使用脸书令牌进行身份验证的无状态RESTendpoint的Spring社交身份验证过滤器

Question

我想使用 Facebook Tokens 使用 Spring Security 来验证我的 REST 后端。您能否详细说明我如何将这种安全性集成到我的 Spring 应用程序中。

我希望使用与Spring Social Security相同的用户管理UserConnection表和本地用户表。

Answer 1

您可以从以下位置下载代码示例：

https://github.com/ozgengunay/FBSpringSocialRESTAuth

我们一直在寻找一个“Spring”解决方案，它使用REST客户端已经拥有的Facebook OAuth令牌来保护我们的REST后端。例如：你有一个移动应用程序，在应用程序本身中实现了Facebook Connect SDK，另一方面，你有一个提供REST API的后端。您希望使用 Facebook OAuth 令牌对 REST API 调用进行身份验证。解决方案实现了此方案。

不幸的是，Spring社会安全框架仅保护您的有状态HTTP请求，而不是您的无状态REST后端。

这是Spring社会保障框架的扩展，由一个组件组成：FacebookTokenAuthenticationFilter。此筛选器截获所有 REST 调用。客户端应该在每个请求中将 URL 中的 Facebook OAuth 令牌作为“input_token”参数发送，因为 REST API 本质上是无隐身的。筛选器查找此令牌，并通过“debug_token”图形 API 调用对其进行验证。如果令牌经过验证，筛选器会尝试将用户与本地用户管理系统匹配。如果尚未注册此类用户，筛选器会将用户注册为新用户。

您可以将此过滤器与Spring社会保障的标准社交身份验证过滤器一起使用，如果您还有 REST API 以外的服务，例如 Web 后端。因此，您可以使用相同的用户管理系统。

1） 在MYSQL中按如下方式创建用户表：

CREATE TABLE IF NOT EXISTS `user` (
  `id` varchar(50) NOT NULL,
  `email` varchar(255) NOT NULL COMMENT 'unique',
  `first_name` varchar(255) NOT NULL,
  `last_name` varchar(255) NOT NULL,
  `password` varchar(255) DEFAULT NULL,
  `role` varchar(255) NOT NULL,
  `sign_in_provider` varchar(20) DEFAULT NULL,
  `creation_time` datetime NOT NULL,
  `modification_time` datetime NOT NULL,
  `status` varchar(20) NOT NULL COMMENT 'not used',
  PRIMARY KEY (`id`),
  UNIQUE KEY `email` (`email`)
);

2）在context.xml配置您的数据源：

上下文.xml在雄猫中：

<Resource auth="Container" driverClassName="com.mysql.jdbc.Driver" maxActive="100" maxIdle="30" maxWait="10000" 
name="jdbc/thingabled" password="..." type="javax.sql.DataSource" url="jdbc:mysql://localhost:3306/..." username="..."/>

3）Spring配置：我们将Spring安全性配置为拦截以FacebookTokenAuthenticationFilter“保护”开头的URL进行身份验证。授权将通过“ROLE_USER_REST_MOBILE”角色完成。

<security:http use-expressions="true" pattern="/protected/**"
create-session="never" entry-point-ref="forbiddenEntryPoint">
  <security:intercept-url pattern="/**"
  access="hasRole('ROLE_USER_REST_MOBILE')" />
<!-- Adds social authentication filter to the Spring Security filter chain. -->
  <security:custom-filter ref="facebookTokenAuthenticationFilter"
  before="FORM_LOGIN_FILTER" />
</security:http>


<bean id="facebookTokenAuthenticationFilter"
class="com.ozgen.server.security.oauth.FacebookTokenAuthenticationFilter">
  <constructor-arg index="0" ref="authenticationManager" />
  <constructor-arg index="1" ref="userIdSource" />
  <constructor-arg index="2" ref="usersConnectionRepository" />
  <constructor-arg index="3" ref="connectionFactoryLocator" />
</bean>

<security:authentication-manager alias="authenticationManager">
  <security:authentication-provider
  ref="socialAuthenticationProvider" />
</security:authentication-manager>

<!-- Configures the social authentication provider which processes authentication 
requests made by using social authentication service (FB). -->
<bean id="socialAuthenticationProvider"
class="org.springframework.social.security.SocialAuthenticationProvider">
  <constructor-arg index="0" ref="usersConnectionRepository" />
  <constructor-arg index="1" ref="simpleSocialUserDetailsService" />
</bean>

<bean id="forbiddenEntryPoint"
class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />

<!-- This bean determines the account ID of the user.-->
<bean id="userIdSource"
class="org.springframework.social.security.AuthenticationNameUserIdSource" />

<!-- This is used to hash the password of the user. -->
<bean id="passwordEncoder"
class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
  <constructor-arg index="0" value="10" />
</bean>
<!-- This bean encrypts the authorization details of the connection. In 
our example, the authorization details are stored as plain text. DO NOT USE 
THIS IN PRODUCTION. -->
<bean id="textEncryptor" class="org.springframework.security.crypto.encrypt.Encryptors"
factory-method="noOpText" />

4） FacebookTokenAuthenticationFilter将拦截所有无状态REST请求，以使用有效的Facebook令牌验证请求。检查Facebook令牌是否有效。如果Facebook令牌无效，则请求将被拒绝。如果Facebook令牌有效，则过滤器将尝试通过SimpleSocialUserDetailsService验证请求。如果用户和用户连接数据不可用，将创建一个新用户（通过UserService）和userconnection。

private Authentication attemptAuthService(...) {
  if (request.getParameter("input_token") == null) {
    throw new SocialAuthenticationException("No token in the request");
  }
  URIBuilder builder = URIBuilder.fromUri(String.format("%s/debug_token", "https://graph.facebook.com"));
  builder.queryParam("access_token", access_token);
  builder.queryParam("input_token", request.getParameter("input_token"));
  URI uri = builder.build();
  RestTemplate restTemplate = new RestTemplate();

  JsonNode resp = null;
  try {
    resp = restTemplate.getForObject(uri, JsonNode.class);
  } catch (HttpClientErrorException e) {
    throw new SocialAuthenticationException("Error validating token");
  }
  Boolean isValid = resp.path("data").findValue("is_valid").asBoolean();
  if (!isValid)
    throw new SocialAuthenticationException("Token is not valid");

  AccessGrant accessGrant = new AccessGrant(request.getParameter("input_token"), null, null,
    resp.path("data").findValue("expires_at").longValue());

  Connection<?> connection = ((OAuth2ConnectionFactory<?>) authService.getConnectionFactory())
    .createConnection(accessGrant);
  SocialAuthenticationToken token = new SocialAuthenticationToken(connection, null);
  Assert.notNull(token.getConnection());

  Authentication auth = SecurityContextHolder.getContext().getAuthentication();
  if (auth == null || !auth.isAuthenticated()) {
    return doAuthentication(authService, request, token);
  } else {
    addConnection(authService, request, token);
    return null;
  }
 }

5） 项目中的其他重要部分：

用户:映射“用户”表的实体。

@Entity
@Table(name = "user")
public class User extends BaseEntity {

  @Column(name = "email", length = 255, nullable = false, unique = true)
  private String email;

  @Column(name = "first_name", length = 255, nullable = false)
  private String firstName;

  @Column(name = "last_name", length = 255, nullable = false)
  private String lastName;

  @Column(name = "password", length = 255)
  private String password;

  @Column(name = "role", length = 255, nullable = false)
  private String rolesString;

  @Enumerated(EnumType.STRING)
  @Column(name = "sign_in_provider", length = 20)
  private SocialMediaService signInProvider;

  ...
}

用户存储库：Spring Data JPA存储库，它将使我们能够在“用户”实体上运行CRUD操作。

public interface UserRepository extends JpaRepository<User, String> {
  public User findByEmailAndStatus(String email,Status status);
  public User findByIdAndStatus(String id,Status status);
}

用户服务 ：此 spring 服务将用于创建一个新的用户帐户，将数据插入“用户”表。

@Service
public class UserService {
  private static final Logger LOGGER = LoggerFactory.getLogger(UserService.class);

  @Autowired
  private UserRepository repository;

  @Transactional
  public User registerNewUserAccount(RegistrationForm userAccountData) throws DuplicateEmailException {
      LOGGER.debug("Registering new user account with information: {}", userAccountData);

      if (emailExist(userAccountData.getEmail())) {
          LOGGER.debug("Email: {} exists. Throwing exception.", userAccountData.getEmail());
          throw new DuplicateEmailException("The email address: " + userAccountData.getEmail() + " is already in use.");
      }

      LOGGER.debug("Email: {} does not exist. Continuing registration.", userAccountData.getEmail());

      User registered =User.newEntity();
      registered.setEmail(userAccountData.getEmail());
      registered.setFirstName(userAccountData.getFirstName());
      registered.setLastName(userAccountData.getLastName());
      registered.setPassword(null);
      registered.addRole(User.Role.ROLE_USER_WEB);
      registered.addRole(User.Role.ROLE_USER_REST);
      registered.addRole(User.Role.ROLE_USER_REST_MOBILE);

      if (userAccountData.isSocialSignIn()) {
          registered.setSignInProvider(userAccountData.getSignInProvider());
      }

      LOGGER.debug("Persisting new user with information: {}", registered);

      return repository.save(registered);
  }
  .... 
}

这个Spring服务将被社会认证提供者用来认证用户的userId。

@Service
public class SimpleSocialUserDetailsService implements SocialUserDetailsService {
  private static final Logger LOGGER = LoggerFactory.getLogger(SimpleSocialUserDetailsService.class);
  @Autowired
  private UserRepository repository;

  @Override
  public SocialUserDetails loadUserByUserId(String userId) throws UsernameNotFoundException, DataAccessException {
      LOGGER.debug("Loading user by user id: {}", userId);

      User user = repository.findByEmailAndStatus(userId, Status.ENABLED);
      LOGGER.debug("Found user: {}", user);

      if (user == null) {
          throw new UsernameNotFoundException("No user found with username: " + userId);
      }

      ThingabledUserDetails principal = new ThingabledUserDetails(user.getEmail(),user.getPassword(),user.getAuthorities());
      principal.setFirstName(user.getFirstName());
      principal.setId(user.getId());
      principal.setLastName(user.getLastName());
      principal.setSocialSignInProvider(user.getSignInProvider());


      LOGGER.debug("Found user details: {}", principal);

      return principal;
  }
} 

您可以从以下位置下载代码示例：

https://github.com/ozgengunay/FBSpringSocialRESTAuth