如何使用Spring Security OAuth2要求每个唯一匿名用户同意？

Question

我的应用程序有一个单一的endpoint。它触发OAuth2授权授予流。它只能由匿名用户调用。每个匿名用户代表在资源服务器中具有不同权限的不同人员。需要每个匿名用户的同意（即不同的授权）。

Spring Boot OAuth2中需要每个匿名用户同意的配置是什么？

我正在使用Spring Boot oath2-Client 2.6.4和Spring Security 5.6.2。

目前，我有oauth2client配置。它不符合要求。在此配置中，只请求一次同意，并将其应用于以下所有匿名呼叫者。所有呼叫者共享相同的授权和访问令牌。

我觉得oauth2login可能是合适的配置，但在尝试oauth2login之前，我必须克服一些必要的定制。我必须禁用生成的登录页面，该页面提示用户选择提供者，并且我必须向授权请求中添加自定义字段。我在outh2login中的这些定制没有成功。因此，这种方法感觉不错，但似乎不可用。

有关此endpoint调用者的信息，请参阅：HL7 FHIR SMART-APP-LAUNCH

Answer 1

这方面存在许多挑战，涉及：

我的应用程序有一个单一的endpoint。[...]它只能由匿名用户调用。

这一要求使得Spring Security很难提供太多帮助。这是因为匿名用户通常没有会话，授权代码授予是一个需要状态的流，因此需要会话。顺便说一句，我不确定我是否完全理解您链接到的规范（据我所知，它构建在OAuth 2.0上）在允许匿名用户的客户端环境中是如何或为什么有意义的。

尽管如此，这似乎只需要使用<代码>。如果您创建用于管理匿名用户的自定义过滤器，则oauth2Client（）支持Spring Security。注意：以下假设即使浏览器中存在会话，授权服务器也不会忽略启动参数。

以下配置定义和配置此过滤器，以及自定义oauth2Client（）以将启动参数传递给授权服务器。它本质上为启动参数创建了一个临时身份验证，该参数将在流期间保存为会话中的principalName。

@EnableWebSecurity
public class SecurityConfig {

    private static final String PARAMETER_NAME = "launch";

    private static final String ROLE_NAME = "LAUNCH_USER";

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http, ClientRegistrationRepository clientRegistrationRepository) throws Exception {
        http
            .authorizeHttpRequests((authorize) -> authorize
                .anyRequest().hasRole(ROLE_NAME)
            )
            .addFilterAfter(authenticationFilter(), AnonymousAuthenticationFilter.class)
            .oauth2Client((oauth2) -> oauth2
                .authorizationCodeGrant((authorizationCode) -> authorizationCode
                    .authorizationRequestResolver(authorizationRequestResolver(clientRegistrationRepository))
                )
            );
        return http.build();
    }

    private OAuth2AuthorizationRequestResolver authorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository) {
        DefaultOAuth2AuthorizationRequestResolver authorizationRequestResolver =
                new DefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepository, OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI);

        // Configure a request customizer for the OAuth2AuthorizationRequestRedirectFilter
        authorizationRequestResolver.setAuthorizationRequestCustomizer((authorizationRequest) -> {
            Authentication currentAuthentication = SecurityContextHolder.getContext().getAuthentication();

            // Customize request with principal name originally obtained from request parameter
            if (currentAuthentication instanceof RequestParameterAuthenticationToken) {
                Map<String, Object> additionalParameters = Map.of(PARAMETER_NAME, currentAuthentication.getName());
                authorizationRequest.additionalParameters(additionalParameters);
            }
        });

        return authorizationRequestResolver;
    }

    private RequestParameterAuthenticationFilter authenticationFilter() {
        return new RequestParameterAuthenticationFilter(PARAMETER_NAME, AuthorityUtils.createAuthorityList("ROLE_" + ROLE_NAME));
    }

    /**
     * Authentication filter that authenticates an anonymous request using a request parameter.
     */
    public static final class RequestParameterAuthenticationFilter extends OncePerRequestFilter {

        private final String parameterName;

        private final List<GrantedAuthority> authorities;

        public RequestParameterAuthenticationFilter(String parameterName, List<GrantedAuthority> authorities) {
            this.parameterName = parameterName;
            this.authorities = authorities;
        }

        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
            SecurityContext existingSecurityContext = SecurityContextHolder.getContext();
            if (existingSecurityContext != null && !(existingSecurityContext.getAuthentication() instanceof AnonymousAuthenticationToken)) {
                filterChain.doFilter(request, response);
                return;
            }

            String principalName = request.getParameter(parameterName);
            if (principalName != null) {
                Authentication authenticationResult = new RequestParameterAuthenticationToken(principalName, authorities);
                authenticationResult.setAuthenticated(true);

                SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
                securityContext.setAuthentication(authenticationResult);
                SecurityContextHolder.setContext(securityContext);
            }
            filterChain.doFilter(request, response);
        }

    }

    /**
     * Custom authentication token that can be persisted between requests, but is otherwise very similar to
     * {@link AnonymousAuthenticationToken}.
     */
    public static final class RequestParameterAuthenticationToken extends AbstractAuthenticationToken implements Serializable {

        private static final long serialVersionUID = 1L;

        private final String principalName;

        public RequestParameterAuthenticationToken(String principalName, Collection<? extends GrantedAuthority> authorities) {
            super(authorities);
            this.principalName = principalName;
        }

        @Override
        public Object getPrincipal() {
            return this.principalName;
        }

        @Override
        public Object getCredentials() {
            return this.principalName;
        }

    }

}

您可以在控制器endpoint中使用它，如以下示例所示：

java prettyprint-override">@RestController
public class LaunchController {

    @GetMapping("/app/launch")
    public void launch(
            @RegisteredOAuth2AuthorizedClient("fhir-client")
                    OAuth2AuthorizedClient authorizedClient) {
        String launchParameter = authorizedClient.getPrincipalName();
        String accessToken = authorizedClient.getAccessToken().getTokenValue();
        // Use authorizedClient.getAccessToken() to make a request (WebClient)...

        // Clear the SecurityContext after the request, to force the next request
        // to start the flow over again
        SecurityContextHolder.clearContext();
    }

}

有关此答案的其他上下文，请参阅相关问题#11069。