Spring Boot应用中的用户认证策略：JWT与OAuth2的协同

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                // 允许特定路径公开访问，例如健康检查、文档等
                .requestMatchers("/api/public/**").permitAll()
                // 所有其他请求都需要认证
                .anyRequest().authenticated()
            )
            // 配置OAuth2资源服务器，默认使用JWT验证
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(Customizer.withDefaults())
            );
        // 如果需要，可以禁用CSRF，因为JWT是无状态的
        // http.csrf(csrf -> csrf.disable());
        return http.build();
    }

    // Spring Boot会自动配置JwtDecoder，通过 'spring.security.oauth2.resourceserver.jwt.issuer-uri' 或 'jwk-set-uri'
    // 如果需要更复杂的JWT解析，可以自定义JwtDecoder Bean
    // @Bean
    // public JwtDecoder jwtDecoder() {
    //     // 例如，从特定的JWK Set URI加载
    //     return NimbusJwtDecoder.withJwkSetUri("YOUR_AUTHORIZATION_SERVER_JWKS_URI").build();
    // }
}

spring.security.oauth2.resourceserver.jwt.issuer-uri=http://localhost:8080/realms/your-realm # Keycloak示例
# 或者
# spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:8080/realms/your-realm/protocol/openid-connect/certs

spring:
  security:
    oauth2:
      client:
        registration:
          google: # 注册一个名为 'google' 的OAuth2客户端
            client-id: your-google-client-id
            client-secret: your-google-client-secret
            scope: openid,profile,email # 请求的权限范围
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}" # 回调URI
            client-name: Google
            authorization-grant-type: authorization_code # 授权码流
          # 您也可以配置自定义授权服务器
          my-auth-server:
            client-id: my-client-id
            client-secret: my-client-secret
            scope: openid,api.read,api.write
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            client-name: My Auth Server
            authorization-grant-type: authorization_code
        provider:
          google: # 配置Google授权服务器的端点
            authorization-uri: https://accounts.google.com/o/oauth2/v2/auth
            token-uri: https://oauth2.googleapis.com/token
            user-info-uri: https://openidconnect.googleapis.com/v1/userinfo
            jwk-set-uri: https://www.googleapis.com/oauth2/v3/certs
            user-name-attribute: sub # 用于获取用户名的属性
          my-auth-server: # 配置自定义授权服务器的端点
            issuer-uri: http://localhost:8080/realms/your-realm # OpenID Connect Issuer URI

import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;

import java.util.Map;

@Controller
public class HomeController {

    @GetMapping("/")
    public String home(@AuthenticationPrincipal OAuth2User oauth2User, Model model) {
        if (oauth2User != null) {
            model.addAttribute("userName", oauth2User.getAttribute("name"));
            model.addAttribute("userAttributes", oauth2User.getAttributes());
        } else {
            model.addAttribute("userName", "Guest");
        }
        return "index"; // 返回一个Thymeleaf模板
    }

    @GetMapping("/userinfo")
    public Map<String, Object> getUserInfo(@AuthenticationPrincipal OAuth2User oauth2User) {
        return oauth2User.getAttributes();
    }
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
import org.springframework.web.reactive.function.client.WebClient;

@Configuration
public class WebClientConfig {

    @Bean
    WebClient webClient(OAuth2AuthorizedClientManager authorizedClientManager) {
        return WebClient.builder()
                .filter(oauth2ClientFilter(authorizedClientManager)) // 添加OAuth2客户端过滤器
                .build();
    }

    // 配置OAuth2AuthorizedClientManager以获取和刷新令牌
    @Bean
    public OAuth2AuthorizedClientManager authorizedClientManager(
            ClientRegistrationRepository clientRegistrationRepository,
            OAuth2AuthorizedClientRepository authorizedClientRepository) {
        OAuth2AuthorizedClientProvider authorizedClientProvider =
                OAuth2AuthorizedClientProviderBuilder.builder()
                        .authorizationCode()
                        .refreshToken()
                        .clientCredentials()
                        .password()
                        .build();
        DefaultOAuth2AuthorizedClientManager authorizedClientManager =
                new DefaultOAuth2AuthorizedClientManager(
                        clientRegistrationRepository, authorizedClientRepository);
        authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
        return authorizedClientManager;
    }

    // WebClient过滤器，用于将访问令牌添加到请求头
    private org.springframework.web.reactive.function.client.ExchangeFilterFunction oauth2ClientFilter(
            OAuth2AuthorizedClientManager authorizedClientManager) {
        return (request, next) -> {
            // 这里需要根据实际情况获取当前用户的OAuth2AuthorizedClient
            // 通常可以通过SecurityContextHolder获取当前认证用户的Principal
            // 并使用authorizedClientManager.authorize(OAuth2AuthorizeRequest)来获取或刷新令牌
            // 简化示例：假设我们总是使用某个注册ID的令牌
            // 实际应用中需要更复杂的逻辑来关联用户和其OAuth2AuthorizedClient
            // 例如，从SecurityContext中获取OAuth2AuthenticationToken
            // String clientRegistrationId = "google"; // 或从请求中动态获取
            // OAuth2AuthorizedClient authorizedClient = authorizedClientManager.authorize(
            //     OAuth2AuthorizeRequest.withClientRegistrationId(clientRegistrationId)
            //         .principal(SecurityContextHolder.getContext().getAuthentication())
            //         .build());
            // if (authorizedClient != null && authorizedClient.getAccessToken() != null) {
            //     request = WebClient.RequestHeadersSpec::header(HttpHeaders.AUTHORIZATION,
            //         "Bearer " + authorizedClient.getAccessToken().getTokenValue());
            // }
            return next.exchange(request);
        };
    }
}