Spring boot oauth2: No userInfo endpoint - How to load the authentication (Principal) from the JWT access token directly in the client

Question

I am setting up an oauth 2.0 client application which will redirect the users to an external IDP (Authorization Server) to sign in. My app will undergo the regular oauth 2 Authorization code grant flow - 1)Redirect the users to sign in. 2)Obtain the access code first 3) Use the access code to obtain the token. Since the external IDP is using oauth 2 just for authentication, they are not going to provide a user-info endpoint url (required by an OIDC provider) to get the user details. Instead they want us to get the claims from the JWT token directly and make any authorizations in our app. I am unable to find the right code/configuration which will not expect a user-info endpoint and instead decode the jwt directly for loading the authentication. In the below demo code, if I were to decode the user details from the JWT token issued by OKTA without calling its userInfo endpoint, how do I do that?

我正在使用 spring boot 2.x 版本，使用 spring 参考示例社交 oauth2 项目中提供的标准 oauth 客户端配置。

如果有人能引导我走上正确的道路，我将非常感激。谢谢你！

梯度配置

buildscript {
ext {
    springBootVersion = '2.2.0.RELEASE'
}
repositories {
    mavenLocal()
    mavenCentral()
}
dependencies {
    classpath("org.springframework.boot:spring-boot-gradle-plugin:${springBootVersion}")
}
}
apply plugin: 'java'
apply plugin: 'org.springframework.boot'
sourceCompatibility = 1.8
targetCompatibility = 1.8
repositories {
mavenLocal()
mavenCentral()
}
configurations {
compile.exclude module: 'spring-boot-starter-logging'
}
dependencies {
compile("org.springframework.boot:spring-boot-starter-web:${springBootVersion}")
compile("org.springframework.boot:spring-boot-starter-log4j2:${springBootVersion}")
compile("org.springframework.boot:spring-boot-starter-security:${springBootVersion}")
compile("org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure:${springBootVersion}")
compile("org.webjars:jquery:2.1.1")
compile("org.webjars:bootstrap:3.2.0")
compile("org.webjars:webjars-locator-core:0.42")
}

应用程序.yml

github:
  client:
     clientId: <clientId>
     clientSecret: <clientSecret>
     accessTokenUri: https://github.com/login/oauth/access_token
     userAuthorizationUri: https://github.com/login/oauth/authorize
     tokenName: oauth_token
     authenticationScheme: query
     clientAuthenticationScheme: form
  resource:
     userInfoUri: https://api.github.com/user

okta:
  client:
   clientId: <clientId>
   clientSecret: <clientSecret>
   accessTokenUri: https://<okta-sub-domain>/oauth2/default/v1/token
   userAuthorizationUri: https://<okta-sub-domain>/oauth2/default/v1/authorize
   scope: openid profile email
 resource:
  userInfoUri: https://<okta-sub-domain>/oauth2/default/v1/userinfo

OAuth2Config.java

@Configuration
@EnableOAuth2Client
public class Oauth2Config extends WebSecurityConfigurerAdapter {

@Autowired
OAuth2ClientContext oauth2ClientContext;

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.antMatcher("/**").authorizeRequests()
    .antMatchers("/", "/login**", "/webjars/**", "/error**")
    .permitAll()
  .anyRequest()
    .authenticated()
            .and().logout().logoutSuccessUrl("/").permitAll()
            .and().addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class);;
    http.csrf().disable();
}

private Filter ssoFilter() {
    CompositeFilter filter = new CompositeFilter();
    List<Filter> filters = new ArrayList<>();

    OAuth2ClientAuthenticationProcessingFilter githubFilter = new OAuth2ClientAuthenticationProcessingFilter("/login/github");
    OAuth2RestTemplate githubTemplate = new OAuth2RestTemplate(github(), oauth2ClientContext);
    githubFilter.setRestTemplate(githubTemplate);
    UserInfoTokenServices tokenServices = new UserInfoTokenServices(githubResource().getUserInfoUri(), github().getClientId());
    tokenServices.setRestTemplate(githubTemplate);
    githubFilter.setTokenServices(tokenServices);
    filters.add(githubFilter);

    OAuth2ClientAuthenticationProcessingFilter oktaFilter = new OAuth2ClientAuthenticationProcessingFilter("/login/okta");
    OAuth2RestTemplate oktaTemplate = new OAuth2RestTemplate(okta(), oauth2ClientContext);
    oktaFilter.setRestTemplate(oktaTemplate);
    tokenServices = new UserInfoTokenServices(oktaResource().getUserInfoUri(), okta().getClientId());        
    tokenServices.setRestTemplate(oktaTemplate);
    oktaFilter.setTokenServices(tokenServices);
    filters.add(oktaFilter);

    filter.setFilters(filters);
    return filter;
}

//Client registration
@Bean
@ConfigurationProperties("github.client")
public AuthorizationCodeResourceDetails github() {
    return new AuthorizationCodeResourceDetails();
}

//user info endpoints
@Bean
@ConfigurationProperties("github.resource")
public ResourceServerProperties githubResource() {
    return new ResourceServerProperties();
}

@Bean
@ConfigurationProperties("okta.client")
public AuthorizationCodeResourceDetails okta() {
    return new AuthorizationCodeResourceDetails();
}

@Bean
@ConfigurationProperties("okta.resource")
public ResourceServerProperties oktaResource() {
    return new ResourceServerProperties();
}

//For Handling Redirects
@Bean
public FilterRegistrationBean<OAuth2ClientContextFilter> oauth2ClientFilterRegistration(OAuth2ClientContextFilter filter) {
    FilterRegistrationBean<OAuth2ClientContextFilter> registration = new FilterRegistrationBean<>();
    registration.setFilter(filter);
    registration.setOrder(-100);
    return registration;
}

}

一个简单的控制器，带有 html 页面使用的端点

@RestController
public class UserController {

@GetMapping("/user")
public Principal user(Principal principal) {        
    return principal;
}

}

@SpringBootApplication
public class Oauth2Application {

public static void main(String[] args) {
    SpringApplication.run(Oauth2Application.class, args);
}

}

Answer 1

DefaultReactiveOAuth2UserService查找用户信息。我们可以简单地引入一个新的ReactiveOAuth2UserService实现来从令牌中获取值，例如：

@Service
public class GttOAuth2UserService implements ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User>  {

    @Override
    public Mono<OAuth2User> loadUser(OAuth2UserRequest oAuth2UserRequest) throws OAuth2AuthenticationException {
        final List<GrantedAuthority> authorities = Arrays.asList(new SimpleGrantedAuthority("authority"));
        final Map<String, Object> attributes = oAuth2UserRequest.getAdditionalParameters();
        final OAuth2User user = new DefaultOAuth2User(authorities, attributes, "email");
        return Mono.just(user);
    }
}

（在你的情况下，它可能是非反应性的等价物）