Spring Security OAuth中AuthorizationServerConfigurerAdapter弃用的处理方案

一、AuthorizationServerConfigurerAdapter 的替代方案 #

• Spring Authorization Server：官方主推的替代方案，是独立的授权服务器实现，完全覆盖原Spring Security OAuth的授权服务器功能，还支持OAuth 2.1、OpenID Connect 1.0等最新标准。
• 直接注册核心Bean：如果暂时不想切换到新的授权服务器，可以跳过适配器，直接注册ClientDetailsService、端点配置类、安全配置类等核心组件来实现相同功能（仅临时过渡用，不推荐长期使用）。

二、迁移现有代码的具体步骤 #

情况1：迁移到Spring Authorization Server（推荐） #

首先引入依赖（以Maven为例）：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-authorization-server</artifactId>
    <version>1.2.0</version> <!-- 建议使用最新稳定版本 -->
</dependency>

然后替换原来的OAuthConfig类，重构配置：

1. 配置客户端信息（对应原代码中configure(ClientDetailsServiceConfigurer)方法）

@Bean
public RegisteredClientRepository registeredClientRepository() {
    RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
            .clientId("你的客户端ID")
            .clientSecret("{noop}你的客户端密钥") // 根据实际加密方式调整，比如用bcrypt的话替换成加密后的字符串
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
            .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
            .redirectUri("http://localhost:8080/login/oauth2/code/你的客户端ID")
            .scope(OidcScopes.OPENID)
            .scope("read")
            .scope("write")
            .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
            .build();

    return new InMemoryRegisteredClientRepository(registeredClient);
}

2. 配置端点与认证规则（对应原代码中configure(AuthorizationServerEndpointsConfigurer)方法）
   Spring Authorization Server会自动配置基础端点，如需自定义令牌端点的请求方法，通过SecurityFilterChain配置：

@Bean
@Order(1)
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
    // 配置令牌端点允许GET、POST请求，对应原代码的allowedTokenEndpointRequestMethods
    http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
            .tokenEndpoint(tokenEndpoint -> tokenEndpoint
                    .allowedRequestMethods(HttpMethod.GET, HttpMethod.POST));

    http.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
    return http.build();
}

// 配置默认的安全过滤链，处理普通登录等请求
@Bean
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated())
            .formLogin(Customizer.withDefaults());
    return http.build();
}

// 配置JWT解码器
@Bean
public JwtDecoder jwtDecoder(JwkSource<SecurityContext> jwkSource) {
    return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
}

// 配置JWK源，用于生成和验证JWT密钥
@Bean
public JwkSource<SecurityContext> jwkSource() {
    RSAKey rsaKey = Jwks.generateRsa();
    JWKSet jwkSet = new JWKSet(rsaKey);
    return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
}

// 授权服务器基础配置
@Bean
public AuthorizationServerSettings authorizationServerSettings() {
    return AuthorizationServerSettings.builder().build();
}

情况2：原Spring Security OAuth环境下临时调整（不推荐） #

如果暂时无法切换到新组件，可以移除适配器，直接注册核心Bean：

@Configuration
public class OAuthConfig {
    @Autowired
    private AuthenticationManager authenticationManager;

    // 替代原configure(ClientDetailsServiceConfigurer)，配置客户端信息
    @Bean
    public ClientDetailsService clientDetailsService() {
        InMemoryClientDetailsServiceBuilder builder = new InMemoryClientDetailsServiceBuilder();
        // 这里添加你的客户端配置示例
        builder.withClient("你的客户端ID")
                .secret("{noop}你的客户端密钥")
                .authorizedGrantTypes("authorization_code", "refresh_token", "password")
                .scopes("read", "write")
                .redirectUris("http://localhost:8080/callback");
        return builder.build();
    }

    // 替代原configure(AuthorizationServerEndpointsConfigurer)，配置端点
    @Bean
    public AuthorizationServerEndpointsConfigurer authorizationServerEndpointsConfigurer() throws Exception {
        AuthorizationServerEndpointsConfigurer endpoints = new AuthorizationServerEndpointsConfigurer();
        endpoints.authenticationManager(authenticationManager)
                .allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST);
        return endpoints;
    }

    // 替代原configure(AuthorizationServerSecurityConfigurer)，配置安全规则
    @Bean
    public AuthorizationServerSecurityConfigurer authorizationServerSecurityConfigurer() throws Exception {
        AuthorizationServerSecurityConfigurer security = new AuthorizationServerSecurityConfigurer();
        // 示例：配置检查令牌的权限
        security.checkTokenAccess("isAuthenticated()");
        return security;
    }
}

内容的提问来源于stack exchange，提问作者김민영