Spring OAuth2 授权服务器多 JWK 密钥管理与多租户实践

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver;
import org.springframework.security.web.SecurityFilterChain;

import java.util.HashMap;
import java.util.Map;

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        // 配置一个 Map，将发行者 URI 映射到其对应的 JwtAuthenticationProvider
        Map<String, JwtAuthenticationProvider> authenticationProviders = new HashMap<>();

        // 假设有两个授权服务器实例，分别位于不同的 URI
        // AS-1
        authenticationProviders.put("https://as1.example.com", new JwtAuthenticationProvider(
            // 这里可以配置 JwtDecoder，例如从 https://as1.example.com/.well-known/jwks.json 获取密钥
            // 实际应用中，JwtDecoder 通常通过 OAuth2ResourceServerConfigurer.jwt() 自动配置
            // 或者自定义 JwtDecoder bean
            // For simplicity, we create a basic JwtAuthenticationProvider
            // In a real app, you'd configure the JwtDecoder more robustly
            // e.g., using NimbusJwtDecoder.withJwkSetUri("https://as1.example.com/oauth2/jwks").build()
            // Here we just use a placeholder.
            // Note: Directly instantiating JwtAuthenticationProvider might not be ideal.
            // A more robust approach is to configure JwtDecoder per issuer.
            // The JwtIssuerAuthenticationManagerResolver handles this internally if configured correctly.
            // For demonstration, let's assume JwtDecoder is implicitly handled by the resolver.
            // A better way is to use a lambda or method reference to create AuthenticationManager per issuer.
            // For JwtIssuerAuthenticationManagerResolver, you usually pass a Function<String, AuthenticationManager>
            // or a Map<String, AuthenticationManager>.

            // Correct approach for JwtIssuerAuthenticationManagerResolver:
            // Define a function that creates an AuthenticationManager for a given issuer
            issuer -> {
                // Here, you would create a JwtDecoder for the specific issuer
                // For example:
                // JwtDecoder decoder = NimbusJwtDecoder.withIssuerLocation(issuer).build();
                // JwtAuthenticationProvider provider = new JwtAuthenticationProvider(decoder);
                // provider.setJwtAuthenticationConverter(new JwtAuthenticationConverter());
                // return provider;
                // For simplicity, let's just return a placeholder.
                // Spring Boot's auto-configuration for resource servers can simplify this.
                // The resolver will internally manage decoders for known issuers.
                return null; // This will be handled by the resolver's internal logic
            }
        ));

        // AS-2
        authenticationProviders.put("https://as2.example.com", new JwtAuthenticationProvider(
            // Similar JwtDecoder configuration for AS-2
            issuer -> null // Placeholder
        ));

        // 构造 JwtIssuerAuthenticationManagerResolver
        // Spring Security 6+ 推荐使用 Lambda 表达式或方法引用来创建 AuthenticationManager
        // for each issuer, rather than pre-creating providers in a map.
        // This allows dynamic creation and caching.
        JwtIssuerAuthenticationManagerResolver authenticationManagerResolver =
                new JwtIssuerAuthenticationManagerResolver(
                        issuer -> {
                            // This function is called for each unique issuer found in a JWT.
                            // You can dynamically configure a JwtDecoder for this issuer.
                            // For example, fetch JWKS from issuer + "/oauth2/jwks"
                            // Or from .well-known/openid-configuration
                            return new JwtAuthenticationProvider(
                                    // NimbusJwtDecoder.withIssuerLocation(issuer).build() is a common way
                                    // It automatically discovers JWKS URI from .well-known/openid-configuration
                                    // or assumes /oauth2/jwks if not specified.
                                    // For this example, let's assume it works.
                                    // Make sure to add a JwtAuthenticationConverter if you need custom authority mapping.
                                    // JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
                                    // return new ProviderManager(new JwtAuthenticationProvider(NimbusJwtDecoder.withIssuerLocation(issuer).build()));
                                    // For simplicity, let's return a simple JwtAuthenticationProvider for now.
                                    // In a real application, you'd use a more robust JwtDecoder.
                                    NimbusJwtDecoder.withIssuerLocation(issuer).build()
                            );
                        },
                        // You can also provide a list of trusted issuers directly.
                        // Or use a Map<String, AuthenticationManager> if you have static configurations.
                        // For dynamic discovery, the Function<String, AuthenticationManager> is more flexible.
                        "https://as1.example.com", "https://as2.example.com" // List of trusted issuers
                );


        http
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .authenticationManagerResolver(authenticationManagerResolver)
            ); // 将解析器应用到资源服务器配置

        return http.build();
    }
}

<dependency>
    <groupId>com.c4-soft.springaddons</groupId>
    <!-- 如果是 WebMVC 应用，使用 "webmvc" -->
    <!-- 如果是 WebFlux 应用，使用 "weblux" -->
    <!-- 如果使用 Token Introspection 而非 JWT 解码，使用 "introspecting" -->
    <artifactId>spring-addons-webmvc-jwt-resource-server</artifactId>
    <!-- 请根据您的 Spring Boot 版本选择合适的库版本 -->
    <!-- 例如，Spring Boot 3.0.0+ 使用 6.x 版本 -->
    <version>6.0.7</version>
</dependency>

# 启用方法安全
spring.security.oauth2.resourceserver.jwt.jwk-set-uri=
# 如果使用 spring-addons，可以清空默认的 jwk-set-uri，由 addons 管理

# 配置第一个发行者 (AS-1)
com.c4-soft.springaddons.security.issuers[0].location=https://as1.example.com
com.c4-soft.springaddons.security.issuers[0].authorities.claims=groups,roles # 从哪些 JWT 声明中提取权限

# 配置第二个发行者 (AS-2)
com.c4-soft.springaddons.security.issuers[1].location=https://as2.example.com
com.c4-soft.springaddons.security.issuers[1].authorities.claims=groups,roles

# 其他安全配置，例如 CORS
com.c4-soft.springaddons.security.cors[0].path=/some-api

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

@Configuration
@EnableMethodSecurity // 启用方法级别的安全注解，如 @PreAuthorize
public class WebSecurityConfig { }