访问资源服务器控制器内的 Spring OAuth 2 JWT 有效负载?

2022-01-10 00:00:00 jwt java spring-boot spring-security spring-oauth2

我正在通过 本教程了解如何设置 Spring Boot oauth与 jwt.它涵盖了使用 Angular 解码 JWT 令牌，但我们如何解码它并访问资源服务器控制器内的自定义声明?

I'm going through this tutorial on how to setup spring boot oauth with jwt. It covers decoding the JWT token using Angular, but how do we decode it and get access to custom claims inside the Resource Server controller?

例如，使用 JJWT 可以这样做(基于这篇文章):

For example with JJWT it can be done like this (Based on this article): 

    String subject = "HACKER";
    try {
        Jws jwtClaims = 
            Jwts.parser().setSigningKey(key).parseClaimsJws(jwt);

        subject = claims.getBody().getSubject();

        //OK, we can trust this JWT

    } catch (SignatureException e) {

        //don't trust the JWT!
    }

Spring 有一个 JWTAccessTokenConverter.decode() 方法，但是缺少javadoc，它是受保护的.

And Spring has a JWTAccessTokenConverter.decode() method, but the javadoc is lacking, and it is protected.

推荐答案

这是我在 Spring Boot 中访问自定义 JWT 声明的方式:

Here is how I am accessing custom JWT claims in Spring Boot:

1) 让 Spring 将 JWT 内容复制到 Authentication 中:

1) Get Spring to copy JWT content into Authentication:

@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends ResourceServerConfigurerAdapter{

    @Override
    public void configure(ResourceServerSecurityConfigurer config) {
        config.tokenServices( createTokenServices() );
    }

    @Bean
    public DefaultTokenServices createTokenServices() {
        DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setTokenStore( createTokenStore() );
        return defaultTokenServices;
    }

    @Bean
    public TokenStore createTokenStore() {               
        return new JwtTokenStore( createJwtAccessTokenConverter() );
    }

    @Bean
    public JwtAccessTokenConverter createJwtAccessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();     
        converter.setAccessTokenConverter( new JwtConverter() );
        return converter;
    }

    public static class JwtConverter extends DefaultAccessTokenConverter implements JwtAccessTokenConverterConfigurer {

        @Override
        public void configure(JwtAccessTokenConverter converter) {
            converter.setAccessTokenConverter(this);
        }

        @Override
        public OAuth2Authentication extractAuthentication(Map<String, ?> map) {
            OAuth2Authentication auth = super.extractAuthentication(map);
            auth.setDetails(map); //this will get spring to copy JWT content into Authentication
            return auth;
        }
    }
}

2) 在代码中的任何位置访问令牌内容:

2) Access token content anywhere in your code: 

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();        
Object details = authentication.getDetails();        
if ( details instanceof OAuth2AuthenticationDetails ){
    OAuth2AuthenticationDetails oAuth2AuthenticationDetails = (OAuth2AuthenticationDetails)details;

    Map<String, Object> decodedDetails = (Map<String, Object>)oAuth2AuthenticationDetails.getDecodedDetails();

    System.out.println( "My custom claim value: " + decodedDetails.get("MyClaim") );
}

相关文章