如何在Spring Cloud Gateway中配置路由以将OAuth2客户端与authorization-grant-type: password
一起使用?换句话说,如何在对API的请求中添加带有令牌的Authorization标头?因为我正在与旧版应用程序集成,所以必须使用授权类型密码。
我有这个应用程序:
@SpringBootApplication
public class DemoApplication {
public static void main(String[] args) {
SpringApplication.run(DemoApplication.class, args);
}
@Bean
public RouteLocator customRouteLocator(RouteLocatorBuilder builder) {
return builder.routes()
.route("route_path", r -> r.path("/**")
.filters(f -> f.addRequestHeader("Authorization", "bearer <token>"))
.uri("http://localhost:8092/messages"))
.build();
}
}
用实际的令牌代替<token>
,一切正常。
我发现这个项目执行类似的操作:https://github.com/jgrandja/spring-security-oauth-5-2-migrate。它具有一个客户端(messaging-client-password
),该客户端用于配置WebClient
以添加OAuth2支持以发出请求(即通过添加Authorization标头)。
我们无法立即使用此示例项目,因为Spring Cloud Gateway是反应性的,并且我们配置事物的方式发生了巨大变化。我认为解决这个问题主要是关于转换WebClientConfig类。
更新
我有点使它起作用,但是它的形状非常糟糕。
首先,我发现了如何将WebClientConfig
转换为被动式的:
@Configuration
public class WebClientConfig {
@Bean
WebClient webClient(ReactiveOAuth2AuthorizedClientManager authorizedClientManager) {
ServerOAuth2AuthorizedClientExchangeFilterFunction oauth =
new ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
oauth.setDefaultOAuth2AuthorizedClient(true);
oauth.setDefaultClientRegistrationId("messaging-client-password");
return WebClient.builder()
.filter(oauth)
.build();
}
@Bean
ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
ReactiveClientRegistrationRepository clientRegistrationRepository,
ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.refreshToken()
.password()
.build();
DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
new DefaultReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository);
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
// For the `password` grant, the `username` and `password` are supplied via request parameters,
// so map it to `OAuth2AuthorizationContext.getAttributes()`.
authorizedClientManager.setContextAttributesMapper(contextAttributesMapper());
return authorizedClientManager;
}
private Function<OAuth2AuthorizeRequest, Mono<Map<String, Object>>> contextAttributesMapper() {
return authorizeRequest -> {
Map<String, Object> contextAttributes = Collections.emptyMap();
ServerWebExchange serverWebExchange = authorizeRequest.getAttribute(ServerWebExchange.class.getName());
String username = serverWebExchange.getRequest().getQueryParams().getFirst(OAuth2ParameterNames.USERNAME);
String password = serverWebExchange.getRequest().getQueryParams().getFirst(OAuth2ParameterNames.PASSWORD);
if (StringUtils.hasText(username) && StringUtils.hasText(password)) {
contextAttributes = new HashMap<>();
// `PasswordOAuth2AuthorizedClientProvider` requires both attributes
contextAttributes.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
contextAttributes.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
}
return Mono.just(contextAttributes);
};
}
}
使用此配置,我们可以使用WebClient
发出请求。调用端点后,这会以某种方式初始化OAuth2客户端:
@GetMapping("/explicit")
public Mono<String[]> explicit() {
return this.webClient
.get()
.uri("http://localhost:8092/messages")
.attributes(clientRegistrationId("messaging-client-password"))
.retrieve()
.bodyToMono(String[].class);
}
然后,通过调用此客户端,我们可以获取对授权客户端的引用:
private OAuth2AuthorizedClient authorizedClient;
@GetMapping("/token")
public String token(@RegisteredOAuth2AuthorizedClient("messaging-client-password") OAuth2AuthorizedClient authorizedClient) {
this.authorizedClient = authorizedClient;
return authorizedClient.getAccessToken().getTokenValue();
}
最后,通过配置全局过滤器,我们可以修改请求以包括Authorization标头:
@Bean
public GlobalFilter customGlobalFilter() {
return (exchange, chain) -> {
//adds header to proxied request
exchange.getRequest().mutate().header("Authorization", authorizedClient.getAccessToken().getTokenType().getValue() + " " + authorizedClient.getAccessToken().getTokenValue()).build();
return chain.filter(exchange);
};
}
依次运行这三个请求后,我们可以在Spring Cloud Gateway中使用密码授予。
当然,此过程非常混乱。仍然需要做的事情:
contextAttributesMapper
答案 0 :(得分:0)
我使用WebClientHttpRoutingFilter
实现了授权授权类型:密码。
默认情况下,Spring Cloud网关使用Netty路由过滤器,但是有一种替代方案不需要Netty(https://cloud.spring.io/spring-cloud-gateway/reference/html/#the-netty-routing-filter)
WebClientHttpRoutingFilter
使用WebClient
路由请求。
WebClient
可以通过ReactiveOAuth2AuthorizedClientManager
(https://docs.spring.io/spring-security/site/docs/current/reference/html5/#webclient)中的ExchangeFilterFunction
进行配置。 ReactiveOAuth2AuthorizedClientManager
将负责管理访问/刷新令牌,并将为您完成所有辛苦的工作
Here,您可以查看此实现。另外,我通过这种方法实现了客户凭证授予