springsecurity实现oauth2换取授权码的过程中,涉及到先登录,然后再授权,再换取授权码的过程。如果不进行设置,security会跳转到一个默认的授权页面,如下图:
其中红框标注的scope为请求/oauth/authorize时传入的scope。
源码分析
跳转到approve页面的源码如下:
if (authorizationRequest.isApproved()) {
if (responseTypes.contains("token")) {
return getImplicitGrantResponse(authorizationRequest);
}
if (responseTypes.contains("code")) {
return new ModelAndView(getAuthorizationCodeResponse(authorizationRequest,
(Authentication) principal));
}
}
// Store authorizationRequest AND an immutable Map of authorizationRequest in session
// which will be used to validate against in approveOrDeny()
model.put(AUTHORIZATION_REQUEST_ATTR_NAME, authorizationRequest);
model.put(ORIGINAL_AUTHORIZATION_REQUEST_ATTR_NAME, unmodifiableMap(authorizationRequest));
//跳转到授权页面
return getUserApprovalPageResponse(model, authorizationRequest, (Authentication) principal);
//生成授权页面
private ModelAndView getUserApprovalPageResponse(Map<String, Object> model,
AuthorizationRequest authorizationRequest, Authentication principal) {
logger.debug("Loading user approval page: " + userApprovalPage);
model.putAll(userApprovalHandler.getUserApprovalRequest(authorizationRequest, principal));
return new ModelAndView(userApprovalPage, model);
}
那么,不想跳转到授权页面就需要看看authorizationRequest.isApproved()这个函数式怎么判断的,进去发现这是authorizationRequest的一个属性,那么属性又是怎么设置的呢?
同样是在这个endpoint里,发现了三行关键代码
进入第一行代码,进入它的实现类ApprovalStoreUserApprovalHandler,可以看到这里对authorizationRequest的approved属性进行了配置,源码如下:
//类名org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler
//方法名checkForPreApproval
if (clientDetailsService != null) {
try {
ClientDetails client = clientDetailsService.loadClientByClientId(clientId);
for (String scope : requestedScopes) {
if (client.isAutoApprove(scope)) {
approvedScopes.add(scope);
}
}
if (approvedScopes.containsAll(requestedScopes)) {
// gh-877 - if all scopes are auto approved, approvals still need to be added to the approval store.
Set<Approval> approvals = new HashSet<Approval>();
Date expiry = computeExpiry();
for (String approvedScope : approvedScopes) {
approvals.add(new Approval(userAuthentication.getName(), authorizationRequest.getClientId(),
approvedScope, expiry, ApprovalStatus.APPROVED));
}
approvalStore.addApprovals(approvals);
authorizationRequest.setApproved(true);
return authorizationRequest;
}
}
catch (ClientRegistrationException e) {
logger.warn("Client registration problem prevent autoapproval check for client=" + clientId);
}
}
//类名org.springframework.security.oauth2.provider.client.BaseClientDetails
public boolean isAutoApprove(String scope) {
if (autoApproveScopes == null) {
return false;
}
for (String auto : autoApproveScopes) {
if (auto.equals("true") || scope.matches(auto)) {
return true;
}
}
return false;
}
根据以上代码可以判断出,会首先使用clientDetailsService加载出client的信息,然后判断当前的scope是否支持自动approve。autoApprovesScopes定义如下:
故只需要在数据库的oauth_client_details的对应字段添加支持自动授权的字段。