Spring Security Oauth2 扩展grant_type

Question

Spring Security Oauth2 扩展grant_type，应该怎么扩展
比如，新增一个grant_type="username",只需要校验账号即可

Answer 1

引自免费微信小程序：皆我百晓生

在Spring Security OAuth2中，如果你想要扩展新的grant_type，你需要实现OAuth2AuthorizationRequestResolver接口，并且注册一个新的ClientDetailsService，以便在处理授权请求时能够识别这个新的grant_type。

首先，创建一个新的OAuth2AuthorizationRequestResolver实现类，例如UsernameAuthorizationRequestResolver：

import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationRequest;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationRequestResolver;

public class UsernameAuthorizationRequestResolver implements OAuth2AuthorizationRequestResolver {

    @Override
    public OAuth2AuthorizationRequest resolve(HttpServletRequest request) {
        String grantType = request.getParameter("grant_type");
        
        if ("username".equals(grantType)) {
            String username = request.getParameter("username");
            String clientId = request.getParameter("client_id");

            // 根据实际应用逻辑获取用户信息，这里仅作示例
            User user = getUser(username);

            return OAuth2AuthorizationRequest.from(AuthorizationGrantType.USERNAME_PASSWORD, clientId)
                    .principal(user)
                    .build();
        }

        return null; // 如果不是"username" grant_type，则返回null
    }

    private User getUser(String username) {
        // 实际应用中应从数据库或其他存储中查找用户
        return new User(username);
    }
}

接下来，你需要配置一个新的ClientDetailsService。Spring Boot默认使用的是InMemoryClientDetailsService，但为了支持新的grant_type，你需要自定义一个：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer.AuthorizeEndpointConfigurerAdapter;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
import org.springframework.security.oauth2.core.oidc.IdTokenClaimNames;
import org.springframework.security.oauth2.jdbc.JdbcClientDetailsService;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationServiceConfiguration;

@Configuration
@EnableAuthorizationServer
public class OAuth2Config {

    @Bean
    public JdbcClientDetailsService clientDetailsService(ClientRegistrationRepository clientRegistrationRepository) {
        return new JdbcClientDetailsService(clientRegistrationRepository);
    }

    @Bean
    public OAuth2AuthorizationRequestResolver usernameAuthorizationRequestResolver() {
        return new UsernameAuthorizationRequestResolver();
    }

    @Bean
    public OAuth2AuthorizationService authorizationService(OAuth2AuthorizationServiceConfiguration serviceConfiguration,
                                                            OAuth2AuthorizationRequestResolver resolver) {
        return serviceConfiguration.authorizationService(resolver);
    }

    @Configuration
    protected static class AuthorizationServerSettings extends AuthorizeEndpointConfigurerAdapter {

        @Override
        public void configure(AuthorizeEndpointConfigurer configurer) {
            configurer.authorizationRequestResolver(usernameAuthorizationRequestResolver());
        }
    }
}

在这个配置中，我们添加了一个新的OAuth2AuthorizationRequestResolver实例到AuthorizationServerEndpointsConfigurer中，这样当处理授权请求时，它会检查是否是"username" grant_type。

注意：这个例子中的User类是一个简单的示例，你需要根据实际情况替换为你的用户模型，并且可能需要从数据库或者其他存储中获取用户信息。

此外，确保你的客户端配置支持新的grant_type。你可以在application.yml或application.properties文件中添加：

spring:
  security:
    oauth2:
      client:
        registration:
          your-client-id:
            client-id: your-client-id
            client-secret: your-client-secret
            scope: read,write
            redirect-uri-template: "{baseUrl}/login/oauth2/code/{registrationId}"
            authorized-grant-types: password,refresh_token,client_credentials,username

现在，你应该能够在你的应用程序中使用"username" grant_type进行授权了。不过请注意，这只是一个基础实现，你可能还需要处理错误、验证等其他方面的需求。