java oauth2 client,Spring OAuth2 - Client Credentials授权类型中的用户信息

我一直在开发Spring Cloud(使用Netflix OSS堆栈)微服务架构 . 正如您所料，我将授权服务器分离为独立的微服务 . 我的前端应用程序使用“密码”授予类型进行用户登录 . 但是，我正在使用“客户端凭据”授权类型来进行从前端服务到其他后端服务的其余调用 . 客户端凭证授权类型也在其他后端服务中使用 . 通过这样做，我无法得到谁是请求的实际调用者(当前登录用户) . 有没有办法将主体的身份验证和授权信息注入到客户端凭据授予中发出的令牌？

我的授权服务器配置类

@Configuration

@EnableAuthorizationServer

@Order(Ordered.HIGHEST_PRECEDENCE)

public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {

@Autowired

private AuthenticationManager authenticationManager;

@Override

public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {

oauthServer.tokenKeyAccess("permitAll()")

.checkTokenAccess("isAuthenticated()");

}

@Override

public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {

clients.inMemory()

.withClient("testclient")

.secret("{noop}testsecret")

.authorizedGrantTypes("authorization_code","password","client_credentials")

.scopes("ui")

.autoApprove(true)

// .accessTokenValiditySeconds(3600)

.and()

.withClient("backend-service")

.secret("{noop}backendsecret")

.authorizedGrantTypes("client_credentials","refresh_token")

.scopes("server")

.autoApprove(true)

}

@Override

public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

endpoints.authenticationManager(authenticationManager);

endpoints.tokenEnhancer(tokenEnhancer());

endpoints.tokenStore(tokenStore());

}

@Bean

public TokenStore tokenStore() {

//return new JdbcTokenStore(dataSource);

return new InMemoryTokenStore();

}

@Bean

@Primary

public AuthorizationServerTokenServices tokenServices() {

DefaultTokenServices tokenServices = new DefaultTokenServices();

tokenServices.setTokenEnhancer(tokenEnhancer());

tokenServices.setTokenStore(tokenStore());

return tokenServices;

}

@Bean

public TokenEnhancer tokenEnhancer() {

return new CustomTokenEnhancer();

}

安全配置类

@Configuration

@Order(1)

public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Override

protected void configure(HttpSecurity http) throws Exception {

http.csrf().disable()

.requestMatchers()

.antMatchers("/login", "/oauth/authorize")

.and()

.authorizeRequests()

.antMatchers("/resources/**", "/src/main/webapp/**","/css/**","/images/**").permitAll()

.and()

.formLogin()

.loginPage("/login")

.permitAll()

.and()

.logout()

.permitAll().and().httpBasic().disable();

}

@Override

public void configure(WebSecurity web) throws Exception {

web.ignoring().antMatchers("/static/**","/resources/**", "/src/main/webapp/**","/css/**","/images/**");

}

@Override

@Bean

public AuthenticationManager authenticationManagerBean() throws Exception {

return super.authenticationManagerBean();

}

@Override

protected void configure(final AuthenticationManagerBuilder auth) throws Exception {

auth.inMemoryAuthentication().withUser("admin").password("{noop}a1b2c3#").roles("User");

}

}

我试图实现一个Token Enhancer类来传播令牌中的其他数据 . 但是，我不认为这是我正在努力实现的正确和安全的方式 .

public class CustomTokenEnhancer implements TokenEnhancer {

@Override

public OAuth2AccessToken enhance(OAuth2AccessToken oAuth2AccessToken, OAuth2Authentication oAuth2Authentication) {

final Map additionalInfo = new HashMap<>();

additionalInfo.put("customInfo", "testdata");

((DefaultOAuth2AccessToken) oAuth2AccessToken).setAdditionalInformation(additionalInfo);

return oAuth2AccessToken;

}

}

非常感谢您的协助 .