Spring Security OAuth2中如何在令牌请求体中发送自定义参数

要在Spring Security OAuth2客户端的令牌请求体中添加自定义参数，你需要定制令牌请求的参数转换器，并将其配置到令牌响应客户端中。以下是具体实现步骤：

1. 自定义授权码模式的请求参数转换器 #

创建一个继承自OAuth2AuthorizationCodeGrantRequestEntityConverter的类，重写getParameters方法来添加额外参数：

import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequest;
import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequestEntityConverter;
import org.springframework.util.MultiValueMap;

public class CustomAuthorizationCodeGrantRequestEntityConverter extends OAuth2AuthorizationCodeGrantRequestEntityConverter {

    @Override
    protected MultiValueMap<String, String> getParameters(OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest) {
        // 先获取默认的请求参数
        MultiValueMap<String, String> parameters = super.getParameters(authorizationCodeGrantRequest);
        // 仅针对指定provider添加自定义参数
        String registrationId = authorizationCodeGrantRequest.getClientRegistration().getRegistrationId();
        if ("provider-name".equals(registrationId)) {
            parameters.add("token_content_type", "jwt");
        }
        return parameters;
    }
}

2. 配置自定义的令牌响应客户端 #

创建配置类，定义OAuth2AuthorizationCodeTokenResponseClient的Bean，绑定自定义转换器：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.endpoint.DefaultAuthorizationCodeTokenResponseClient;
import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeTokenResponseClient;

@Configuration
public class OAuth2ClientConfig {

    @Bean
    public OAuth2AuthorizationCodeTokenResponseClient authorizationCodeTokenResponseClient() {
        DefaultAuthorizationCodeTokenResponseClient tokenResponseClient = new DefaultAuthorizationCodeTokenResponseClient();
        tokenResponseClient.setRequestEntityConverter(new CustomAuthorizationCodeGrantRequestEntityConverter());
        return tokenResponseClient;
    }
}

3. 更新SecurityFilterChain配置 #

在Security配置中注入自定义令牌响应客户端，并配置到oauth2Login的tokenEndpoint中：

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeTokenResponseClient;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;

@EnableWebSecurity
public class SecurityConfig {

    private final ClientRegistrationRepository clientRegistrationRepository;
    private final OAuth2AuthorizationCodeTokenResponseClient tokenResponseClient;

    // 构造器注入依赖
    public SecurityConfig(ClientRegistrationRepository clientRegistrationRepository,
                          OAuth2AuthorizationCodeTokenResponseClient tokenResponseClient) {
        this.clientRegistrationRepository = clientRegistrationRepository;
        this.tokenResponseClient = tokenResponseClient;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
         return http
                .authorizeHttpRequests(auth -> {
                    auth.requestMatchers("/a/token").permitAll();
                    auth.anyRequest().authenticated(); // 根据业务需求调整认证规则
                })
                 .oauth2Login(oauth2 ->
                         oauth2.authorizationEndpoint(endpoint ->
                                 endpoint.authorizationRequestResolver(new CustomAuthorizationRequestResolver(clientRegistrationRepository)))
                         // 绑定自定义令牌响应客户端
                         .tokenEndpoint(endpoint ->
                                 endpoint.accessTokenResponseClient(tokenResponseClient)))
                 .formLogin(withDefaults())
                 .build();
    }
}

验证配置 #

开启DEBUG日志确认参数是否生效，在application.yaml中添加：

logging:
  level:
    org.springframework.security.oauth2.client.endpoint: DEBUG

启动应用后，查看日志中令牌请求的参数输出，确认token_content_type=jwt已包含在请求体中。

内容的提问来源于stack exchange，提问作者Marius Manastireanu