|
此版本仍在开发中，尚未被视为稳定版本。对于最新的稳定版本，请使用 Spring Security 6.4.1！ |
授权授予支持
授权码
| 请参阅 OAuth 2.0 授权框架，了解有关授权码授予的更多详细信息。 |
获取授权
| 请参阅授权请求/响应协议流程，了解授权码授予。 |
发起授权请求
这OAuth2AuthorizationRequestRedirectWebFilter使用ServerOAuth2AuthorizationRequestResolver要解析OAuth2AuthorizationRequest并通过将最终用户的用户代理重定向到授权服务器的授权端点来启动授权代码授予流程。
主要角色ServerOAuth2AuthorizationRequestResolver是解析OAuth2AuthorizationRequest从提供的 Web 请求。
默认实现DefaultServerOAuth2AuthorizationRequestResolver（默认）路径上的 matches/oauth2/authorization/{registrationId}提取registrationId并使用它来构建OAuth2AuthorizationRequest对于关联的ClientRegistration.
给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：
spring:
security:
oauth2:
client:
registration:
okta:
client-id: okta-client-id
client-secret: okta-client-secret
authorization-grant-type: authorization_code
redirect-uri: "{baseUrl}/authorized/okta"
scope: read, write
provider:
okta:
authorization-uri: https://dev-1234.oktapreview.com/oauth2/v1/authorize
token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token具有基本路径的请求/oauth2/authorization/okta将启动 Authorization Request 重定向OAuth2AuthorizationRequestRedirectWebFilter并最终启动授权代码授予流程。
这AuthorizationCodeReactiveOAuth2AuthorizedClientProvider是ReactiveOAuth2AuthorizedClientProvider对于 Authorization Code 授予，
它还通过OAuth2AuthorizationRequestRedirectWebFilter. |
如果 OAuth 2.0 客户端是公共客户端，则按如下方式配置 OAuth 2.0 客户端注册：
spring:
security:
oauth2:
client:
registration:
okta:
client-id: okta-client-id
client-authentication-method: none
authorization-grant-type: authorization_code
redirect-uri: "{baseUrl}/authorized/okta"
...支持使用代码交换证明密钥 （PKCE） 的公共客户端。 如果客户端在不受信任的环境中运行（例如，本机应用程序或基于 Web 浏览器的应用程序），因此无法维护其凭据的机密性，则当满足以下条件时，将自动使用 PKCE：
-
client-secret被省略（或为空） -
client-authentication-method设置为 “none” （ClientAuthenticationMethod.NONE)
如果 OAuth 2.0 提供者支持机密客户端的 PKCE，您可以（可选）使用DefaultServerOAuth2AuthorizationRequestResolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce()). |
这DefaultServerOAuth2AuthorizationRequestResolver还支持URItemplate 变量的redirect-uri用UriComponentsBuilder.
以下配置使用所有支持的URI模板变量：
spring:
security:
oauth2:
client:
registration:
okta:
...
redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/authorized/{registrationId}"
...
{baseUrl}resolve为{baseScheme}://{baseHost}{basePort}{basePath}
|
配置redirect-uri跟URI当 OAuth 2.0 客户端在 Proxy Server 后面运行时，模板变量特别有用。
这可确保X-Forwarded-*扩展redirect-uri.
自定义授权请求
主要用例之一是ServerOAuth2AuthorizationRequestResolver可以实现的是能够使用高于 OAuth 2.0 授权框架中定义的标准参数的其他参数自定义授权请求。
例如，OpenID Connect 为授权代码流定义了其他 OAuth 2.0 请求参数，该请求参数从 OAuth 2.0 授权框架中定义的标准参数扩展而来。
其中一个扩展参数是prompt参数。
|
这 |
以下示例显示如何配置DefaultServerOAuth2AuthorizationRequestResolver替换为Consumer<OAuth2AuthorizationRequest.Builder>自定义oauth2Login()，通过包含 request 参数prompt=consent.
-
Java
-
Kotlin
@Configuration
@EnableWebFluxSecurity
public class OAuth2LoginSecurityConfig {
@Autowired
private ReactiveClientRegistrationRepository clientRegistrationRepository;
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http
.authorizeExchange(authorize -> authorize
.anyExchange().authenticated()
)
.oauth2Login(oauth2 -> oauth2
.authorizationRequestResolver(
authorizationRequestResolver(this.clientRegistrationRepository)
)
);
return http.build();
}
private ServerOAuth2AuthorizationRequestResolver authorizationRequestResolver(
ReactiveClientRegistrationRepository clientRegistrationRepository) {
DefaultServerOAuth2AuthorizationRequestResolver authorizationRequestResolver =
new DefaultServerOAuth2AuthorizationRequestResolver(
clientRegistrationRepository);
authorizationRequestResolver.setAuthorizationRequestCustomizer(
authorizationRequestCustomizer());
return authorizationRequestResolver;
}
private Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer() {
return customizer -> customizer
.additionalParameters(params -> params.put("prompt", "consent"));
}
}@Configuration
@EnableWebFluxSecurity
class SecurityConfig {
@Autowired
private lateinit var customClientRegistrationRepository: ReactiveClientRegistrationRepository
@Bean
fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
http {
authorizeExchange {
authorize(anyExchange, authenticated)
}
oauth2Login {
authorizationRequestResolver = authorizationRequestResolver(customClientRegistrationRepository)
}
}
return http.build()
}
private fun authorizationRequestResolver(
clientRegistrationRepository: ReactiveClientRegistrationRepository): ServerOAuth2AuthorizationRequestResolver {
val authorizationRequestResolver = DefaultServerOAuth2AuthorizationRequestResolver(
clientRegistrationRepository)
authorizationRequestResolver.setAuthorizationRequestCustomizer(
authorizationRequestCustomizer())
return authorizationRequestResolver
}
private fun authorizationRequestCustomizer(): Consumer<OAuth2AuthorizationRequest.Builder> {
return Consumer { customizer ->
customizer
.additionalParameters { params -> params["prompt"] = "consent" }
}
}
}对于简单的用例，其中特定提供商的附加请求参数始终相同，可以直接将其添加到authorization-uri财产。
例如，如果 request 参数prompt总是consent对于提供商okta，而不是简单地配置如下：
spring:
security:
oauth2:
client:
provider:
okta:
authorization-uri: https://dev-1234.oktapreview.com/oauth2/v1/authorize?prompt=consent前面的示例显示了在标准参数之上添加自定义参数的常见使用案例。
或者，如果您的要求更高级，则只需覆盖OAuth2AuthorizationRequest.authorizationRequestUri财产。
OAuth2AuthorizationRequest.Builder.build()构造OAuth2AuthorizationRequest.authorizationRequestUri，它表示授权请求 URI，包括使用application/x-www-form-urlencoded格式。 |
以下示例显示了authorizationRequestCustomizer()，而是覆盖OAuth2AuthorizationRequest.authorizationRequestUri财产。
-
Java
-
Kotlin
private Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer() {
return customizer -> customizer
.authorizationRequestUri(uriBuilder -> uriBuilder
.queryParam("prompt", "consent").build());
}private fun authorizationRequestCustomizer(): Consumer<OAuth2AuthorizationRequest.Builder> {
return Consumer { customizer: OAuth2AuthorizationRequest.Builder ->
customizer
.authorizationRequestUri { uriBuilder: UriBuilder ->
uriBuilder
.queryParam("prompt", "consent").build()
}
}
}存储授权请求
这ServerAuthorizationRequestRepository负责OAuth2AuthorizationRequest从发起授权请求到收到授权响应（回调）的时间。
这OAuth2AuthorizationRequest用于关联和验证授权响应。 |
的默认实现ServerAuthorizationRequestRepository是WebSessionOAuth2ServerAuthorizationRequestRepository，它将OAuth2AuthorizationRequest在WebSession.
如果您有ServerAuthorizationRequestRepository，您可以按照以下示例所示对其进行配置：
-
Java
-
Kotlin
@Configuration
@EnableWebFluxSecurity
public class OAuth2ClientSecurityConfig {
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http
.oauth2Client(oauth2 -> oauth2
.authorizationRequestRepository(this.authorizationRequestRepository())
...
);
return http.build();
}
}@Configuration
@EnableWebFluxSecurity
class OAuth2ClientSecurityConfig {
@Bean
fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
http {
oauth2Client {
authorizationRequestRepository = authorizationRequestRepository()
}
}
return http.build()
}
}申请 Access Token
| 请参阅访问令牌请求/响应协议流程，了解授权码的授予。 |
的默认实现ReactiveOAuth2AccessTokenResponseClient的授权码 grant 为WebClientReactiveAuthorizationCodeTokenResponseClient，它使用WebClient用于在 Authorization Server 的令牌端点上将授权码交换为访问令牌。
这WebClientReactiveAuthorizationCodeTokenResponseClient非常灵活，因为它允许您自定义令牌请求的预处理和/或令牌响应的后处理。
自定义 Access Token 请求
如果需要自定义 Token Request 的预处理，可以提供WebClientReactiveAuthorizationCodeTokenResponseClient.setParametersConverter()使用自定义Converter<OAuth2AuthorizationCodeGrantRequest, MultiValueMap<String, String>>.
默认实现构建一个MultiValueMap<String, String>仅包含grant_type用于构建请求的标准 OAuth 2.0 访问令牌请求的参数。授权码授权所需的其他参数由WebClientReactiveAuthorizationCodeTokenResponseClient.
但是，提供自定义Converter）将允许您扩展标准 Token Request 并添加自定义参数。
如果您只想添加其他参数，则可以改为提供WebClientReactiveAuthorizationCodeTokenResponseClient.addParametersConverter()使用自定义Converter<OAuth2AuthorizationCodeGrantRequest, MultiValueMap<String, String>>它构造一个聚合Converter. |
自定义Converter必须返回预期的 OAuth 2.0 提供者可以理解的 OAuth 2.0 访问令牌请求的有效参数。 |
自定义访问令牌响应
另一方面，如果您需要自定义 Token Response 的后处理，则需要提供WebClientReactiveAuthorizationCodeTokenResponseClient.setBodyExtractor()使用自定义配置BodyExtractor<Mono<OAuth2AccessTokenResponse>, ReactiveHttpInputMessage>用于将 OAuth 2.0 访问令牌响应转换为OAuth2AccessTokenResponse.
由OAuth2BodyExtractors.oauth2AccessTokenResponse()解析响应并相应地处理错误。
自定义WebClient
或者，如果您的需求更高级，则只需提供WebClientReactiveAuthorizationCodeTokenResponseClient.setWebClient()使用自定义配置WebClient.
无论您是否自定义WebClientReactiveAuthorizationCodeTokenResponseClient或提供您自己的ReactiveOAuth2AccessTokenResponseClient，您需要对其进行配置，如以下示例所示：
-
Java
-
Kotlin
@Configuration
@EnableWebFluxSecurity
public class OAuth2ClientSecurityConfig {
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http
.oauth2Client(oauth2 -> oauth2
.authenticationManager(this.authorizationCodeAuthenticationManager())
...
);
return http.build();
}
private ReactiveAuthenticationManager authorizationCodeAuthenticationManager() {
WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
new WebClientReactiveAuthorizationCodeTokenResponseClient();
...
return new OAuth2AuthorizationCodeReactiveAuthenticationManager(accessTokenResponseClient);
}
}@Configuration
@EnableWebFluxSecurity
class OAuth2ClientSecurityConfig {
@Bean
fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
http {
oauth2Client {
authenticationManager = authorizationCodeAuthenticationManager()
}
}
return http.build()
}
private fun authorizationCodeAuthenticationManager(): ReactiveAuthenticationManager {
val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
...
return OAuth2AuthorizationCodeReactiveAuthenticationManager(accessTokenResponseClient)
}
}刷新令牌
| 请参阅 OAuth 2.0 授权框架，了解有关刷新令牌的更多详细信息。 |
刷新 Access Token
| 请参阅 Access Token 请求/响应协议流程，了解刷新令牌授予。 |
的默认实现ReactiveOAuth2AccessTokenResponseClient的 Refresh Token grant 为WebClientReactiveRefreshTokenTokenResponseClient，它使用WebClient在 Authorization Server 的令牌端点刷新访问令牌时。
这WebClientReactiveRefreshTokenTokenResponseClient非常灵活，因为它允许您自定义令牌请求的预处理和/或令牌响应的后处理。
自定义 Access Token 请求
如果需要自定义 Token Request 的预处理，可以提供WebClientReactiveRefreshTokenTokenResponseClient.setParametersConverter()使用自定义Converter<OAuth2RefreshTokenGrantRequest, MultiValueMap<String, String>>.
默认实现构建一个MultiValueMap<String, String>仅包含grant_type用于构建请求的标准 OAuth 2.0 访问令牌请求的参数。刷新令牌授权所需的其他参数由WebClientReactiveRefreshTokenTokenResponseClient.
但是，提供自定义Converter）将允许您扩展标准 Token Request 并添加自定义参数。
如果您只想添加其他参数，则可以改为提供WebClientReactiveRefreshTokenTokenResponseClient.addParametersConverter()使用自定义Converter<OAuth2RefreshTokenGrantRequest, MultiValueMap<String, String>>它构造一个聚合Converter. |
自定义Converter必须返回预期的 OAuth 2.0 提供者可以理解的 OAuth 2.0 访问令牌请求的有效参数。 |
自定义访问令牌响应
另一方面，如果您需要自定义 Token Response 的后处理，则需要提供WebClientReactiveRefreshTokenTokenResponseClient.setBodyExtractor()使用自定义配置BodyExtractor<Mono<OAuth2AccessTokenResponse>, ReactiveHttpInputMessage>用于将 OAuth 2.0 访问令牌响应转换为OAuth2AccessTokenResponse.
由OAuth2BodyExtractors.oauth2AccessTokenResponse()解析响应并相应地处理错误。
自定义WebClient
或者，如果您的需求更高级，则只需提供WebClientReactiveRefreshTokenTokenResponseClient.setWebClient()使用自定义配置WebClient.
无论您是否自定义WebClientReactiveRefreshTokenTokenResponseClient或提供您自己的ReactiveOAuth2AccessTokenResponseClient，您需要对其进行配置，如以下示例所示：
-
Java
-
Kotlin
// Customize
ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> refreshTokenTokenResponseClient = ...
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.authorizationCode()
.refreshToken(configurer -> configurer.accessTokenResponseClient(refreshTokenTokenResponseClient))
.build();
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);// Customize
val refreshTokenTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> = ...
val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.authorizationCode()
.refreshToken { it.accessTokenResponseClient(refreshTokenTokenResponseClient) }
.build()
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
ReactiveOAuth2AuthorizedClientProviderBuilder.builder().refreshToken()配置RefreshTokenReactiveOAuth2AuthorizedClientProvider,
它是ReactiveOAuth2AuthorizedClientProvider对于 Refresh Token 授权。 |
这OAuth2RefreshToken可以选择在 Access Token Response 中返回authorization_code和password授权类型。
如果OAuth2AuthorizedClient.getRefreshToken()可用，并且OAuth2AuthorizedClient.getAccessToken()已过期，则会自动由RefreshTokenReactiveOAuth2AuthorizedClientProvider.
客户端凭证
| 请参阅 OAuth 2.0 授权框架，了解有关客户端凭证授予的更多详细信息。 |
申请 Access Token
| 请参阅访问令牌请求/响应协议流程，了解客户端凭证授予。 |
的默认实现ReactiveOAuth2AccessTokenResponseClient对于 Client Credentials （客户端凭证） 授予为WebClientReactiveClientCredentialsTokenResponseClient，它使用WebClient在 Authorization Server 的令牌端点请求访问令牌时。
这WebClientReactiveClientCredentialsTokenResponseClient非常灵活，因为它允许您自定义令牌请求的预处理和/或令牌响应的后处理。
自定义 Access Token 请求
如果需要自定义 Token Request 的预处理，可以提供WebClientReactiveClientCredentialsTokenResponseClient.setParametersConverter()使用自定义Converter<OAuth2ClientCredentialsGrantRequest, MultiValueMap<String, String>>.
默认实现构建一个MultiValueMap<String, String>仅包含grant_type用于构建请求的标准 OAuth 2.0 访问令牌请求的参数。Client Credentials 授权所需的其他参数由WebClientReactiveClientCredentialsTokenResponseClient.
但是，提供自定义Converter）将允许您扩展标准 Token Request 并添加自定义参数。
如果您只想添加其他参数，则可以改为提供WebClientReactiveClientCredentialsTokenResponseClient.addParametersConverter()使用自定义Converter<OAuth2ClientCredentialsGrantRequest, MultiValueMap<String, String>>它构造一个聚合Converter. |
自定义Converter必须返回预期的 OAuth 2.0 提供者可以理解的 OAuth 2.0 访问令牌请求的有效参数。 |
自定义访问令牌响应
另一方面，如果您需要自定义 Token Response 的后处理，则需要提供WebClientReactiveClientCredentialsTokenResponseClient.setBodyExtractor()使用自定义配置BodyExtractor<Mono<OAuth2AccessTokenResponse>, ReactiveHttpInputMessage>用于将 OAuth 2.0 访问令牌响应转换为OAuth2AccessTokenResponse.
由OAuth2BodyExtractors.oauth2AccessTokenResponse()解析响应并相应地处理错误。
自定义WebClient
或者，如果您的需求更高级，则只需提供WebClientReactiveClientCredentialsTokenResponseClient.setWebClient()使用自定义配置WebClient.
无论您是否自定义WebClientReactiveClientCredentialsTokenResponseClient或提供您自己的ReactiveOAuth2AccessTokenResponseClient，您需要对其进行配置，如以下示例所示：
-
Java
-
Kotlin
// Customize
ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsTokenResponseClient = ...
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.clientCredentials(configurer -> configurer.accessTokenResponseClient(clientCredentialsTokenResponseClient))
.build();
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);// Customize
val clientCredentialsTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> = ...
val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.clientCredentials { it.accessTokenResponseClient(clientCredentialsTokenResponseClient) }
.build()
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
ReactiveOAuth2AuthorizedClientProviderBuilder.builder().clientCredentials()配置ClientCredentialsReactiveOAuth2AuthorizedClientProvider,
它是ReactiveOAuth2AuthorizedClientProvider的 Client Credentials grant（客户端凭证）授予。 |
使用 Access Token
给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：
spring:
security:
oauth2:
client:
registration:
okta:
client-id: okta-client-id
client-secret: okta-client-secret
authorization-grant-type: client_credentials
scope: read, write
provider:
okta:
token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token…和ReactiveOAuth2AuthorizedClientManager @Bean:
-
Java
-
Kotlin
@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
ReactiveClientRegistrationRepository clientRegistrationRepository,
ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.clientCredentials()
.build();
DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
new DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository);
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
return authorizedClientManager;
}@Bean
fun authorizedClientManager(
clientRegistrationRepository: ReactiveClientRegistrationRepository,
authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.clientCredentials()
.build()
val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository)
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
return authorizedClientManager
}您可以获取OAuth2AccessToken如下：
-
Java
-
Kotlin
@Controller
public class OAuth2ClientController {
@Autowired
private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;
@GetMapping("/")
public Mono<String> index(Authentication authentication, ServerWebExchange exchange) {
OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
.principal(authentication)
.attribute(ServerWebExchange.class.getName(), exchange)
.build();
return this.authorizedClientManager.authorize(authorizeRequest)
.map(OAuth2AuthorizedClient::getAccessToken)
...
.thenReturn("index");
}
}class OAuth2ClientController {
@Autowired
private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager
@GetMapping("/")
fun index(authentication: Authentication, exchange: ServerWebExchange): Mono<String> {
val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
.principal(authentication)
.attribute(ServerWebExchange::class.java.name, exchange)
.build()
return authorizedClientManager.authorize(authorizeRequest)
.map { it.accessToken }
...
.thenReturn("index")
}
}
ServerWebExchange是 OPTIONAL 属性。
如果未提供，它将通过密钥ServerWebExchange.class. |
资源所有者密码凭证
| 请参阅 OAuth 2.0 授权框架，了解有关资源所有者密码凭证授予的更多详细信息。 |
申请 Access Token
| 请参阅访问令牌请求/响应协议流程，了解资源所有者密码凭证授予。 |
的默认实现ReactiveOAuth2AccessTokenResponseClient对于 Resource Owner Password Credentials，grant 为WebClientReactivePasswordTokenResponseClient，它使用WebClient在 Authorization Server 的令牌端点请求访问令牌时。
这WebClientReactivePasswordTokenResponseClient非常灵活，因为它允许您自定义令牌请求的预处理和/或令牌响应的后处理。
自定义 Access Token 请求
如果需要自定义 Token Request 的预处理，可以提供WebClientReactivePasswordTokenResponseClient.setParametersConverter()使用自定义Converter<OAuth2PasswordGrantRequest, MultiValueMap<String, String>>.
默认实现构建一个MultiValueMap<String, String>仅包含grant_type用于构建请求的标准 OAuth 2.0 访问令牌请求的参数。Resource Owner Password Credentials 授予所需的其他参数由WebClientReactivePasswordTokenResponseClient.
但是，提供自定义Converter）将允许您扩展标准 Token Request 并添加自定义参数。
如果您只想添加其他参数，则可以改为提供WebClientReactivePasswordTokenResponseClient.addParametersConverter()使用自定义Converter<OAuth2PasswordGrantRequest, MultiValueMap<String, String>>它构造一个聚合Converter. |
自定义Converter必须返回预期的 OAuth 2.0 提供者可以理解的 OAuth 2.0 访问令牌请求的有效参数。 |
自定义访问令牌响应
另一方面，如果您需要自定义 Token Response 的后处理，则需要提供WebClientReactivePasswordTokenResponseClient.setBodyExtractor()使用自定义配置BodyExtractor<Mono<OAuth2AccessTokenResponse>, ReactiveHttpInputMessage>用于将 OAuth 2.0 访问令牌响应转换为OAuth2AccessTokenResponse.
由OAuth2BodyExtractors.oauth2AccessTokenResponse()解析响应并相应地处理错误。
自定义WebClient
或者，如果您的需求更高级，则只需提供WebClientReactivePasswordTokenResponseClient.setWebClient()使用自定义配置WebClient.
无论您是否自定义WebClientReactivePasswordTokenResponseClient或提供您自己的ReactiveOAuth2AccessTokenResponseClient，您需要对其进行配置，如以下示例所示：
-
Java
-
Kotlin
// Customize
ReactiveOAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> passwordTokenResponseClient = ...
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.password(configurer -> configurer.accessTokenResponseClient(passwordTokenResponseClient))
.refreshToken()
.build();
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);val passwordTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> = ...
val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.password { it.accessTokenResponseClient(passwordTokenResponseClient) }
.refreshToken()
.build()
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
ReactiveOAuth2AuthorizedClientProviderBuilder.builder().password()配置PasswordReactiveOAuth2AuthorizedClientProvider,
它是ReactiveOAuth2AuthorizedClientProvider对于 Resource Owner Password Credentials （资源所有者密码凭证） 授予。 |
使用 Access Token
给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：
spring:
security:
oauth2:
client:
registration:
okta:
client-id: okta-client-id
client-secret: okta-client-secret
authorization-grant-type: password
scope: read, write
provider:
okta:
token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token…和ReactiveOAuth2AuthorizedClientManager @Bean:
-
Java
-
Kotlin
@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
ReactiveClientRegistrationRepository clientRegistrationRepository,
ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.password()
.refreshToken()
.build();
DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
new DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository);
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
// Assuming the `username` and `password` are supplied as `ServerHttpRequest` parameters,
// map the `ServerHttpRequest` parameters to `OAuth2AuthorizationContext.getAttributes()`
authorizedClientManager.setContextAttributesMapper(contextAttributesMapper());
return authorizedClientManager;
}
private Function<OAuth2AuthorizeRequest, Mono<Map<String, Object>>> contextAttributesMapper() {
return authorizeRequest -> {
Map<String, Object> contextAttributes = Collections.emptyMap();
ServerWebExchange exchange = authorizeRequest.getAttribute(ServerWebExchange.class.getName());
ServerHttpRequest request = exchange.getRequest();
String username = request.getQueryParams().getFirst(OAuth2ParameterNames.USERNAME);
String password = request.getQueryParams().getFirst(OAuth2ParameterNames.PASSWORD);
if (StringUtils.hasText(username) && StringUtils.hasText(password)) {
contextAttributes = new HashMap<>();
// `PasswordReactiveOAuth2AuthorizedClientProvider` requires both attributes
contextAttributes.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
contextAttributes.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
}
return Mono.just(contextAttributes);
};
}@Bean
fun authorizedClientManager(
clientRegistrationRepository: ReactiveClientRegistrationRepository,
authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.password()
.refreshToken()
.build()
val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository)
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
// Assuming the `username` and `password` are supplied as `ServerHttpRequest` parameters,
// map the `ServerHttpRequest` parameters to `OAuth2AuthorizationContext.getAttributes()`
authorizedClientManager.setContextAttributesMapper(contextAttributesMapper())
return authorizedClientManager
}
private fun contextAttributesMapper(): Function<OAuth2AuthorizeRequest, Mono<MutableMap<String, Any>>> {
return Function { authorizeRequest ->
var contextAttributes: MutableMap<String, Any> = mutableMapOf()
val exchange: ServerWebExchange = authorizeRequest.getAttribute(ServerWebExchange::class.java.name)!!
val request: ServerHttpRequest = exchange.request
val username: String? = request.queryParams.getFirst(OAuth2ParameterNames.USERNAME)
val password: String? = request.queryParams.getFirst(OAuth2ParameterNames.PASSWORD)
if (StringUtils.hasText(username) && StringUtils.hasText(password)) {
contextAttributes = hashMapOf()
// `PasswordReactiveOAuth2AuthorizedClientProvider` requires both attributes
contextAttributes[OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME] = username!!
contextAttributes[OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME] = password!!
}
Mono.just(contextAttributes)
}
}您可以获取OAuth2AccessToken如下：
-
Java
-
Kotlin
@Controller
public class OAuth2ClientController {
@Autowired
private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;
@GetMapping("/")
public Mono<String> index(Authentication authentication, ServerWebExchange exchange) {
OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
.principal(authentication)
.attribute(ServerWebExchange.class.getName(), exchange)
.build();
return this.authorizedClientManager.authorize(authorizeRequest)
.map(OAuth2AuthorizedClient::getAccessToken)
...
.thenReturn("index");
}
}@Controller
class OAuth2ClientController {
@Autowired
private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager
@GetMapping("/")
fun index(authentication: Authentication, exchange: ServerWebExchange): Mono<String> {
val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
.principal(authentication)
.attribute(ServerWebExchange::class.java.name, exchange)
.build()
return authorizedClientManager.authorize(authorizeRequest)
.map { it.accessToken }
...
.thenReturn("index")
}
}
ServerWebExchange是 OPTIONAL 属性。
如果未提供，它将通过密钥ServerWebExchange.class. |
JWT 持有者
| 有关 JWT 不记名授权的更多详细信息，请参阅 OAuth 2.0 客户端身份验证和授权的 JSON Web 令牌 （JWT） 配置文件。 |
申请 Access Token
| 请参阅 JWT Bearer 授权的访问令牌请求/响应协议流程。 |
的默认实现ReactiveOAuth2AccessTokenResponseClient对于 JWT Bearer 授权为WebClientReactiveJwtBearerTokenResponseClient，它使用WebClient在 Authorization Server 的令牌端点请求访问令牌时。
这WebClientReactiveJwtBearerTokenResponseClient非常灵活，因为它允许您自定义令牌请求的预处理和/或令牌响应的后处理。
自定义 Access Token 请求
如果需要自定义 Token Request 的预处理，可以提供WebClientReactiveJwtBearerTokenResponseClient.setParametersConverter()使用自定义Converter<JwtBearerGrantRequest, MultiValueMap<String, String>>.
默认实现构建一个MultiValueMap<String, String>仅包含grant_type用于构建请求的标准 OAuth 2.0 访问令牌请求的参数。JWT Bearer 授权所需的其他参数由WebClientReactiveJwtBearerTokenResponseClient.
但是，提供自定义Converter）将允许您扩展标准 Token Request 并添加自定义参数。
如果您只想添加其他参数，则可以改为提供WebClientReactiveJwtBearerTokenResponseClient.addParametersConverter()使用自定义Converter<JwtBearerGrantRequest, MultiValueMap<String, String>>它构造一个聚合Converter. |
自定义Converter必须返回预期的 OAuth 2.0 提供者可以理解的 OAuth 2.0 访问令牌请求的有效参数。 |
自定义访问令牌响应
另一方面，如果您需要自定义 Token Response 的后处理，则需要提供WebClientReactiveJwtBearerTokenResponseClient.setBodyExtractor()使用自定义配置BodyExtractor<Mono<OAuth2AccessTokenResponse>, ReactiveHttpInputMessage>用于将 OAuth 2.0 访问令牌响应转换为OAuth2AccessTokenResponse.
由OAuth2BodyExtractors.oauth2AccessTokenResponse()解析响应并相应地处理错误。
自定义WebClient
或者，如果您的需求更高级，则只需提供WebClientReactiveJwtBearerTokenResponseClient.setWebClient()使用自定义配置WebClient.
无论您是否自定义WebClientReactiveJwtBearerTokenResponseClient或提供您自己的ReactiveOAuth2AccessTokenResponseClient，您需要对其进行配置，如以下示例所示：
-
Java
-
Kotlin
// Customize
ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> jwtBearerTokenResponseClient = ...
JwtBearerReactiveOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider = new JwtBearerReactiveOAuth2AuthorizedClientProvider();
jwtBearerAuthorizedClientProvider.setAccessTokenResponseClient(jwtBearerTokenResponseClient);
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.provider(jwtBearerAuthorizedClientProvider)
.build();
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);// Customize
val jwtBearerTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> = ...
val jwtBearerAuthorizedClientProvider = JwtBearerReactiveOAuth2AuthorizedClientProvider()
jwtBearerAuthorizedClientProvider.setAccessTokenResponseClient(jwtBearerTokenResponseClient)
val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.provider(jwtBearerAuthorizedClientProvider)
.build()
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)使用 Access Token
给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：
spring:
security:
oauth2:
client:
registration:
okta:
client-id: okta-client-id
client-secret: okta-client-secret
authorization-grant-type: urn:ietf:params:oauth:grant-type:jwt-bearer
scope: read
provider:
okta:
token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token…和OAuth2AuthorizedClientManager @Bean:
-
Java
-
Kotlin
@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
ReactiveClientRegistrationRepository clientRegistrationRepository,
ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {
JwtBearerReactiveOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider =
new JwtBearerReactiveOAuth2AuthorizedClientProvider();
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.provider(jwtBearerAuthorizedClientProvider)
.build();
DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
new DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository);
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
return authorizedClientManager;
}@Bean
fun authorizedClientManager(
clientRegistrationRepository: ReactiveClientRegistrationRepository,
authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
val jwtBearerAuthorizedClientProvider = JwtBearerReactiveOAuth2AuthorizedClientProvider()
val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.provider(jwtBearerAuthorizedClientProvider)
.build()
val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository)
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
return authorizedClientManager
}您可以获取OAuth2AccessToken如下：
-
Java
-
Kotlin
@RestController
public class OAuth2ResourceServerController {
@Autowired
private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;
@GetMapping("/resource")
public Mono<String> resource(JwtAuthenticationToken jwtAuthentication, ServerWebExchange exchange) {
OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
.principal(jwtAuthentication)
.build();
return this.authorizedClientManager.authorize(authorizeRequest)
.map(OAuth2AuthorizedClient::getAccessToken)
...
}
}class OAuth2ResourceServerController {
@Autowired
private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager
@GetMapping("/resource")
fun resource(jwtAuthentication: JwtAuthenticationToken, exchange: ServerWebExchange): Mono<String> {
val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
.principal(jwtAuthentication)
.build()
return authorizedClientManager.authorize(authorizeRequest)
.map { it.accessToken }
...
}
}
JwtBearerReactiveOAuth2AuthorizedClientProvider解决Jwtassertion viaOAuth2AuthorizationContext.getPrincipal().getPrincipal()默认情况下，因此使用JwtAuthenticationToken在前面的示例中。 |
如果您需要解决Jwtassertion 的 Assertion 中，您可以提供JwtBearerReactiveOAuth2AuthorizedClientProvider.setJwtAssertionResolver()使用自定义Function<OAuth2AuthorizationContext, Mono<Jwt>>. |
代币兑换
| 请参阅 OAuth 2.0 Token Exchange，了解有关 Token Exchange 授权的更多详细信息。 |
申请 Access Token
| 请参阅 Token Exchange 请求和响应协议流程，了解 Token Exchange 授权。 |
的默认实现ReactiveOAuth2AccessTokenResponseClient对于 Token Exchange 授权为WebClientReactiveTokenExchangeTokenResponseClient，它使用WebClient在 Authorization Server 的令牌端点请求访问令牌时。
这WebClientReactiveTokenExchangeTokenResponseClient非常灵活，因为它允许您自定义令牌请求的预处理和/或令牌响应的后处理。
自定义 Access Token 请求
如果需要自定义 Token Request 的预处理，可以提供WebClientReactiveTokenExchangeTokenResponseClient.setParametersConverter()使用自定义Converter<TokenExchangeGrantRequest, MultiValueMap<String, String>>.
默认实现构建一个MultiValueMap<String, String>仅包含grant_type用于构建请求的标准 OAuth 2.0 访问令牌请求的参数。
Token Exchange 授权所需的其他参数由WebClientReactiveTokenExchangeTokenResponseClient.
但是，提供自定义Converter）将允许您扩展标准 Token Request 并添加自定义参数。
如果您只想添加其他参数，则可以改为提供WebClientReactiveTokenExchangeTokenResponseClient.addParametersConverter()使用自定义Converter<TokenExchangeGrantRequest, MultiValueMap<String, String>>它构造一个聚合Converter. |
自定义Converter必须返回预期的 OAuth 2.0 提供者可以理解的 OAuth 2.0 访问令牌请求的有效参数。 |
自定义访问令牌响应
另一方面，如果您需要自定义 Token Response 的后处理，则需要提供WebClientReactiveTokenExchangeTokenResponseClient.setBodyExtractor()使用自定义配置BodyExtractor<Mono<OAuth2AccessTokenResponse>, ReactiveHttpInputMessage>用于将 OAuth 2.0 访问令牌响应转换为OAuth2AccessTokenResponse.
由OAuth2BodyExtractors.oauth2AccessTokenResponse()解析响应并相应地处理错误。
自定义WebClient
或者，如果您的需求更高级，则只需提供WebClientReactiveTokenExchangeTokenResponseClient.setWebClient()使用自定义配置WebClient.
无论您是否自定义WebClientReactiveTokenExchangeTokenResponseClient或提供您自己的ReactiveOAuth2AccessTokenResponseClient，您需要对其进行配置，如以下示例所示：
-
Java
-
Kotlin
// Customize
ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> tokenExchangeTokenResponseClient = ...
TokenExchangeReactiveOAuth2AuthorizedClientProvider tokenExchangeAuthorizedClientProvider = new TokenExchangeReactiveOAuth2AuthorizedClientProvider();
tokenExchangeAuthorizedClientProvider.setAccessTokenResponseClient(tokenExchangeTokenResponseClient);
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.provider(tokenExchangeAuthorizedClientProvider)
.build();
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);// Customize
val tokenExchangeTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> = ...
val tokenExchangeAuthorizedClientProvider = TokenExchangeReactiveOAuth2AuthorizedClientProvider()
tokenExchangeAuthorizedClientProvider.setAccessTokenResponseClient(tokenExchangeTokenResponseClient)
val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.provider(tokenExchangeAuthorizedClientProvider)
.build()
...
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)使用 Access Token
给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：
spring:
security:
oauth2:
client:
registration:
okta:
client-id: okta-client-id
client-secret: okta-client-secret
authorization-grant-type: urn:ietf:params:oauth:grant-type:token-exchange
scope: read
provider:
okta:
token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token…和OAuth2AuthorizedClientManager @Bean:
-
Java
-
Kotlin
@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
ReactiveClientRegistrationRepository clientRegistrationRepository,
ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {
TokenExchangeReactiveOAuth2AuthorizedClientProvider tokenExchangeAuthorizedClientProvider =
new TokenExchangeReactiveOAuth2AuthorizedClientProvider();
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.provider(tokenExchangeAuthorizedClientProvider)
.build();
DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
new DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository);
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
return authorizedClientManager;
}@Bean
fun authorizedClientManager(
clientRegistrationRepository: ReactiveClientRegistrationRepository,
authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
val tokenExchangeAuthorizedClientProvider = TokenExchangeReactiveOAuth2AuthorizedClientProvider()
val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.provider(tokenExchangeAuthorizedClientProvider)
.build()
val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository)
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
return authorizedClientManager
}您可以获取OAuth2AccessToken如下：
-
Java
-
Kotlin
@RestController
public class OAuth2ResourceServerController {
@Autowired
private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;
@GetMapping("/resource")
public Mono<String> resource(JwtAuthenticationToken jwtAuthentication) {
OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
.principal(jwtAuthentication)
.build();
return this.authorizedClientManager.authorize(authorizeRequest)
.map(OAuth2AuthorizedClient::getAccessToken)
...
}
}class OAuth2ResourceServerController {
@Autowired
private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager
@GetMapping("/resource")
fun resource(jwtAuthentication: JwtAuthenticationToken): Mono<String> {
val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
.principal(jwtAuthentication)
.build()
return authorizedClientManager.authorize(authorizeRequest)
.map { it.accessToken }
...
}
}
TokenExchangeReactiveOAuth2AuthorizedClientProvider解析主题令牌（作为OAuth2Token） 通过OAuth2AuthorizationContext.getPrincipal().getPrincipal()默认情况下，因此使用JwtAuthenticationToken在前面的示例中。
默认情况下，不会解析角色令牌。 |
如果需要从其他来源解析主题令牌，可以提供TokenExchangeReactiveOAuth2AuthorizedClientProvider.setSubjectTokenResolver()使用自定义Function<OAuth2AuthorizationContext, Mono<OAuth2Token>>. |
如果需要解析 actor 令牌，可以提供TokenExchangeReactiveOAuth2AuthorizedClientProvider.setActorTokenResolver()使用自定义Function<OAuth2AuthorizationContext, Mono<OAuth2Token>>. |