Spring Cloud中Azure AD SSO认证遇TOO_MANY_REDIRECTS问题求助

在Spring Cloud中配置Azure AD认证后，触发https://localhost:8080/signin端点会跳转到微软登录页，但输入凭证后出现TOO_MANY_REDIRECTS错误，反复重定向回登录页。通过浏览器调试可见已生成OAuth code，但无法跳转至指定URL，期望认证成功后重定向到signin控制器获取access_token。

相关配置 #

application.properties #

spring.security.oauth2.client.registration.client.provider=azuread
spring.security.oauth2.client.registration.client.client-id=<client_ID>
spring.security.oauth2.client.registration.client.client-secret=<client_secret>
spring.security.oauth2.client.registration.client.client-authentication-method=client_secret_basic
spring.security.oauth2.client.registration.client.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.client.redirect-uri={baseUrl}/login/oauth2/code/
spring.security.oauth2.client.registration.client.scope=openid+email+profile
spring.security.oauth2.client.registration.client.client-name=Login with Azure
spring.security.oauth2.client.provider.azuread.issuer-uri=https://login.microsoftonline.com/<tenant_ID>/v2.0
spring.security.oauth2.client.provider.azuread.token-uri=https://login.microsoftonline.com/<tenant_ID>/oauth2/v2.0/token
spring.security.oauth2.client.provider.azuread.authorization-uri=https://login.microsoftonline.com/<tenant_ID>/oauth2/v2.0/authorize
spring.security.oauth2.client.provider.azuread.user-info-uri=https://graph.microsoft.com/oidc/userinfo
azure.activedirectory.tenant-id=<tenant_ID>

SecurityConfig #

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http.csrf().disable()
                .authorizeExchange()
                .pathMatchers("/signin/**")
                .permitAll()
                .anyExchange()
                .authenticated()
            .and()
                .oauth2Login() // to redirect to oauth2 login page.
    ;

    return http.build();
}

Login Controller #

@RequestMapping("/signin")
private ResponseEntity<?> login(@Context ServerHttpRequest request, @AuthenticationPrincipal OAuth2User principal) throws JSONException {
    Map<String, String> userProfile = new HashMap<>();
    userProfile = authService.userLogin(principal);
    System.out.println("data from endpoint : "
            +principal.toString() );
    return ResponseEntity.ok(userProfile);
    //return Response.ok("Success").build();
}

问题原因及解决步骤 #

1. 修正重定向URI配置 #

Spring Security OAuth2的回调路径需要指定具体客户端标识，当前配置的redirect-uri={baseUrl}/login/oauth2/code/缺少客户端ID，导致回调失败触发重定向循环。

• 修改application.properties中的redirect-uri：

  spring.security.oauth2.client.registration.client.redirect-uri={baseUrl}/login/oauth2/code/client
  

• 登录Azure AD门户，找到对应应用注册，在认证页面添加匹配的重定向URI（例如https://localhost:8080/login/oauth2/code/client），确保与配置完全一致。

2. 调整SecurityConfig，指定认证成功跳转路径 #

当前配置未指定认证成功后的跳转目标，且未开放回调路径的访问权限，导致回调时被拦截触发重定向。

修改SecurityWebFilterChain配置：

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http.csrf().disable()
            .authorizeExchange()
            // 开放回调路径和signin路径
            .pathMatchers("/signin/**", "/login/oauth2/code/**")
            .permitAll()
            .anyExchange()
            .authenticated()
        .and()
            .oauth2Login()
            // 指定认证成功后跳转到/signin端点
            .authenticationSuccessHandler((webFilterExchange, authentication) -> {
                ServerHttpResponse response = webFilterExchange.getExchange().getResponse();
                response.setStatusCode(HttpStatus.SEE_OTHER);
                response.getHeaders().setLocation(URI.create("/signin"));
            });

    return http.build();
}

3. 修正Login Controller的问题 #

控制器方法访问修饰符错误，且WebFlux环境下无法直接同步注入OAuth2User，导致主体为空触发认证逻辑。

修改控制器代码：

@RestController
@RequestMapping("/signin")
public class LoginController {

    @Autowired
    private AuthService authService;

    @GetMapping
    public ResponseEntity<?> login(@AuthenticationPrincipal Mono<OAuth2User> principalMono) {
        return principalMono
                .map(principal -> {
                    Map<String, String> userProfile = authService.userLogin(principal);
                    System.out.println("data from endpoint : " + principal.toString());
                    return ResponseEntity.ok(userProfile);
                })
                .defaultIfEmpty(ResponseEntity.status(HttpStatus.UNAUTHORIZED).build());
    }
}

• 新增@RestController注解，确保Spring识别为控制器
• 将方法改为public访问权限
• 使用Mono<OAuth2User>适配WebFlux响应式环境，避免主体为空的情况

4. 检查Azure AD应用权限配置 #

确保应用注册中已添加openid、email、profile权限，且已授予管理员同意（针对租户内应用），避免权限不足导致认证流程异常。

内容的提问来源于stack exchange，提问作者Raj musham