Spring Framework（非Spring Boot）集成Azure AD OAuth2Login异常排查

问题描述 #

我基于Spring Framework 5.3.25和Spring Security 5.7.7开发Web应用，尝试集成Azure AD/Entra ID的OAuth2Login功能，已持有有效的client-id、租户信息和密钥。但配置的OAuth2LoginConfig未被触发，访问'/faces/start/start.jsf'时直接打开页面，未跳转至Azure AD登录页。以下是我的配置代码及pom依赖，请问是否遗漏了什么配置？是否需要额外加载OAuth2LoginConfig？

配置代码 #

@Configuration
@EnableWebSecurity
public class OAuth2LoginConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
        .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
                )
        
        .oauth2Login(withDefaults());
        return http.build();
        
    }

    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        return new InMemoryClientRegistrationRepository(this.azureClientRegistration());
    }

    @Bean
    public OAuth2AuthorizedClientService authorizedClientService(
            ClientRegistrationRepository clientRegistrationRepository) {
        return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
    }

    @Bean
    public OAuth2AuthorizedClientRepository authorizedClientRepository(
            OAuth2AuthorizedClientService authorizedClientService) {
        return new AuthenticatedPrincipalOAuth2AuthorizedClientRepository(authorizedClientService);
    }

    private ClientRegistration azureClientRegistration() {

        return ClientRegistration.withRegistrationId("azure")
                .clientId("my-client-id")
                .clientSecret("my-secret")
                .scope("openid", "profile", "email")
           .authorizationUri("https://login.microsoftonline.com/xxx/oauth2/v2.0/authorize")
                .tokenUri("https://login.microsoftonline.com/xxx/oauth2/v2.0/token")
                .build();
}

POM依赖 #

<dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>${spring-security.version}</version>
            <exclusions>
                <exclusion>
                    <groupId>org.springframework</groupId>
                    <artifactId>spring-tx</artifactId>
                </exclusion>
            </exclusions>
        </dependency>   
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>${spring-security.version}</version>
        </dependency>       
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-oauth2-client</artifactId>
            <version>${spring-security.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-oauth2-jose</artifactId>
            <version>${spring-security.version}</version>
        </dependency>

问题排查与解决方法 #

1. 确认配置类被Spring加载 #

• 检查OAuth2LoginConfig所在包是否在Spring组件扫描范围内。如果主启动类的@SpringBootApplication或@ComponentScan未覆盖该包路径，Spring无法识别并加载这个配置类。
• 解决方式：要么调整组件扫描范围包含配置类所在包，要么在主启动类上添加@Import(OAuth2LoginConfig.class)强制导入该配置。

2. 补充Azure AD OAuth2必要端点配置 #

你的ClientRegistration缺少用户信息端点和关键属性配置，这会导致Spring Security无法完成完整的认证流程：

• 修改azureClientRegistration()方法，补充以下配置：

import org.springframework.security.oauth2.core.oidc.IdTokenClaimNames;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.client.registration.ClientAuthenticationMethod;

// ...

private ClientRegistration azureClientRegistration() {
    return ClientRegistration.withRegistrationId("azure")
            .clientId("my-client-id")
            .clientSecret("my-secret")
            .scope("openid", "profile", "email")
            .authorizationUri("https://login.microsoftonline.com/xxx/oauth2/v2.0/authorize")
            .tokenUri("https://login.microsoftonline.com/xxx/oauth2/v2.0/token")
            .userInfoUri("https://graph.microsoft.com/oidc/userinfo") // 添加用户信息端点
            .userNameAttributeName(IdTokenClaimNames.SUB) // 指定用户标识属性
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .redirectUri("{baseUrl}/login/oauth2/code/{registrationId}") // 显式指定回调地址，需与Azure AD后台配置一致
            .build();
}

3. 确保Spring Security过滤器链生效 #

• 非Spring Boot应用：需要在web.xml中配置DelegatingFilterProxy，或者通过Java配置注册过滤器：

@Bean
public FilterRegistrationBean<DelegatingFilterProxy> securityFilterChainRegistration() {
    FilterRegistrationBean<DelegatingFilterProxy> registration = new FilterRegistrationBean<>();
    registration.setFilter(new DelegatingFilterProxy("springSecurityFilterChain"));
    registration.addUrlPatterns("/*");
    return registration;
}

• Spring Boot应用：默认会自动注册过滤器，但如果有自定义WebMvcConfigurer，需确认未覆盖默认过滤器逻辑。

4. 验证请求是否被安全规则拦截 #

开启Spring Security调试日志，查看目标请求是否被拦截：

http
    .authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
    )
    .oauth2Login(withDefaults())
    .debug(); // 开启调试日志

查看日志中是否存在/faces/start/start.jsf请求的拦截记录，确认安全规则是否生效。

5. 核对依赖版本一致性 #

确保所有Spring Security相关依赖的版本完全一致，避免版本冲突导致的功能异常。

内容的提问来源于stack exchange，提问作者Abdul Waheed