相关疑难解决方法(0)

我有一个配置了@EnableResourceServer注释的资源服务器,它通过user-info-uri参数引用授权服务器,如下所示:

security:
  oauth2:
    resource:
      user-info-uri: http://localhost:9001/user

授权服务器/用户端点返回的扩展名org.springframework.security.core.userdetails.User包含例如电子邮件:

{  
   "password":null,
   "username":"myuser",
    ...
   "email":"me@company.com"
}

每当访问某个资源服务器端点时,Spring通过调用授权服务器的/user端点来验证后台的访问令牌,它实际上会返回丰富的用户信息(其中包含例如电子邮件信息,我已经使用Wireshark验证了该信息).

所以问题是如何在没有明确第二次调用授权服务器/user端点的情况下获取此自定义用户信息.Spring是否在授权后将其存储在资源服务器本地的某个位置,或者如果没有任何可用的开箱即用,那么实现此类用户信息的最佳方式是什么？

我有一个使用 spring boot 的项目，使用 oauth2 的 spring security。当我使用 SecurityContextHolder.getContext().getAuthentication().getPrincipal()

在我看到此方法返回 UserDetails 实现的示例中，此方法仅返回用户名结尾。

按照设置

OAuthSecurityConfig.java：

package br.com.altha.api.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;
import org.springframework.core.annotation.Order;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;

import br.com.altha.api.security.CustomUserDetailsService;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
@EnableAuthorizationServer
@EnableResourceServer
@Order(SecurityProperties.BASIC_AUTH_ORDER-2)
@Import(Encoders.class)
public class OAuthSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private PasswordEncoder userPasswordEncoder;

    @Autowired
    private CustomUserDetailsService userDetailsService;

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected …