最近发现自己的工程中,修改了UserDetails中的用户信息后,再用access_token获取用户信息后,发现总是获取的第一次登录时存储的信息,不是修改后的信息,后来才发现是没有更新redis中的信息。
oauth2配置:
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.provider.ClientDetailsService;
import org.springframework.security.oauth2.provider.approval.ApprovalStore;
import org.springframework.security.oauth2.provider.approval.TokenApprovalStore;
import org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler;
import org.springframework.security.oauth2.provider.client.JdbcClientDetailsService;
import org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;
import javax.sql.DataSource;
/**
*
*/
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Order(-1)
public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter
{
@Autowired
private DataSource dataSource;
@Autowired
private RedisConnectionFactory connectionFactory;
@Autowired
private PasswdAuthenticationProvider passwdAuthenticationProvider;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception
{
auth.authenticationProvider(passwdAuthenticationProvider);
}
@Override
protected void configure(HttpSecurity http) throws Exception
{
http.requestMatchers().antMatchers(HttpMethod.OPTIONS, "/oauth/token").and().csrf().disable();
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception
{
return super.authenticationManagerBean();
}
@Bean
public ClientDetailsService clientDetailsService()
{
return new JdbcClientDetailsService(dataSource);
}
@Bean
public TokenStore tokenStore()
{
RedisTokenStore redis = new RedisTokenStore(connectionFactory);
return redis;
}
@Bean
@Autowired
public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore)
{
TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
handler.setTokenStore(tokenStore);
handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService()));
handler.setClientDetailsService(clientDetailsService());
return handler;
}
@Bean
@Autowired
public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception
{
TokenApprovalStore store = new TokenApprovalStore();
store.setTokenStore(tokenStore);
return store;
}
}
获取认证后的信息:
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
Object principal = authentication == null ? null : authentication.getPrincipal();
修改的就是principal 中的信息,但没有修改redis中的信息,本想直接操作redis中存储的对象,但担心打乱spring security自身存储的数据结构,苦苦寻找并自己研究了两天,始终没能找到答案。
spring security源码后,发现信息是在Tokenstone接口中新增的,由于该接口没有提供修改方法,所以重写了新增的方法,覆盖了redis中的信息。
@Autowired
private TokenStore tokenStore;
@Autowired
private RedisConnectionFactory connectionFactory;
private AuthenticationKeyGenerator authenticationKeyGenerator=new
DefaultAuthenticationKeyGenerator();
private JdkSerializationStrategy serializationStrategy=new JdkSerializationStrategy();
//更新redis中的token相关信息
OAuth2Authentication authentication = (OAuth2Authentication)SecurityContextHolder.getContext().getAuthentication();
String key = authenticationKeyGenerator.extractKey(authentication);
byte[] serializedKey = serializationStrategy.serialize("auth_to_access:" + key);
byte[] bytes = null;
RedisConnection conn = connectionFactory.getConnection();
try {
bytes = conn.get(serializedKey);
} finally {
conn.close();
}
OAuth2AccessToken accessToken =serializationStrategy.deserialize(bytes,
OAuth2AccessToken.class);
tokenStore.storeAccessToken(accessToken, authentication);