SpringBoot应用中LinkedIn OAuth2登录失效问题求助

核心问题分析 #

1. LinkedIn的OIDC适配缺失：LinkedIn的OAuth2实现更贴近OIDC标准，而你当前仅配置了OAuth2UserService，未适配OIDC流程，导致Spring Security无法正确处理LinkedIn的用户信息请求， fallback到了全局自定义的MyAuthenticationManager。
2. 自定义AuthenticationManager全局生效：你手动注册的MyAuthenticationManager被Spring Security作为全局认证管理器使用，但它仅支持用户名密码认证，完全不兼容OAuth2的认证Token，因此LinkedIn登录时会进入错误的认证流程。
3. 安全配置顺序冲突：原配置中对/login启用了HTTP Basic认证，和OAuth2登录的端点逻辑冲突，导致请求被错误的过滤器拦截。

具体修复步骤 #

1. 调整SecurityFilterChain配置 #

先移除冲突的HTTP Basic配置，同时为OAuth2登录添加上OIDC用户服务适配：

@Bean
public SecurityFilterChain filterChain(
        HttpSecurity http,
        CustomOauth2UserService customOauth2UserService,
        CustomOidcUserService customOidcUserService
) throws Exception {
    http.cors(Customizer.withDefaults());
    http.csrf(AbstractHttpConfigurer::disable);

    // 先配置全局授权规则，再绑定认证方式
    http.authorizeHttpRequests(auth -> {
                auth.requestMatchers(
                        "/signup",
                        "/password-reset/forgot-password"
                ).permitAll();
                auth.anyRequest().authenticated();
            })
            .formLogin(form -> form.loginPage("/login"))
            .oauth2Login(oauth -> oauth
                    .successHandler(authenticationSuccessHandler)
                    .userInfoEndpoint(userInfo -> userInfo
                            .userService(customOauth2UserService)
                            // 适配LinkedIn的OIDC流程
                            .oidcUserService(customOidcUserService)))
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);

    return http.build();
}

2. 实现CustomOidcUserService #

专门处理LinkedIn的OIDC用户信息：

@Component
public class CustomOidcUserService extends DefaultOidcUserService {
    private final UserService userService;
    private final UsersRepository usersRepository;

    @Autowired
    public CustomOidcUserService(UserService userService, UsersRepository usersRepository) {
        this.userService = userService;
        this.usersRepository = usersRepository;
    }

    @Override
    public OidcUser loadUser(OidcUserRequest userRequest) throws OAuth2AuthenticationException {
        OidcUser oidcUser = super.loadUser(userRequest);
        RegistrationForm registrationForm = mapOidcUserToRegistrationForm(oidcUser);
        String email = oidcUser.getEmail();
        var existingUser = usersRepository.findByEmailIgnoreCase(email);
        existingUser.orElseGet(() -> userService.createUser(registrationForm));
        return oidcUser;
    }

    private RegistrationForm mapOidcUserToRegistrationForm(OidcUser oidcUser) {
        RegistrationForm registrationForm = new RegistrationForm();
        registrationForm.setEmail(oidcUser.getEmail());
        registrationForm.setPassword(String.valueOf(Hex.encodeHex(RandomUtils.nextBytes(32))));
        registrationForm.setFirstName(oidcUser.getGivenName());
        registrationForm.setLastName(oidcUser.getFamilyName());
        return registrationForm;
    }
}

3. 限制自定义认证管理器的作用范围 #

把MyAuthenticationManager替换为DaoAuthenticationProvider，仅用于表单登录的用户名密码认证，避免全局覆盖OAuth2逻辑：

@Bean
public AuthenticationManager authenticationManager(
        UsersRepository usersRepository,
        PasswordEncoder passwordEncoder,
        AuthenticationConfiguration authConfig
) throws Exception {
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setUserDetailsService(username -> usersRepository.findByEmailIgnoreCase(username)
            .orElseThrow(() -> new UsernameNotFoundException("Unknown email: " + username)));
    provider.setPasswordEncoder(passwordEncoder);
    
    return authConfig.getAuthenticationManager();
}

4. 校验LinkedIn的配置属性 #

确保配置文件中LinkedIn的OAuth2参数正确：

spring.security.oauth2.client.registration.linkedin.client-id=你的客户端ID
spring.security.oauth2.client.registration.linkedin.client-secret=你的客户端密钥
spring.security.oauth2.client.registration.linkedin.scope=openid,profile,email
spring.security.oauth2.client.provider.linkedin.authorization-uri=https://www.linkedin.com/oauth/v2/authorization
spring.security.oauth2.client.provider.linkedin.token-uri=https://www.linkedin.com/oauth/v2/accessToken
spring.security.oauth2.client.provider.linkedin.user-info-uri=https://api.linkedin.com/v2/userinfo
spring.security.oauth2.client.provider.linkedin.user-name-attribute=email

内容的提问来源于stack exchange，提问作者Rohit Singh