使用 Spring Security 使用 Oauth2 客户端自定义状态参数答案

【问题标题】：customize state parameter with Oauth2client using spring security使用 Spring Security 使用 Oauth2 客户端自定义状态参数
【发布时间】：2021-05-12 20:30:08
【问题描述】：

我想使用 Spring Security OIDC 通过 Oauth2client 自定义状态参数。我正在使用弹簧反应。问题是我无法在客户端注册中添加自定义状态。下面是我的安全配置。

@Bean
    SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        return http
                .authorizeExchange()
                .pathMatchers("/","/jwt").permitAll()
                .anyExchange().authenticated().and()
                .oauth2Client()
                .build();
    }

@Bean
    public ReactiveClientRegistrationRepository reactiveClientRegistrationRepository(RegisteredClients clients) {
        List<ClientRegistration> clientRegistrations = clients.getClients()
                .entrySet().stream()
                .map(clientRegistration -> {
                    String registrationId = clientRegistration.getKey();
                    RegisteredClients.OAuthClient client = clientRegistration.getValue();

                    return ClientRegistration.withRegistrationId(registrationId)
                            .clientId(client.getClientId())
                            .clientSecret(client.getClientSecret())
                            .redirectUriTemplate(client.getRedirectUri())
                            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                            .tokenUri(client.getTokenUri())
                            .authorizationUri(client.getAuthorizationUri())
                            .scope("openid")
                            .build();
                })
                .collect(toList());
        return new InMemoryReactiveClientRegistrationRepository(clientRegistrations);
    }

【问题讨论】：

标签： spring spring-security openid-connect

【解决方案1】：

要自定义授权请求，您应该发送ServerAuthorizationRequestResolver：

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    return http
        // ...
        .oauth2Client((oauth2) -> oauth2
            .authorizationEndpoint((authorization) -> authorization
                .authorizationRequestResolver(authorizationRequestResolver)
            )
        )
        .build();
}

@Bean
OAuth2ServerAuthorizationRequestResolver authorizationRequestResolver
    (ReactiveClientRegistrationRepository registrations) {

    DefaultServerOAuth2AuthorizationRequestResolver resolver = 
        new DefaultServerOAuth2AuthorizationRequestResolver(registrations);
    resolver.setAuthorizationRequestCustomizer((request) -> request.state(...));
    return resolver;
}

Spring Security 的 some related servlet documentation 也可能有用。

【讨论】：