有人有在Spring Cloud Gateway/Spring WebFlux中实现x509相互身份验证的简单示例吗？

Question

从我所看到的来看，身份验证不是通过Spring Cloud Gateway本身来处理的，而是应该通过Spring WebFlux来完成--如果这是一个不正确的假设，请纠正我。我已经找到了通过Spring Security实现认证身份验证的示例，但在WebFlux中没有找到任何示例。

有人能提供一些提示甚至一些代码示例来让我走上正确的轨道吗？

Answer 1

您可以在src/main/resources/application.yml中配置它。

server:
  # for testing or development without SSL certs (HTTP) use an "appropriate"
  # non-secure port, e.g. 8080
  # for HTTPS use an "appropriate" secure port, e.g. 8443
  port: 8443
  ssl:
    # for HTTP set enabled to false, for HTTPS (with required client certs) set to true
    enabled: true
    # this is the spring cloud gateway _server_ cert
    key-store: /etc/pki/tls/private/server.p12
    key-store-password: servercertpassword
    key-store-type: PKCS12
    # this is the "bundle" of CA intermediate/root upon which the client cert has to
    # match
    trust-store: /etc/pki/ca-trust/extracted/java/cacerts
    # this `client-auth` option is where you *require* mutual-TLS, it can alternatively
    # be made optional
    client-auth: need
    trust-store-password: truststorepassword
    trust-store-type: JCEKS
management:
  # management port without SSL to allow monitoring/etc. without client certs
  # e.g. /actuator/health
  server:
    port: 8080
    ssl:
      enabled: false

如果您有一组客户机证书、一个服务器证书和trust-store/CA包，这是如何在Spring Cloud Gateway中配置它的一个示例。

您的应用程序中将提供一个X509preauthenticatedauthenticationtoken，用于通过相互TLS成功连接，其中包含客户端证书的主体/详细信息。