Spring Security Reactive运行时程序化选择Oauth2身份提供商方案咨询

我们有一个基于Spring Boot 2的响应式Web代理应用，使用Spring Security OAuth2实现用户认证。终端用户来自公网或私网，需要根据请求头X-Forwarded-For中的用户IP，自动重定向到对应的身份提供商登录页：

• 公网用户 → identity-provider.com
• 私网用户 → identity-provider.biz
  并且两种场景下，认证完成后最终跳转的业务页面保持一致。

目前已在application.yaml中完成两个OAuth2身份提供商及客户端的配置，但应用默认会展示两个提供商的选择链接，不符合我们自动跳转的需求。现有配置如下：

spring:
  security:
    oauth2:
      client:
        provider:
          idpcom:
            issuer-uri: https://identity-provider.com
          idpbiz:
            issuer-uri: https://identity-provider.biz
        
        registration:
          idpcom:
            provider: idpcom
            client-id: clientid
            client-secret: clientsecret
            authorization-grant-type: authorization_code
            redirect-uri: https://my-domain.com/login/oauth2/code/idpcom
            scope:
              - openid

          idpbiz:
            provider: idpbiz
            client-id: clientid
            client-secret: clientsecret
            authorization-grant-type: authorization_code
            redirect-uri: https://my-domain.com/login/oauth2/code/idpbiz
            scope:
              - openid

1. 实现IP解析逻辑，自动匹配身份提供商 #

创建一个组件，从请求头中提取用户IP，判断所属网络类型，返回对应的OAuth2客户端注册ID。

@Component
public class IpIdpResolver {
    // 可根据实际私网IP段调整正则匹配规则
    private final List<String> PRIVATE_IP_PATTERNS = Arrays.asList(
        "^192\\.168\\..*$",
        "^10\\..*$",
        "^172\\.(1[6-9]|2[0-9]|3[0-1])\\..*$"
    );

    public String resolveRegistrationId(ServerHttpRequest request) {
        String xForwardedFor = request.getHeaders().getFirst("X-Forwarded-For");
        // 无X-Forwarded-For头时默认走公网提供商
        if (xForwardedFor == null || xForwardedFor.isBlank()) {
            return "idpcom";
        }
        // 提取第一个真实客户端IP（X-Forwarded-For可能包含多个代理IP）
        String clientIp = xForwardedFor.split(",")[0].trim();
        // 判断是否属于私网IP段
        for (String pattern : PRIVATE_IP_PATTERNS) {
            if (clientIp.matches(pattern)) {
                return "idpbiz";
            }
        }
        return "idpcom";
    }
}

2. 自定义认证入口点，替换默认选择页面 #

实现ServerAuthenticationEntryPoint接口，在认证触发时自动根据IP解析结果，重定向到对应身份提供商的授权页面。

@Component
public class AutoRedirectAuthEntryPoint implements ServerAuthenticationEntryPoint {
    private final ClientRegistrationRepository clientRepo;
    private final OAuth2AuthorizationRequestRedirectFilter redirectFilter;
    private final IpIdpResolver ipIdpResolver;

    public AutoRedirectAuthEntryPoint(ClientRegistrationRepository clientRepo,
                                     OAuth2AuthorizationRequestRedirectFilter redirectFilter,
                                     IpIdpResolver ipIdpResolver) {
        this.clientRepo = clientRepo;
        this.redirectFilter = redirectFilter;
        this.ipIdpResolver = ipIdpResolver;
    }

    @Override
    public Mono<Void> commence(ServerHttpRequest request, ServerHttpResponse response) {
        String registrationId = ipIdpResolver.resolveRegistrationId(request);
        ClientRegistration registration = clientRepo.findByRegistrationId(registrationId);
        if (registration == null) {
            return Mono.error(new IllegalArgumentException("未找到对应身份提供商配置：" + registrationId));
        }
        // 触发OAuth2授权请求重定向
        return redirectFilter.sendRedirectForAuthorization(request, response, registration);
    }
}

3. 配置Spring Security，启用自定义入口点 #

修改Security配置，将默认的认证入口点替换为自定义实现，同时可配置统一的登录成功跳转页面，满足“认证后redirect_uri一致”的需求。

@Configuration
public class SecurityConfig {
    private final AutoRedirectAuthEntryPoint authEntryPoint;
    private final CustomAuthSuccessHandler successHandler;

    public SecurityConfig(AutoRedirectAuthEntryPoint authEntryPoint,
                         CustomAuthSuccessHandler successHandler) {
        this.authEntryPoint = authEntryPoint;
        this.successHandler = successHandler;
    }

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        http
            .authorizeExchange(exchanges -> exchanges
                .anyExchange().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                // 配置统一的登录成功跳转逻辑
                .authenticationSuccessHandler(successHandler)
            )
            .exceptionHandling(exceptionHandling -> exceptionHandling
                // 替换默认认证入口点
                .authenticationEntryPoint(authEntryPoint)
            );
        return http.build();
    }
}

// 统一登录成功跳转处理器
@Component
public class CustomAuthSuccessHandler implements ServerAuthenticationSuccessHandler {
    @Override
    public Mono<Void> onAuthenticationSuccess(WebFilterExchange exchange, Authentication auth) {
        ServerHttpResponse response = exchange.getExchange().getResponse();
        response.setStatusCode(HttpStatus.SEE_OTHER);
        // 这里设置统一的业务跳转页面
        response.getHeaders().setLocation(URI.create("/home"));
        return response.setComplete();
    }
}

4. 补充配置：信任X-Forwarded-For头 #

确保应用信任代理传递的X-Forwarded-For头，在application.yaml中添加配置：

server:
  forward-headers-strategy: framework

• 私网IP段的正则规则需要根据实际网络环境调整，避免匹配错误。
• 需确保前端代理（如Nginx、负载均衡器）正确传递X-Forwarded-For头，否则无法获取真实客户端IP。
• 如果需要统一OAuth2回调地址（而非最终业务页面），可将两个客户端注册的redirect-uri设置为同一值，再在后端根据提供商标识区分处理。

内容的提问来源于stack exchange，提问作者Cosmin Ion