如何使用Spring Security和OAuth2保护Apache Camel restendpoint

Question

我正在开发配置了SSO/OAuth2安全性的Spring Boot应用程序。身份验证对我的rest控制器很有效，现在我需要用restendpoint保护我的Apache Camel路由。

据我所知，有几种方法可以做到这一点：

1. 通过将身份验证处理器添加到我的路线
2. 通过向我的路线添加策略（SpringSecurityAuthorizationPolicy）
3. jettyendpoint的“按处理程序”选项

我试图通过添加新的auth处理器到我的Restendpoint来做到这一点，但我坚持这个例外：

组织。springframework。安全oauth2。常见的例外。OAuth2Exception:找不到组织的AuthenticationProvider。springframework。安全网状物认证。预授权。预验证身份验证令牌

在调试过程中，我看到了那个组织。springframework。安全认证。ProviderManager。getProviders（）只包含一个提供程序AnonymousAuthenticationProvider，因此我可能必须注册相应的提供程序。。。

有人能帮我找到解决这个问题的正确方法吗？

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().authorizeRequests().anyRequest().permitAll();
  }

  @Configuration
  @EnableResourceServer
  protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    @Value("${oauth2.token.endpoint}")
    private String tokenEndpoint;

    @Bean
    public ResourceServerTokenServices tokenService() {
      RemoteTokenServices tokenServices = new RemoteTokenServices();
      tokenServices.setClientId("clientId");
      tokenServices.setClientSecret("clientSecret");
      tokenServices.setCheckTokenEndpointUrl(tokenEndpoint);
      return tokenServices;
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests().anyRequest().authenticated();
    }
  }

}

@Configuration
public class EmbeddedServerRoute {
  @Bean
  public RoutesBuilder embeddedServer() {
    return new RouteBuilder() {
      @Override
      public void configure() throws Exception {
        restConfiguration().component("jetty").port("8081").bindingMode(RestBindingMode.json);
      }
    };
  }
}


@Component
public class RestTestRoute extends RouteBuilder {

  @Autowired
  private AuthProcessor authProcessor;

  @Override
  public void configure() throws Exception {
    from("rest:get:/test").process(authProcessor).to("mock:end").end();
  }
}


@Component
public class AuthProcessor implements Processor {

  @Autowired
  private AuthenticationManager authenticationManager;

  private TokenExtractor tokenExtractor = new BearerTokenExtractor();

  private AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new OAuth2AuthenticationDetailsSource();

  @Override
  public void process(Exchange exchange) throws Exception {
    HttpServletRequest request = exchange.getIn().getBody(HttpServletRequest.class);
    Subject subject = new Subject();
    Authentication auth = getAuth(request);
    subject.getPrincipals().add(auth);
    exchange.getIn().setHeader(Exchange.AUTHENTICATION, subject);
  }

  private Authentication getAuth(HttpServletRequest request) throws OAuth2Exception {
    Authentication authentication = null;
    try {
      authentication = tokenExtractor.extract(request);
      if (authentication != null) {
        request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_VALUE, authentication.getPrincipal());

        if (authentication instanceof AbstractAuthenticationToken) {
          AbstractAuthenticationToken needsDetails = (AbstractAuthenticationToken) authentication;
          needsDetails.setDetails(authenticationDetailsSource.buildDetails(request));
        }
        return authenticationManager.authenticate(authentication);
      }
    } catch (Exception e) {
      throw new OAuth2Exception(e.getMessage());
    }
    throw new OAuth2Exception("Not Authorized to view resource");
  }

}

Answer 1

作为最终的解决方案，我决定使用Spring Boot嵌入式servlet容器，而不是Apache Camel rest组件。因此，它可以很容易地通过Spring Security进行保护。这可以通过创建额外的bean来实现：

  @Bean
  public ServletRegistrationBean servletRegistrationBean() {
    SpringServerServlet serverServlet = new SpringServerServlet();
    ServletRegistrationBean regBean = new ServletRegistrationBean(serverServlet, "/camel/*");
    Map<String, String> params = new HashMap<>();
    params.put("org.restlet.component", "restletComponent");
    regBean.setInitParameters(params);
    return regBean;
  }

  @Bean
  public Component restletComponent() {
    return new Component();
  }

  @Bean
  public RestletComponent restletComponentService() {
    return new RestletComponent(restletComponent());
  }