Spring Security-使用自定义DB授权与Auth0预验证

Question

我目前正在使用Spring Security开发Spring Boot REST应用程序。我的工作场所使用Auth0（提供用户管理的外部第三方服务）进行身份验证，并已要求我在此应用程序中实现它。身份验证发生在用React编写的前端应用程序中。前端应用程序显示登录表单，并将用户名和密码发送给Auth0，Auth0验证凭据，并在验证用户时返回JWT令牌。

在此之后，前端应用程序将通过Authorize头中的JWT令牌从我的应用程序调用REST服务。Spring Security使用Auth0插件验证该令牌，并允许执行请求。我已经测试了这么多，以达到预期效果。代码如下：

import java.util.Arrays;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import com.auth0.spring.security.api.JwtWebSecurityConfigurer;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter{
    
    @Value(value = "${auth0.apiAudience}")
    private String apiAudience;
    @Value(value = "${auth0.issuer}")
    private String issuer;
    
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("http://localhost:8080"));
        configuration.setAllowedMethods(Arrays.asList("GET","POST"));
        configuration.setAllowCredentials(true);
        configuration.addAllowedHeader("Authorization");
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors();
        JwtWebSecurityConfigurer  //Auth0 provided class performs per-authentication using JWT token
            .forRS256(apiAudience, issuer)
            .configure(http)
            .authorizeRequests()
            .antMatchers(HttpMethod.GET, "/Test/public").permitAll()
            .antMatchers(HttpMethod.GET, "/Test/authenticated").authenticated();
    }
    
}

现在，一旦完成了身份验证，我发现安全上下文中的主体将使用Auth0中的用户id进行更新。我已经通过以下代码片段验证了这一点：

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
String name = authentication.getName(); // Returns the Auth0 user id.

我希望做的下一步是使用此用户id将用户与我现有数据库模式中的角色和权限匹配。因此，我需要实现一个自定义授权机制，该机制也可以插入到Spring Security中。换句话说，用户的角色必须在（预）身份验证完成后不久加载到安全上下文中。我该如何实现这一点？是否有一些类需要扩展或实现一些接口？

Answer 1

好吧，我找到了一个解决方案，虽然我觉得有点脏。按照官方Auth0类的奇怪结构，我所做的可能被描述为黑客行为。不管怎样，下面是：

首先，我通过实现AuthenticationUserDetailsService接口创建了一个自定义用户详细信息服务：

@Service
public class VUserDetailsService implements AuthenticationUserDetailsService<PreAuthenticatedAuthenticationJsonWebToken> {

@Autowired
UserRepository userRepository;

Logger logger = LoggerFactory.getLogger(VUserDetailsService.class);

@Override
@Transactional(readOnly = true)
public UserDetails loadUserDetails(PreAuthenticatedAuthenticationJsonWebToken token) throws UsernameNotFoundException {
    logger.debug("User id: "+token.getName());
    // Verify whether there is an entry for this id in the database.
    User user = userRepository.findByAuxillaryId(token.getName());
    
    if(user == null)
        throw new UsernameNotFoundException("The user with id "+token.getName()+" not found in database.");
    
    logger.debug("Obtained user details from db: "+user.toString());
    List<GrantedAuthority> authoritiesList = new ArrayList<>();
    // Get user roles
    List<UserRole> userRoles = user.getUserRoles();
    if(userRoles != null) logger.debug("Number of user roles:"+userRoles.size());
    
    for(UserRole userRole : userRoles) {
        logger.debug(userRole.getCompositeKey().getRole());
        authoritiesList.add(new SimpleGrantedAuthority(userRole.getCompositeKey().getRole()));
    }
        
    return new org.springframework.security.core.userdetails.User(token.getName(), "TEMP", authoritiesList);
}
}

在这里，辅助id是在Auth0中创建用户时分配的用户id。请注意，预验证验证JsonWebToken也是Auth0提供的类。

在这之后，我创建了一个自定义身份验证提供程序，扩展了Auth0提供的Jwt验证提供程序：

public class VAuthenticationProvider extends JwtAuthenticationProvider {
    
    public VAuthenticationProvider(JwkProvider jwkProvider, String issuer, String audience) {
        super(jwkProvider, issuer, audience);
    }

    @Autowired
    VUserDetailsService vUserDetailsService;
    
    Logger logger = LoggerFactory.getLogger(VAuthenticationProvider.class);

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        logger.debug("*** Processing authentication for token: "+authentication.getName());
        logger.debug("*** Current granted authorities: "+authentication.getAuthorities());
        UserDetails userDetails = vUserDetailsService.loadUserDetails((PreAuthenticatedAuthenticationJsonWebToken) authentication);
        authentication = new PreAuthenticatedAuthenticationToken(userDetails, userDetails.getPassword(), userDetails.getAuthorities());
        return authentication;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        //com.auth0.spring.security.api.authentication.PreAuthenticatedAuthenticationJsonWebToken
        return authentication.equals(PreAuthenticatedAuthenticationJsonWebToken.class);
    }
}

然后我在我的安全配置类中使用了这个身份验证提供程序：

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Value(value = "${auth0.apiAudience}")
    private String apiAudience;
    @Value(value = "${auth0.issuer}")
    private String issuer;

    @Autowired
    VUserDetailsService vUserDetailsService;

    Logger log = LoggerFactory.getLogger(SecurityConfiguration.class);
    
    @Bean
    public VAuthenticationProvider authProvider() {
        JwkProvider jwkProvider = new JwkProviderBuilder(issuer).build(); //Auth0 provided class
        VAuthenticationProvider vAuthProvider = new VAuthenticationProvider(jwkProvider, issuer, apiAudience);
        return vAuthProvider;
        
    }
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors();
        JwtWebSecurityConfigurer.forRS256(apiAudience, issuer, authProvider())
                .configure(http)
                .authorizeRequests().antMatchers(HttpMethod.GET, "/Test/public").permitAll()
                .antMatchers(HttpMethod.GET, "/Test/authenticated").authenticated()
                .antMatchers(HttpMethod.GET, "/admin/*").hasRole("ADMIN") //Not Auth0 role, defined in my DB.
                .antMatchers(HttpMethod.GET, "/Test/root").hasRole("ROOT"); //Not Auth0 role, defined in my DB.
    }
/* Code ommitted */

现在，我的所有请求都会根据数据库中的角色进行筛选。因此，Auth0仅用于身份验证，授权基于数据库中的角色。

如果有人认为这个解决方案可以改进，请告诉我。

Answer 2

我想你要找的是AuthenticationProvider接口。以下是我如何处理身份验证的两个示例：

DAO身份验证

@Component
public class DaoAdminAuthenticationProvider extends DaoAuthenticationProvider {
private static final Logger LOG = 
LoggerFactory.getLogger(DaoAdminAuthenticationProvider.class);

private final AdminUserRepository adminUserRepository;

public DaoAdminAuthenticationProvider(AdminUserRepository adminUserRepository, DaoAdminUserDetailsService daoAdminUserDetailsService) {
    this.adminUserRepository = adminUserRepository;
    setPasswordEncoder(new BCryptPasswordEncoder(11));
    this.setUserDetailsService(daoAdminUserDetailsService);
}

@Override
public Authentication authenticate(Authentication auth) throws AuthenticationException {

    AdminUser adminUser = adminUserRepository.findByEmail(auth.getName());
    if (adminUser == null) {
        LOG.info("Invalid username or password");
        throw new BadCredentialsException("Invalid username or password");
    }

    Authentication result = super.authenticate(auth);
    return new UsernamePasswordAuthenticationToken(adminUser, result.getCredentials(), result.getAuthorities());
}

@Override
public boolean supports(Class<?> authentication) {
    return authentication.equals(UsernamePasswordAuthenticationToken.class);
}
}

JwtAuthenticationProvider

@Component
public class JwtAuthenticationProvider implements AuthenticationProvider {
private static final Logger LOG = 
LoggerFactory.getLogger(JwtAuthenticationProvider.class);

private static final String EX_TOKEN_INVALID = "jwt.token.invalid";

private final JwtTokenService jwtTokenService;

@SuppressWarnings("unused")
public JwtAuthenticationProvider() {
    this(null);
}

@Autowired
public JwtAuthenticationProvider(JwtTokenService jwtTokenService) {
    this.jwtTokenService = jwtTokenService;
}

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {

    try {
        String token = (String) authentication.getCredentials();
        String username = jwtTokenService.getUsernameFromToken(token);

        return jwtTokenService.validateToken(token)
                .map(aBoolean -> new JwtAuthenticatedProfile(username))
                .orElseThrow(() -> new TokenException(EX_TOKEN_INVALID));

    } catch (JwtException ex) {
        LOG.error("Invalid JWT Token");
        throw new TokenException(EX_TOKEN_INVALID);
    }
}

@Override
public boolean supports(Class<?> authentication) {
    return JwtAuthentication.class.equals(authentication);
}
}

其他类，如JwtTokenService等，我也实现了。但是关于你的问题，我认为答案是使用AuthenticationProvider接口。