Spring 未找到安全 OAuth 重定向端点

Question

我已将 Spring 安全性添加到现有 JEE 应用程序以将 OAuth 添加到该应用程序。安全配置设置为保护 REST API，这部分似乎工作正常。当 UI 请求受保护的 URL 时，响应包含到 'oauth2/authorize/keycloak'.

的重定向

但这就是故事的结尾，因为对 'oauth2/authorize/keycloak' 本身的请求 returns 是 404。

我对 spring 安全性已经过时了（上次在 Spring 应用程序中使用它大约是 8 年前）而且我不知道应该在哪里找到实现端点 'oauth2/authorize/keycloak' 以便找出我的设置中缺少或错误的内容。

我的依赖关系树的相关部分如下所示：

[INFO] |  +- com.mycompany.auth:authentication-sso-configuration:jar:1.0.0-SNAPSHOT:compile
[INFO] |  |  +- org.reactivestreams:reactive-streams:jar:1.0.3:compile
[INFO] |  |  +- org.springframework.security:spring-security-oauth2-client:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  +- com.nimbusds:oauth2-oidc-sdk:jar:7.5:compile
[INFO] |  |  |  |  +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO] |  |  |  |  +- com.nimbusds:content-type:jar:2.0:compile
[INFO] |  |  |  |  +- net.minidev:json-smart:jar:2.3:compile (version selected from constraint [1.3.1,2.3])
[INFO] |  |  |  |  |  \- net.minidev:accessors-smart:jar:1.2:compile
[INFO] |  |  |  |  |     \- org.ow2.asm:asm:jar:5.0.4:compile
[INFO] |  |  |  |  \- com.nimbusds:lang-tag:jar:1.4.4:compile
[INFO] |  |  |  +- org.springframework.security:spring-security-oauth2-core:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  \- org.springframework:spring-core:jar:5.2.6.RELEASE:compile
[INFO] |  |  |     \- org.springframework:spring-jcl:jar:5.2.6.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-oauth2-jose:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  \- com.nimbusds:nimbus-jose-jwt:jar:8.18.1:compile
[INFO] |  |  +- org.springframework.security:spring-security-oauth2-resource-server:jar:5.3.3.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-core:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  +- org.springframework:spring-aop:jar:5.2.6.RELEASE:compile
[INFO] |  |  |  +- org.springframework:spring-beans:jar:5.2.6.RELEASE:compile
[INFO] |  |  |  +- org.springframework:spring-context:jar:5.2.6.RELEASE:compile
[INFO] |  |  |  \- org.springframework:spring-expression:jar:5.2.6.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-web:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  \- org.springframework:spring-web:jar:5.2.6.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-config:jar:5.3.3.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-saml2-service-provider:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  +- org.opensaml:opensaml-core:jar:3.4.5:compile
[INFO] |  |  |  |  +- io.dropwizard.metrics:metrics-core:jar:3.1.2:compile
[INFO] |  |  |  |  \- net.shibboleth.utilities:java-support:jar:7.5.1:compile
[INFO] |  |  |  +- org.opensaml:opensaml-saml-api:jar:3.4.5:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-xmlsec-api:jar:3.4.5:compile
[INFO] |  |  |  |  |  \- org.opensaml:opensaml-security-api:jar:3.4.5:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-soap-api:jar:3.4.5:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-messaging-api:jar:3.4.5:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-profile-api:jar:3.4.5:compile
[INFO] |  |  |  |  \- org.opensaml:opensaml-storage-api:jar:3.4.5:compile
[INFO] |  |  |  \- org.opensaml:opensaml-saml-impl:jar:3.4.5:compile
[INFO] |  |  |     +- org.opensaml:opensaml-security-impl:jar:3.4.5:compile
[INFO] |  |  |     +- org.opensaml:opensaml-xmlsec-impl:jar:3.4.5:compile
[INFO] |  |  |     |  \- org.apache.santuario:xmlsec:jar:2.0.10:compile
[INFO] |  |  |     |     \- com.fasterxml.woodstox:woodstox-core:jar:5.0.3:compile
[INFO] |  |  |     |        \- org.codehaus.woodstox:stax2-api:jar:3.1.4:compile
[INFO] |  |  |     +- org.opensaml:opensaml-soap-impl:jar:3.4.5:compile
[INFO] |  |  |     \- org.apache.velocity:velocity:jar:1.7:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-core:jar:2.13.3:compile
[INFO] |  |  +- org.yaml:snakeyaml:jar:1.26:compile
[INFO] |  |  +- commons-collections:commons-collections:jar:3.2.2:compile
[INFO] |  |  +- org.bouncycastle:bcprov-jdk15on:jar:1.66:compile
[INFO] |  |  +- org.cryptacular:cryptacular:jar:1.2.4:compile
[INFO] |  |  \- org.apache.commons:commons-configuration2:jar:2.7:compile
[INFO] |  |     \- org.apache.commons:commons-text:jar:1.8:compile

这是 OAuth 的配置

# OAuth2 login manifest
oauth2Login:
  authorizationCode:
    authorizationUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/auth"
    scope:
      - "openid"
      - "finx"
    redirectUriTemplate: "{baseUrl}/login/oauth2/code/{registrationId}"
    tokenUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/token"
    userInfoUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/userinfo"
    jwkSetKeyUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/certs"
    registrationId: "keycloak"
    clientId: "finx_oauth2"
    clientSecret:
      vaultType: PLAIN_TEXT
      secret: "my-secret"
    clientName: "FinX"
    entryPoints:
      - pathMatcher: "/ledger-api/**"
      - pathMatcher: "/ledger-api-internal/**"
      - pathMatcher: "/ledger-api-ui/**"
# OAuth2 resource server
oauth2ResourceServer:
  keySetUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/certs"
  pathMatchers:
    - "/api/**"
    - "/orchestration-api/**"

我一直在挖掘 spring 源代码以找到端点 'oauth2/authorize/keycloak' 的实现，但这不是一件容易的事。

所以寻找可以帮助我的人，了解我的配置中可能 missing/wrong 的内容。

Answer 1

默认情况下，OAuth 2.0 登录页面是 auto-generated DefaultLoginPageGeneratingFilter。
客户端的登录页面默认为：OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI + "/{registrationId}"。根据您的配置，registrationId: "keycloak"，这意味着 (/oauth2/authorization/keycloak).

请检查您的 WebSecurityConfigurerAdapter 配置。尝试通过配置 oauth2Login().loginPage() 和（可选）oauth2Login().authorizationEndpoint().baseUri().

来覆盖默认登录页面

以下清单显示了一个示例：

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .oauth2Login()
            .loginPage("/login/oauth2")
            ...
            .authorizationEndpoint()
                .baseUri("/login/oauth2/authorization")
                ....
}

请查看OAuth 2.0 Login - Advanced Configuration了解更多信息。

Spring 未找到安全 OAuth 重定向端点

Spring security OAuth redirect endpoint not found

oauth-2.0

java-ee-7

spring-security-oauth2