403 禁止在访问 Okta Userinfo 端点时使用 Springboot

Question

我正在尝试将 Okta 设置为我的 Spring Boot 应用程序中一组子路径的登录。 我正在配置身份验证资源详细信息：

    @Bean(name = "oktaOAuthClient")
public AuthorizationCodeResourceDetails oktaOAuthAdminClient(@Qualifier("oktaAdminConfiguration") OktaConfigurationProperties oktaAdminCongfig,
        ICredentialsApi credentialsApi) {
    String redirectUrl = UriComponentsBuilder.fromUriString("http://localhost:8091/")
            .path(ConfigurationRequestPaths.ADMINISTRATION_LANDING)
            .build(false)
            .toUriString();

    AuthorizationCodeResourceDetails client = new AuthorizationCodeResourceDetails();

    client.setClientId(oktaAdminCongfig.getClientId());
    client.setClientSecret(oktaAdminCongfig.getClientSecret());
    client.setAccessTokenUri(oktaAdminCongfig.getAccessTokenUri());
    client.setUserAuthorizationUri(oktaAdminCongfig.getUserAuthorizationUri());
    client.setClientAuthenticationScheme(AuthenticationScheme.header);
    client.setPreEstablishedRedirectUri(redirectUrl);
    client.setScope(OKTA_SCOPES);
    client.setUseCurrentUri(false);

    client.setScope(OKTA_SCOPES);

    return client;
}

这些和其他设置是从application.properties手动找到的，设置为：

okta.admin.clientId={id}
okta.admin.clientSecret={secret}
okta.admin.accessTokenUri=https://dev-{value}.okta.com/oauth2/default/v1/token
okta.admin.userAuthorizationUri=https://dev-{value}.okta.com/oauth2/default/v1/authorize
okta.admin.issuer=https://dev-{value}.okta.com/oauth2/default
okta.admin.userInfoUrl=https://dev-{value}.okta.com/oauth2/default/v1/userinfo 

然后我做了一个过滤器（注意，在 UserTokenInfoServices 中设置的 clientId 是否意味着来自 okta 客户端 ID/客户端密钥的客户端 ID？）：

@Bean(name = "oktaFilter")
public Filter oktaFilter(@Qualifier("oktaOAuthClient") AuthorizationCodeResourceDetails oktaOAuthClient,
        @Qualifier("oktaOAuthResource") ResourceServerProperties resource,
        @Qualifier("oktaOAuthRestTemplate") OAuth2RestTemplate oktaOAuthRestTemplate) {
    ExceptionMappingAuthenticationFailureHandler failureHandler = new ExceptionMappingAuthenticationFailureHandler();
    failureHandler.setDefaultFailureUrl("/");

    OAuth2ClientAuthenticationProcessingFilter filter = new OAuth2ClientAuthenticationProcessingFilter(ConfigurationRequestPaths.ADMINISTRATION_LANDING);
    UserInfoTokenServices tokenServices = new UserInfoTokenServices(resource.getUserInfoUri(), oktaOAuthClient.getClientId());

    tokenServices.setRestTemplate(oktaOAuthRestTemplate);
    filter.setRestTemplate(oktaOAuthRestTemplate);
    filter.setTokenServices(tokenServices);

    SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
    successHandler.setUseReferer(true);
    filter.setAuthenticationSuccessHandler(successHandler);
    filter.setAuthenticationFailureHandler(failureHandler);

    return filter;
}

最后，我使用以下内容设置了 WebSecurityConfigurerAdapter：

        http.antMatcher("/config/**")
                .authorizeRequests()
                .antMatchers("/config")
                .permitAll()
                .anyRequest().authenticated().and()
                .exceptionHandling()
           .authenticationEntryPoint(oktaLoginHandler)SimpleUrlAuthenticationSuccessHandler(ConfigurationRequestPaths.ADMINISTRATION_LANDING))
                .and()
                .logout().addLogoutHandler(oktaLogoutHandler).logoutSuccessUrl(externalAccessUrl).permitAll().and()
                .addFilterBefore(oktaFilter, BasicAuthenticationFilter.class);
    }

子路径的重定向工作正常并进入登录页面，但登录后出现错误提示：

org.springframework.security.authentication.BadCredentialsException: Could not obtain user details from token...Caused by: org.springframework.security.oauth2.common.exceptions.InvalidTokenException:

我认为这可能与访问 okta userinfo 端点时出现 403 有关：

Request is to process authentication
Retrieving token from https://dev-{value}.okta.com/oauth2/default/v1/token
Encoding and sending form: {grant_type=[authorization_code], code=[{code}], redirect_uri=[http://localhost:8091/config], client_id=[{id}], client_secret=[{secret}]}
HTTP GET https://dev-{value}.okta.com/oauth2/default/v1/userinfo
Accept=[application/json, application/*+json]
Response 403 

我也尝试过 okta starter，但是当与另一个 oauth 登录 github 一起使用时，它似乎会中断，以获取应用程序中的另一组子路径。我使用的 spring 版本不包括 .oauthLogin() 和其他我看过一些指南的 httpsecurity 设置。

编辑：添加我的 spring 依赖列表以获得更多说明：

org.springframework:spring-beans:5.1.20.RELEASE
org.springframework:spring-context:5.1.20.RELEASE
org.springframework:spring-jdbc:5.1.20.RELEASE
org.springframework:spring-tx:5.1.20.RELEASE
org.springframework:spring-web:5.1.20.RELEASE
org.springframework:spring-webmvc:5.1.20.RELEASE
org.springframework:spring-test:5.1.20.RELEASE
    
org.springframework.boot:spring-boot-actuator:2.1.18.RELEASE
org.springframework.boot:spring-boot-autoconfigure:2.1.18.RELEASE
org.springframework.boot:spring-boot-configuration-processor:2.1.18.RELEASE
org.springframework.boot:spring-boot-starter:2.1.18.RELEASE
org.springframework.boot:spring-boot-starter-actuator:2.1.18.RELEASE
org.springframework.boot:spring-boot-starter-security:2.1.18.RELEASE
org.springframework.boot:spring-boot-starter-thymeleaf:2.1.18.RELEASE
org.springframework.boot:spring-boot-starter-web:2.1.18.RELEASE
org.springframework.boot:spring-boot-starter-test:2.1.18.RELEASE
    
org.springframework.retry:spring-retry:1.3.1
    
org.springframework.security:spring-security-config:5.1.13.RELEASE
org.springframework.security:spring-security-core:5.1.13.RELEASE
org.springframework.security:spring-security-ldap:5.1.13.RELEASE
org.springframework.security:spring-security-web:5.1.13.RELEASE
    
org.springframework.security.oauth:spring-security-oauth2:2.3.8.RELEASE

org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure:2.1.18.RELEASE

Answer 1

听起来您可能正在使用较旧的 Spring Security OAuth 项目： spring-security-oauth?

此项目已被弃用。较新的 Spring Security OAuth2 模块很棒，它们现在是 Spring Security 中的一等公民（它们现在存在于官方项目中）。连同此Spring Boot 1.x is EoL，不再获得补丁和安全更新。

您看到的大多数指南可能都引用了较新的库（例如，.oauthLogin()）。

对于典型的 StackOverflow 回答“不要做 X”，我很抱歉，但这是我的建议：

1. 更新您的 Spring Boot 版本
2. 迁移较新的 OAuth 库
3. 然后添加您的新逻辑（更新后应该会容易得多）

如果您已经使用 Spring Boot 2 和更新的 OAuth 库，请告诉我，我们可以尝试找出您没有更新的 HttpSecurity 方法的原因。