如何更新redis中存储的spring security oauth2认证后的token相关信息(用户信息等)

最近发现自己的工程中,修改了UserDetails中的用户信息后,再用access_token获取用户信息后,发现总是获取的第一次登录时存储的信息,不是修改后的信息,后来才发现是没有更新redis中的信息。
oauth2配置:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.provider.ClientDetailsService;
import org.springframework.security.oauth2.provider.approval.ApprovalStore;
import org.springframework.security.oauth2.provider.approval.TokenApprovalStore;
import org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler;
import org.springframework.security.oauth2.provider.client.JdbcClientDetailsService;
import org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;

import javax.sql.DataSource;

/**
 *
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Order(-1)
public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter
{

    @Autowired
    private DataSource dataSource;

    @Autowired
    private RedisConnectionFactory connectionFactory;

    @Autowired
    private PasswdAuthenticationProvider passwdAuthenticationProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception
    {
        auth.authenticationProvider(passwdAuthenticationProvider);
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http.requestMatchers().antMatchers(HttpMethod.OPTIONS, "/oauth/token").and().csrf().disable();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception
    {
        return super.authenticationManagerBean();
    }

    @Bean
    public ClientDetailsService clientDetailsService()
    {
        return new JdbcClientDetailsService(dataSource);
    }

    @Bean
    public TokenStore tokenStore()
    {
        RedisTokenStore redis = new RedisTokenStore(connectionFactory);
        return redis;
    }

    @Bean
    @Autowired
    public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore)
    {
        TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
        handler.setTokenStore(tokenStore);
        handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService()));
        handler.setClientDetailsService(clientDetailsService());
        return handler;
    }

    @Bean
    @Autowired
    public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception
    {
        TokenApprovalStore store = new TokenApprovalStore();
        store.setTokenStore(tokenStore);
        return store;
    }

}

获取认证后的信息:

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            Object principal = authentication == null ? null : authentication.getPrincipal();

修改的就是principal 中的信息,但没有修改redis中的信息,本想直接操作redis中存储的对象,但担心打乱spring security自身存储的数据结构,苦苦寻找并自己研究了两天,始终没能找到答案。

spring security源码后,发现信息是在Tokenstone接口中新增的,由于该接口没有提供修改方法,所以重写了新增的方法,覆盖了redis中的信息。

@Autowired
private TokenStore tokenStore;
@Autowired
private RedisConnectionFactory connectionFactory;
private AuthenticationKeyGenerator authenticationKeyGenerator=new 
DefaultAuthenticationKeyGenerator();

private JdkSerializationStrategy serializationStrategy=new JdkSerializationStrategy();

 //更新redis中的token相关信息
    OAuth2Authentication authentication = (OAuth2Authentication)SecurityContextHolder.getContext().getAuthentication();
    String key = authenticationKeyGenerator.extractKey(authentication);
    byte[] serializedKey =  serializationStrategy.serialize("auth_to_access:" + key);
    byte[] bytes = null;
    RedisConnection conn = connectionFactory.getConnection();
    try {
        bytes = conn.get(serializedKey);
    } finally {
        conn.close();
    }
    OAuth2AccessToken accessToken =serializationStrategy.deserialize(bytes, 
    OAuth2AccessToken.class);
    tokenStore.storeAccessToken(accessToken, authentication);
评论 5
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值