.principalUserDetailsS​​ervice返回的UserDetail对象进行设置的类.如果没有它,authentication.principal仅使用令牌username作为String设置.

这是我的摘录ResourceServerConfigAdapter:

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration 
        extends ResourceServerConfigurerAdapter {

    @Bean
    UserDetailsService userDetailsService () {
        return new UserDetailsServiceImpl();
    }

    @Bean
    public UserAuthenticationConverter userAuthenticationConverter () {
        DefaultUserAuthenticationConverter duac 
            = new DefaultUserAuthenticationConverter();
        duac.setUserDetailsService(userDetailsService());
        return duac;
    }

    @Bean
    public AccessTokenConverter accessTokenConverter() {
        DefaultAccessTokenConverter datc 
            = new DefaultAccessTokenConverter();
        datc.setUserTokenConverter(userAuthenticationConverter());
        return datc;
    }

    @Bean
    RemoteTokenServices getRemoteTokenServices () {
        RemoteTokenServices rts = new RemoteTokenServices();
        rts.setCheckTokenEndpointUrl(
            "http://localhost:15574/oauth/check_token");
        rts.setAccessTokenConverter(accessTokenConverter());
        rts.setClientId("client");
        rts.setClientSecret("pass");
        return rts;
    }

    ...

}

另一种方法是覆盖DefaultUserAuthenticationManager并提供自定义public Authentication extractAuthentication(Map<String, ?> map).

完成后,我们可以使用以下用户数据expression-based access control:

@PreAuthorize("#oauth2.hasScope('admin') or #id == authentication.principal.userAccount.id")
@Override
UserAccount findOne (@P("id") Integer id);

请注意,这userAccount是我原来的DOMAIN用户对象.它可能是UserDetailsS​​ervice返回的所有内容.

编辑: 要回答Valentin Despa,这是我的UserDetailsS​​ervice实现:

@Component
public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    UserAccountRepository userAccountRepository;

    public UserDetails loadUserByUsername (String username) 
            throws UsernameNotFoundException {

        // Fetch user from repository
        UserAccount ua = this.userAccountRepository
            .findByEmail(username);

        // If nothing throws Exception
        if (ua == null) {
            throw new UsernameNotFoundException(
                "No user found having this username");
        }

        // Convert it to a UserDetails object
        return new UserDetailsImpl(ua);

    }

}