统一认证中心 Oauth2 认证坑

作者：Xiao8

2022 年 6 月 10 日
本文字数：3690 字
阅读完需：约 12 分钟

在前面文章 Springcloud Oauth2 HA篇中，实现了基于 Oauth2 的统一认证的认证与授权。在配置中，我们可以看到：

cas-server-url: http://cas-server-service #这里配置成HA地址
security:  oauth2: #与cas-server对应的配置    client:      client-id: admin-web      client-secret: admin-web-123      user-authorization-uri: ${cas-server-url}/oauth/authorize #是授权码认证方式需要的      access-token-uri: ${cas-server-url}/oauth/token #是密码模式需要用到的获取 token 的接口    resource:      loadBalanced: true      id: admin-web      user-info-uri: ${cas-server-url}/api/user #指定user info的URI      prefer-token-info: false

复制代码

这里的 url 配置是基于 k8s 的 Service，实现负载均衡，从而实现高可用。但我们接下来分析 user-info-uri。user-info-uri 的原理是在授权服务器认证后将认证信息 Principal 通过形参绑定的方法通过 URL 的方式获取用户信息。当然它也有配套的 UserInfoTokenService 等。

但这个在客户端获取用户权限时候，是存在一定问题的。譬如 Web 端请求消费端的某个接口：

/** * 返回发现的所有服务 * @author Damon * @date 2021年11月2日 下午8:18:44 * @return * */@PreAuthorize("hasRole('admin')")  @GetMapping(value = "/getService")    public String getService(){    HttpHeaders headers = new HttpHeaders();    MediaType type = MediaType.parseMediaType("application/json; charset=UTF-8");    headers.setContentType(type);    headers.add("Accept", MediaType.APPLICATION_JSON.toString());    HttpEntity<String> formEntity = new HttpEntity<String>(null, headers);    String body = "";    try {      ResponseEntity<String> responseEntity = restTemplate.exchange("http://cas-server/api/v1/user",          HttpMethod.GET, formEntity, String.class);      if (responseEntity.getStatusCodeValue() == 200) {        return "ok";      }    } catch (Exception e) {      System.out.println(e.getMessage());    }    return body;    }

复制代码

在这个接口中，我们通过添加@PreAuthorize("hasRole('admin')")来控制权限，只要是 admin 的用户才能访问改接口。

我们先来请求认证中心登录接口，获取 token：

在拿到 token 之后，我们请求这个接口，我们会发现：

说明未认证，我们再看看：发现原来当请求这个接口时，消费端后去请求认证中心的接口：

2021-11-03 15:59:09.385 DEBUG 127896 --- [io2-2001-exec-4] org.springframework.web.HttpLogging      : HTTP GET http://cas-server/auth/user2021-11-03 15:59:09.389 DEBUG 127896 --- [io2-2001-exec-4] org.springframework.web.HttpLogging      : Accept=[application/json, application/*+json]2021-11-03 15:59:09.427 DEBUG 127896 --- [io2-2001-exec-4] org.springframework.web.HttpLogging      : Response 404 NOT_FOUND2021-11-03 15:59:09.446 DEBUG 127896 --- [io2-2001-exec-4] o.s.w.c.HttpMessageConverterExtractor    : Reading to [org.springframework.security.oauth2.common.exceptions.OAuth2Exception]2021-11-03 15:59:09.456  WARN 127896 --- [io2-2001-exec-4] o.s.b.a.s.o.r.UserInfoTokenServices      : Could not fetch user details: class org.springframework.web.client.HttpClientErrorException$NotFound, 404 : [{"timestamp":"2021-11-03T07:59:09.423+00:00","status":404,"error":"Not Found","message":"","path":"/auth/user"}]2021-11-03 15:59:09.457 ERROR 127896 --- [io2-2001-exec-4] c.l.h.CustomAuthenticationEntryPoint     : 无效的token，请重新认证访问{"data":"b34841b4-61fa-4dbb-9e2b-76496deb27b4","result":{"code":20202,"msg":"未认证","status":401}}

复制代码

但认证中心给返回的404状态码，此时会走统一异常 EntryPoint 提示报错：无效的token，请重新认证访问。从而返回信息体：{"data":"b34841b4-61fa-4dbb-9e2b-76496deb27b4","result":{"code":20202,"msg":"未认证","status":401}}。

接下来分析：为什么认证中心会返回404呢？看认证中心日志：

2021-11-03 15:59:09.407 DEBUG 54492 --- [o2-2000-exec-15] o.s.web.servlet.DispatcherServlet        : GET "/auth/user", parameters={}2021-11-03 15:59:09.409 DEBUG 54492 --- [o2-2000-exec-15] o.s.w.s.handler.SimpleUrlHandlerMapping  : Mapped to ResourceHttpRequestHandler ["classpath:/META-INF/resources/", "classpath:/resources/", "classpath:/static/", "classpath:/public/"]2021-11-03 15:59:09.413 DEBUG 54492 --- [o2-2000-exec-15] o.s.w.s.r.ResourceHttpRequestHandler     : Resource not found2021-11-03 15:59:09.414 DEBUG 54492 --- [o2-2000-exec-15] o.s.web.servlet.DispatcherServlet        : Completed 404 NOT_FOUND2021-11-03 15:59:09.422 DEBUG 54492 --- [o2-2000-exec-15] o.s.web.servlet.DispatcherServlet        : "ERROR" dispatch for GET "/error", parameters={}2021-11-03 15:59:09.423 DEBUG 54492 --- [o2-2000-exec-15] s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to org.springframework.boot.autoconfigure.web.servlet.error.BasicErrorController#error(HttpServletRequest)2021-11-03 15:59:09.424 DEBUG 54492 --- [o2-2000-exec-15] o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Using 'application/json', given [application/json] and supported [application/json, application/*+json, application/json, application/*+json, application/json, application/*+json]2021-11-03 15:59:09.424 DEBUG 54492 --- [o2-2000-exec-15] o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Writing [{timestamp=Wed Nov 03 15:59:09 CST 2021, status=404, error=Not Found, message=, path=/auth/user}]2021-11-03 15:59:09.426 DEBUG 54492 --- [o2-2000-exec-15] o.s.web.servlet.DispatcherServlet        : Exiting from "ERROR" dispatch, status 404

复制代码

发现原来 Oauth2 没有此类接口:/auth/user。最后决定自写一个接口来替换原生:

@GetMapping("/api/v1/user")    public Authentication user(Map map, Principal user, Authentication auth) {        //获取当前用户信息      logger.info("cas-server provide user: " + JSON.toJSONString(auth));        return auth;    }

复制代码

在封装、覆盖后，在消费端直接配置相关配置：

cas-server-url: http://cas-server
security:  path:    ignores: /,/index,/static/**,/css/**, /image/**, /favicon.ico, /js/**,/plugin/**,/avue.min.js,/img/**,/fonts/**  oauth2:    client:      client-id: rest-service      client-secret: rest-service-123      user-authorization-uri: ${cas-server-url}/oauth/authorize      access-token-uri: ${cas-server-url}/oauth/token    resource:      loadBalanced: true      id: rest-service      prefer-token-info: false      user-info-uri: ${cas-server-url}/api/v1/user    authorization:      check-token-access: ${cas-server-url}/oauth/check_token

复制代码

同时启动认证中心、消费端，继续获取 token 后，请求接口：

此时，发现是403，没有权限了，这下我们可以对用户添加这种权限即可：

"authorities": [ { "authority": "ROLE_admin" }, { "authority": "admin" }

复制代码

添加完之后，我们发现可以请求接口成功：

{ "authorities": [ { "authority": "ROLE_admin" }, { "authority": "admin" } ], "details": { "remoteAddress": "0:0:0:0:0:0:0:1", "sessionId": null, "tokenValue": "b34841b4-61fa-4dbb-9e2b-76496deb27b4", "tokenType": "bearer", "decodedDetails": null }, "authenticated": true, "userAuthentication": { "authorities": [ { "authority": "ROLE_admin" }, { "authority": "admin" } ], "details": { "authorities": [ { "authority": "ROLE_admin" }, { "authority": "admin" } ], "details": { "remoteAddress": "169.254.200.12", "sessionId": null, "tokenValue": "b34841b4-61fa-4dbb-9e2b-76496deb27b4", "tokenType": "Bearer", "decodedDetails": null }, "authenticated": true, "userAuthentication": { "authorities": [ { "authority": "ROLE_admin" }, { "authority": "admin" } ],...

复制代码

这里简单测试，直接写的返回当前用户权限的接口，发现权限就是"ROLE_admin、"admin"。