Spring Boot、authorization_code、IdentityServer4 code_verifier

Question

我已经在 Spring Boot 项目中集成了 IdentityServer4。

我想知道如何添加code_verifier来调用IdentityServer的“/connect/token”？

我在重定向网址中收到如下代码，

第一次重定向： https://idsrv4test.com/connect/authorize?response_type=code&client_id=client_id&scope=id_number%20openid%20email%20roles%20profile&state=SDGHMnvw0UJZyylFr752jBAWS2ahGIwBiavF0YsRtoI%3D&redirect_uri=https://127.0.0.1:9443/signin-oidc&code_challenge_method=S256&nonce=_8fJthx0jlqX_2tJKSkwvs_r4RfxIjU4NokGGpSZIF0&code_challenge=

第二次重定向 https://127.0.0.1:9443/signin-oidc?code=returned_code&scope=id_number%20openid%20email%20roles%20profile&state=9KxStmaCkre_-cCqofOSfRO0eWahh-3e19upwYH1rJ8%3D&session_state=Sm-Zq8GcrX43Rc1Ve5elO7ua90aIyXTkJB6lT4tQRhY.ImGYr6V2186LxSMZdLcngg

我在我的项目中构造了一个resttemplate来调用“/connect/token”

POST /connect/token CONTENT-TYPE application/x-www-form-urlencoded

client_id=client_id&
client_secret=secret&
grant_type=authorization_code&
code=returned_code&
redirect_uri=https://127.0.0.1:9443/signin-oidc
code_verifier=<this_encrypted_text>

在 requestBody 中我设置了 code_verifier= 但我得到“invalid_grant”。这意味着根据规范文档https://datatracker.ietf.org/doc/html/rfc7636#page-10 code_verifier == code_challenge。是闪光

供您参考 SecurityConfig 类是这样的

@EnableWebSecurity
public class ConfigSecurity extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {


        PortMapperImpl portMapper = new PortMapperImpl();
        portMapper.setPortMappings(Collections.singletonMap("9443","9443"));
        PortResolverImpl portResolver = new PortResolverImpl();
        portResolver.setPortMapper(portMapper);
        LoginUrlAuthenticationEntryPoint entryPoint = new LoginUrlAuthenticationEntryPoint(
                "/login");
        entryPoint.setPortMapper(portMapper);
        entryPoint.setPortResolver(portResolver);
        http.exceptionHandling()
                .authenticationEntryPoint(entryPoint)
                .and()
                .authorizeRequests()
                .antMatchers("/login","/css/*", "/images/*","/signin-oidc","/test")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .oauth2Login()
                .loginPage("/login")
                .and()
                .logout().logoutUrl("/logout")
                .logoutSuccessHandler(oidcLogoutSuccessHandler());


    }

    @Autowired
    private ClientRegistrationRepository clientRegistrationRepository;

    private LogoutSuccessHandler oidcLogoutSuccessHandler() {

        OidcClientInitiatedLogoutSuccessHandler oidcLogoutSuccessHandler =
                new OidcClientInitiatedLogoutSuccessHandler(
                        this.clientRegistrationRepository);

        oidcLogoutSuccessHandler.setPostLogoutRedirectUri(
                URI.create("http://localhost:9443"));

        return oidcLogoutSuccessHandler;
    }
}

而我的application.yml如下，

server:
  port: 9443
  ssl:
    key-store: classpath:asif1.jks
    key-store-password: xxxxx
    key-store-type: pkcs12
    key-store-alias: server
spring:
  security:
    oauth2:
      client:
        registration:
          idsrv4:
            client-name: client_name_test
            client-id: client_id_test
            client-secret: Marines
            client-authentication-method: none
            authorization-grant-type: authorization_code
            redirect-uri: "https://127.0.0.1:9443/signin-oidc"

            scope: "id_number,openid,email,roles,profile"


        provider:
          idsrv4:
            authorization-uri: https://idsrv4test.com/connect/authorize
            issuer-uri: https://idsrv4test.com
            token-uri: https://idsrv4test.com/connect/token
            user-info-uri: https://idsrv4test.com/connect/userinfo
            user-name-attribute: sub
            jwk-set-uri: https://idsrv4test.com/.well-known/openid-configuration/jwks

有什么帮助吗？

Answer 1

我终于解决了这个问题。但仍然对方法不满意。它仍然优雅地工作。我对 OAuth2AuthorizationRequestResolver 的期望是，获取 jwt 令牌的请求是在内部创建的，我应该不知道生成为 code_challenge（以实现 PKCE）的随机字符串。

如果有人有一个验证和获取令牌的工作示例，我仍然请求分享，只需提供所需的配置，而无需我实现和覆盖 OAuth2AuthorizationRequestResolver。 所以，我来了

要实现 OAuth2AuthorizationRequestResolver，请关注https://developer.okta.com/blog/2020/01/23/pkce-oauth2-spring-boot

然后在方法addPkceParameters

     String codeVerifier = this.secureKeyGenerator.generateKey();
    attributes.put(PkceParameterNames.CODE_VERIFIER, codeVerifier);

codeVerifier 是我们需要与 /connect/token 的请求一起发送的字符串

现在，如何在控制器中获取这个随机生成的字符串来发送请求完全取决于您。

我已经对其进行了硬编码；-) 暂时。但我知道这不符合 PKCE 的目的。

另外，在扩展 WebSecurityConfigurerAdapter 的类中，configure(HttpSecurity http) 方法必须包含“/oauth2/authorization”作为基本 url

像这样的

http.exceptionHandling()
                .authenticationEntryPoint(entryPoint)
                .and()
                .authorizeRequests()
                .antMatchers("/login","/css/*", "/static/**", "/images/*","/test","/signin-oidc","/logoutSession")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .oauth2Login()
                .authorizationEndpoint()
                .authorizationRequestResolver(new CustomAuthorizationRequestResolver(
                        clientRegistrationRepository, "/oauth2/authorization"
                ))
                .and()
                .loginPage("/login").and().logout().logoutUrl("/logout")
                .logoutSuccessHandler(oidcLogoutSuccessHandler());