Spring Security OAuth2Login基于请求匹配器配置多Realm登录问题

你的问题核心在于同一个HttpSecurity实例重复配置会导致规则覆盖：后面的.anyRequest().authenticated()完全覆盖了前面的/customers匹配规则，最终只会生效第二个OAuth2登录配置。

要实现特定路径用realm1、其余路径用realm2的需求，需要创建两个独立的SecurityFilterChain Bean，通过@Order指定优先级，让更具体的路径规则优先执行。

修正后的代码示例 #

// 第一个FilterChain：仅处理/customers相关路径，优先级最高
@Bean
@Order(Ordered.HIGHEST_PRECEDENCE)
public SecurityFilterChain realm1FilterChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/customers/**") // 限定当前FilterChain的作用路径
        .csrf().disable()
        .authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
        )
        .oauth2Login(oauth2 -> oauth2
            .loginPage("/oauth2/authorization/realm1")
        );
    return http.build();
}

// 第二个FilterChain：处理所有未被第一个FilterChain匹配的路径
@Bean
public SecurityFilterChain realm2FilterChain(HttpSecurity http) throws Exception {
    http
        .csrf().disable()
        .authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
        )
        .oauth2Login(oauth2 -> oauth2
            .loginPage("/oauth2/authorization/realm2")
        );
    return http.build();
}

// 以下ClientRegistration相关代码保持不变
@Bean
public ClientRegistrationRepository clientRepository() {
    return new InMemoryClientRegistrationRepository(realm1ClientRegistration(), realm2ClientRegistration());
}

private ClientRegistration realm1ClientRegistration() {
    return ClientRegistration.withRegistrationId("webeam")
            .clientId(realm1ClientId)
            .clientSecret(realm1ClientSecret)
            .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
            .scope("openid","groups", "profile", "email")
            .clientAuthenticationMethod(ClientAuthenticationMethod.POST)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationUri(issuerUrl+realm1+"authorize")
            .tokenUri(issuerUrl+realm1+"access_token")
            .userInfoUri(issuerUrl+realm1+"userinfo")
            .jwkSetUri(issuerUrl+realm1+"connect/jwk_uri")
            .userNameAttributeName(IdTokenClaimNames.SUB)
            .build();
}

private ClientRegistration realm2ClientRegistration() {
    return ClientRegistration.withRegistrationId("realm2")
            .clientId(realm2ClientId)
            .clientSecret(realm2ClientSecret)
            .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}")
            .scope("openid","groups", "profile", "email")
            .clientAuthenticationMethod(ClientAuthenticationMethod.POST)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationUri(issuerUrl+realm2+"authorize")
            .tokenUri(issuerUrl+realm2+"access_token")
            .userInfoUri(issuerUrl+realm2+"userinfo")
            .jwkSetUri(issuerUrl+realm2+"connect/jwk_uri")
            .userNameAttributeName(IdTokenClaimNames.SUB)
            .build();
}

关键说明 #

• securityMatcher("/customers/**")：明确当前FilterChain只处理匹配该路径的请求，避免与其他FilterChain的规则冲突。
• @Order注解：优先级高的FilterChain会先执行，匹配到/customers的请求不会进入第二个FilterChain的处理流程。
• 独立HttpSecurity实例：两个FilterChain各自维护独立的配置逻辑，不会出现规则覆盖问题。

内容的提问来源于stack exchange，提问作者Mosd