Spring RSocket安全JWT访问被拒绝错误

Question

我正在尝试使用Spring Boot RSocket与安全使用JWT令牌。它给我一个拒绝访问的错误，没有其他有用的信息来帮助调试？

拒绝访问
ApplicationErrorException（0x201）：app//io.rsocket.exceptions.exceptions.from（exceptions.java:76）处的app//io-rsocket.core.RSocketRequester.handleFrame（rsocket Requester.java:261）处的app//io.rsocket.core.RSocketRequester.handleIncomingFrames（RSocker.core.publisher.LambdaSubscriber.onNext（Lambda订阅服务器.java:160）处的访问被拒绝app//io.rsocket.core.ClientServerInputMultiplexer$InternalDuplexConnection.onNext（ClientServerInputMultiplexer.java:248），位于app//io.rsocket.core.ClientServerInput Multiplex.onNext，位于app//io.rsoket.core.ClientServer InputMultiplexer。onNextapp//reactor.netty.http.client.HttpClientOperations.onInboundNext（HttpClientOperations.java:725）的app//reator.netty.channel.ChannelOperations.on入站下一步（FluxReceive.java:364）app//io.netty.channel.AcchannelOperationsHandler.channelRead（ChannelOperations Handler.java:93）位于app//io.netty.cchannel.AbstractChannelHandlerContext.invokeChannelReads（AbstractchannelHandllerContext.java:379）位于app//io.netthy.channel.AbstractHandlerContrext.invokeChannel读取app//io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead（ByteToMessageDecoder.java:327），app//io.netty.hhandler.codec.ByteTo消息Decoder.channelReads（BytetoMessageDecoders.java:299），app//io.netthy.channel.AbstractChannelHandlerContext.invokeChannelRead（AbstractchannelHannelHanderContext.java:379）app//io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead（AbstractchannelHandllerContext.java:365）位于app//io.netty.cchannel.AbtractChannellHandlerContrext.fireChannel读取（Abstract ChannelhannelHanderContext.jawa:357）位于app//io.netty.channel.DefaultChannelPipeline$HeadContext.channellRead（DefaultChannel管道.java:1410app//io.netty.channelapp//io.netty.channel.nio.NioEventLoop.processSelectedKey（NioEventLoop.java:722 leThreadEventExecutor$4.运行app//io.netty.util.internal.ThreadExecutorMap$2.run上的（SingleThreadEventExecutor.java:997java.base@11.0.14/java.lang.Thread.run（Thread.java:834）

安全配置文件

@Configuration
@EnableRSocketSecurity
@EnableReactiveMethodSecurity
class SecurityConfig {

    @Bean
    fun authorization(rsocketSecurity: RSocketSecurity): PayloadSocketAcceptorInterceptor {
        val security: RSocketSecurity =
            rsocketSecurity.authorizePayload { authorize: RSocketSecurity.AuthorizePayloadsSpec ->
                authorize
                    .anyRequest().authenticated()
                    .anyExchange().permitAll()
            }
                .jwt { jwtSpec ->
                    jwtSpec.authenticationManager(jwtReactiveAuthenticationManager(jwtDecoder()))
                }
        return security.build()
    }

    @Bean
    fun jwtDecoder(): ReactiveJwtDecoder {
        return TokenUtils.jwtAccessTokenDecoder()
    }

    @Bean
    fun jwtReactiveAuthenticationManager(decoder: ReactiveJwtDecoder): JwtReactiveAuthenticationManager {
        val converter = JwtAuthenticationConverter()
        val authoritiesConverter = JwtGrantedAuthoritiesConverter()
        authoritiesConverter.setAuthorityPrefix("ROLE_")
        converter.setJwtGrantedAuthoritiesConverter(authoritiesConverter)
        val manager = JwtReactiveAuthenticationManager(decoder)
        manager.setJwtAuthenticationConverter(ReactiveJwtAuthenticationConverterAdapter(converter))
        return manager
    }

    @Bean
    fun rsocketMessageHandler() = RSocketMessageHandler() .apply {
        argumentResolverConfigurer.addCustomResolver(AuthenticationPrincipalArgumentResolver())
        routeMatcher = PathPatternRouteMatcher()
        rSocketStrategies = rsocketStrategies()
    }

    @Bean
    fun rsocketStrategies() = RSocketStrategies.builder()
        .routeMatcher(PathPatternRouteMatcher())
        .build()
}

消息控制器文件

@MessageMapping("api.v1.messages")
@Controller
class MessageController {

    @MessageMapping("stream")
    suspend fun receive(
        @Payload inboundMessages: Flow<String>,
        @AuthenticationPrincipal jwt: String
    ) {
        println("MessageController: jwt: $jwt")
        println("MessageController: inbound message: " + inboundMessages.first())
    }
}

使用MessageControllerTest文件进行测试

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
class MessageControllerTest(
    @Autowired val rsocketBuilder: RSocketRequester.Builder,
    @LocalServerPort val serverPort: Int
) {

    @ExperimentalTime
    @ExperimentalCoroutinesApi
    @Test
    fun `test that messages API streams latest messages`() {
        val admin = HelloUser(userId = "9527", password = "password", role = HelloRole.ADMIN)

        val token: UserToken = TokenUtils.generateAccessToken(admin)!!

        val authenticationMimeType: MimeType =
            MimeTypeUtils.parseMimeType(WellKnownMimeType.MESSAGE_RSOCKET_AUTHENTICATION.string)

        runBlocking {
            val rSocketRequester = rsocketBuilder.websocket(URI("ws://localhost:${serverPort}/rsocket"))

            launch {

                rSocketRequester.route("api.v1.messages.stream")
                    .metadata(token.token!!, authenticationMimeType)
                    .dataWithType(flow {
                        emit(
                            "Hey from test class"
                        )
                    })
                    .retrieveFlow<Void>()
                    .collect()
            }
        }
    }
}

我已经将剩下的代码示例添加到GitHub中https://github.com/CJMobileApps/rsocket-jwt-security-example

Answer 1

我想通了。RSocket目前有一个bug或者只是错误的文档。JWTs BearerTokenMetadata的MimeType。BEARER _ authentic ation _ MIME _ TYPE 表示已弃用，并使用< code > MIME TYPE utils . parse MIME TYPE(well knownmimetype。MESSAGE _ r socket _ authentic ation . string)来代替，然而这并不起作用。

当传递令牌时，继续使用/useBearerTokenMetadata.BEARER_AUTHENTICATION_MIME_TYPE和令牌字符串。

.metadata(token.token!!, BearerTokenMetadata.BEARER_AUTHENTICATION_MIME_TYPE)