如何禁用Spring Boot OAuth登录菜单并实现按路径自动重定向

一、核心思路 #

要实现两个目标：

• 跳过默认的多Client登录选择页面，直接触发对应Client的授权流程
• 根据请求路径（/first/**或/second/**）自动匹配对应的first-client或second-client

核心是通过自定义授权请求解析器，根据请求路径动态选择ClientRegistrationId，同时配置SecurityFilterChain让未认证请求直接走对应Client的授权流程，避免出现选择菜单。

二、具体实现步骤 #

1. 自定义授权请求解析器 #

创建一个自定义的ServerOAuth2AuthorizationRequestResolver，根据请求路径判断要使用的Client ID：

import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.server.DefaultServerOAuth2AuthorizationRequestResolver;
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizationRequestResolver;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

public class PathBasedAuthorizationRequestResolver implements ServerOAuth2AuthorizationRequestResolver {

    private final ServerOAuth2AuthorizationRequestResolver defaultResolver;

    public PathBasedAuthorizationRequestResolver(ReactiveClientRegistrationRepository clientRegistrationRepository) {
        this.defaultResolver = new DefaultServerOAuth2AuthorizationRequestResolver(clientRegistrationRepository);
    }

    @Override
    public Mono<org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest> resolve(ServerWebExchange exchange) {
        return getClientRegistrationId(exchange)
                .flatMap(clientId -> defaultResolver.resolve(exchange, clientId));
    }

    @Override
    public Mono<org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest> resolve(ServerWebExchange exchange, String clientRegistrationId) {
        return defaultResolver.resolve(exchange, clientRegistrationId);
    }

    private Mono<String> getClientRegistrationId(ServerWebExchange exchange) {
        String path = exchange.getRequest().getPath().value();
        if (path.startsWith("/first/")) {
            return Mono.just("first-client");
        } else if (path.startsWith("/second/")) {
            return Mono.just("second-client");
        }
        return Mono.empty();
    }
}

2. 配置Spring Security Filter Chain #

在配置类中注册自定义解析器，并配置SecurityFilterChain，让未认证请求直接触发对应Client的授权流程，同时禁用默认的登录页面：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizationRequestResolver;
import org.springframework.security.web.server.SecurityWebFilterChain;

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http,
                                                           ReactiveClientRegistrationRepository clientRegistrationRepository) {
        http
                .authorizeExchange(exchanges -> exchanges
                        .pathMatchers("/first/**", "/second/**").authenticated()
                        .anyExchange().permitAll()
                )
                .oauth2Login(oauth2 -> oauth2
                        .authorizationRequestResolver(new PathBasedAuthorizationRequestResolver(clientRegistrationRepository))
                )
                .exceptionHandling(exceptions -> exceptions
                        .authenticationEntryPoint((exchange, ex) -> {
                            // 直接触发授权流程，跳过选择页面
                            ServerOAuth2AuthorizationRequestResolver resolver = new PathBasedAuthorizationRequestResolver(clientRegistrationRepository);
                            return resolver.resolve(exchange)
                                    .flatMap(request -> {
                                        exchange.getResponse().setStatusCode(request.getRedirectUri().isAbsolute() ? 
                                                org.springframework.http.HttpStatus.FOUND : org.springframework.http.HttpStatus.BAD_REQUEST);
                                        exchange.getResponse().getHeaders().setLocation(request.getRedirectUri());
                                        return exchange.getResponse().setComplete();
                                    });
                        })
                );
        return http.build();
    }
}

3. 验证配置效果 #

• 访问localhost:8080/first/id=3123时，会直接重定向到first-client对应的Keycloak授权页面
• 访问localhost:8080/second/id=3123时，会直接重定向到second-client对应的Keycloak授权页面
• 默认的多Client登录选择菜单不再出现

三、补充说明 #

• 确保你的application.yml中已正确配置两个Client的注册信息（如你提供的配置）
• TokenRelay过滤器会自动转发OAuth2令牌到下游服务，无需额外修改
• 若需扩展更多路径与Client的映射，只需在PathBasedAuthorizationRequestResolver的getClientRegistrationId方法中添加对应规则即可

内容的提问来源于stack exchange，提问作者Dred