配置OpenAPI(Swagger)结合Auth0授权码流遇JWE密钥错误求助

在配置OpenAPI（Swagger）以Auth0作为安全提供商，采用授权码（authorization code）流时出现错误。Auth0端已完成API及Machine2machine类型应用的配置，报错信息如下：

www-authenticate: Bearer error="invalid_token",error_description="尝试解码Jwt时出错：加密JWT被拒绝：未配置JWE密钥选择器",error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

OpenAPI配置代码 #

@Configuration
public class OpenApiConfiguration {

    private static final String OAUTH_SCHEME_NAME = "oauth";

    @Bean
    public OpenAPI customizeOpenAPI() {
        return new OpenAPI()
            .addSecurityItem(new SecurityRequirement()
                .addList(OAUTH_SCHEME_NAME))
            .components(new Components()
                .addSecuritySchemes(OAUTH_SCHEME_NAME, createOAuthScheme()))
            .addSecurityItem(new SecurityRequirement().addList(OAUTH_SCHEME_NAME));
    }

    private SecurityScheme createOAuthScheme() {
        return new SecurityScheme().type(SecurityScheme.Type.OAUTH2).flows(createOAuthFlows());
    }

    private OAuthFlows createOAuthFlows() {
        OAuthFlow scopes = new OAuthFlow()
            .authorizationUrl("https://dev-xxxxxx.us.auth0.com/authorize")
            .refreshUrl("https://dev-xxxxxx.us.auth0.com/oauth/token")
            .tokenUrl("https://dev-xxxxxx.us.auth0.com/oauth/token")
            .scopes(new Scopes());
        return new OAuthFlows().authorizationCode(scopes);
    }
}

Security配置代码 #

@Configuration
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfiguration {

private final Auth0JwtAuthConverter jwtAuthConverter;

private final SecurityProperties securityProperties;

@Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")
private String issuerUri;

private final Auth0AudienceValidator audienceValidator;

private final Auth0SignatureValidator signatureValidator;

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(req ->
            req.requestMatchers(getPermittedMatchers()).permitAll()
                .anyRequest()
                .authenticated())
        .cors(withDefaults())
        .csrf(AbstractHttpConfigurer::disable)
        .oauth2ResourceServer(auth -> auth.jwt(token -> token.jwtAuthenticationConverter(jwtAuthConverter)));

    return http.build();
}

private String[] getPermittedMatchers() {
    return securityProperties.getPermittedMatchers().toArray(String[]::new);
}

@Bean
public JwtDecoder jwtDecoder() {
    NimbusJwtDecoder jwtDecoder = JwtDecoders.fromOidcIssuerLocation(issuerUri);

    OAuth2TokenValidator<Jwt> issuerValidator = JwtValidators.createDefaultWithIssuer(issuerUri);

    OAuth2TokenValidator<Jwt> delegate = new DelegatingOAuth2TokenValidator<>(issuerValidator, audienceValidator,
        signatureValidator);

    jwtDecoder.setJwtValidator(delegate);

    return jwtDecoder;
}

YAML配置文件 #

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://dev-xxxx.us.auth0.com/
          audiences: https://userapi
          jwk-set-uri: https://dev-xxxx.us.auth0.com/.well-known/jwks.json
springdoc:
  api-docs:
    path: /api-docs
  swagger-ui:
    oauth:
      client-id: ${auth0.client-id}
      client-secret: ${auth0.client-secret}
    oauth2-redirect-url: http://localhost:8080/swagger-ui/oauth2-redirect.html

内容的提问来源于stack exchange，提问作者Danil Tk