使用自定义登录表单后，OAuth2服务器不会重定向到客户端服务器

Question

身份验证和授权工作正常。但是在成功登录后，它不会将我重定向到客户端，而是进一步打开一些.js文件的源代码。而上一个（没有自定义登录表单loginPage（“/login”））它成功地将我重定向到最后一个单击的页面（客户端），该页面需要进行身份验证。

我的服务器端代码如下:

授权服务器

@Configuration

@EnableAuthorizationServer

public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

@Autowired
private AuthenticationManager authenticationManager;

@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {

    security.tokenKeyAccess("permitAll()")
            .checkTokenAccess("isAuthenticated()");
}


@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients
            .inMemory()
            .withClient("ClientId")
            .secret("secret")
            .authorizedGrantTypes("authorization_code")
            .scopes("user_info")
            .redirectUris("http://localhost:8082/ui/login")
            .autoApprove(true);
}


@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

    endpoints.authenticationManager(authenticationManager);
}
}

资源服务器

@Configuration

@EnableResourceServer

public class ResourceServer extends ResourceServerConfigurerAdapter {
@Override
public void configure(HttpSecurity http) throws Exception {
    http.requestMatchers().antMatchers("/api/**").and().authorizeRequests()
            .antMatchers("/api/**").authenticated().and()
            .antMatcher("/rest/hello/principal")
            .authorizeRequests().anyRequest().authenticated();
}

我的安全配置

@Configuration

public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {


@Autowired
private CustomUserDetailsService userDetailsService;

@Override
protected void configure(HttpSecurity http) throws Exception {
        
        http.authorizeRequests().antMatchers("/login").permitAll().antMatchers("/oauth/token/revokeById/**").permitAll()
        .antMatchers("/tokens/**").permitAll().anyRequest().authenticated().and()
        .formLogin().loginPage("/login")
        .usernameParameter("username")
        .passwordParameter("password")
        .failureUrl("/login?error")
        .defaultSuccessUrl("/").permitAll().and()
        .csrf().disable();
        
}

@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(passwordencoder());
}

@Bean(name = "passwordEncoder")
public PasswordEncoder passwordencoder() {
    return new CustomPasswordEncoder();
}

}

Answer 1

你需要创建 SimpleUrlAuthenticationSuccessHandler 实现

public class RefererRedirectionAuthenticationSuccessHandler 
  extends SimpleUrlAuthenticationSuccessHandler
  implements AuthenticationSuccessHandler {
 
    public RefererRedirectionAuthenticationSuccessHandler() {
        super();
        setUseReferer(true);
    }
 
}

并将一行添加到WebSecurityConfiguration.在处理程序（新的RefererReDirectionAuth在处理程序（））

之后，您的方法将如下所示

@Override
protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests().antMatchers("/login").permitAll().antMatchers("/oauth/token/revokeById/**").permitAll()
        .antMatchers("/tokens/**").permitAll().anyRequest().authenticated().and()
        .formLogin().loginPage("/login")
        .usernameParameter("username")
        .passwordParameter("password")
        .successHandler(new RefererRedirectionAuthenticationSuccessHandler()) 
        .failureUrl("/login?error")
        .defaultSuccessUrl("/").permitAll().and()
        .csrf().disable();

}