Spring Boot未读取Auth0权限：自定义JwtAuthenticationConverter未生效

在Spring Boot项目中集成Auth0，需要从JWT的permissions字段读取权限，通过hasAuthority做校验。已自定义JwtAuthenticationConverter，但控制器中仅能看到scope解析出的权限，permissions字段未被读取。

JWT令牌内容 #

{
  "iss": "https://dev-hxo7qtywv.eu.auth0.com/",
  "sub": "google-oauth2|10344498554237",
  "aud": [
    "https://test/api",
    "https://dev-hxo7qtywv.eu.auth0.com/userinfo"
  ],
  "iat": 17010717,
  "exp": 17019317,
  "azp": "dv1rEpS37p9jaGIPXO0S5fnjMh",
  "scope": "openid profile email offline_access",
  "permissions": [
    "read:admin",
    "SCOPE_read:admin"
  ]
}

相关代码片段 #

自定义JwtAuthenticationConverter Bean #

@Bean
public JwtAuthenticationConverter customJwtAuthenticationConverter() {
  JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
  grantedAuthoritiesConverter.setAuthoritiesClaimName("permissions");
  JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
  jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedAuthoritiesConverter);
  return jwtAuthenticationConverter;
}

权限配置 #

.requestMatchers("/api/test/admin").hasAuthority("read:admin")

JWT配置 #

http.oauth2ResourceServer(oauth2 -> oauth2
        .jwt(jwt -> jwt.jwtAuthenticationConverter(customJwtAuthenticationConverter())));

控制器中显示的权限 #

Authority: SCOPE_openid
Authority: SCOPE_profile
Authority: SCOPE_email
Authority: SCOPE_offline_access

排查与解决步骤 #

1. 确保配置类被Spring扫描
   自定义Converter的Bean所在的类必须添加@Configuration注解，且该类所在的包在Spring的组件扫描路径内，否则Bean无法被容器加载，自然不会生效：

   @Configuration
   public class SecurityConfig {
       // 自定义Converter Bean定义
   }
   

2. 检查JWT配置的引用是否正确
   确认在SecurityFilterChain的oauth2ResourceServer配置中，确实调用了customJwtAuthenticationConverter()，而非重复定义匿名Converter或使用默认实现。

3. 可选：同时保留scope和permissions权限
   默认的转换器会解析scope字段生成SCOPE_前缀的权限，如果你的自定义Converter完全替换了默认逻辑，只会读取permissions字段。若需要同时保留两种权限，可组合两个转换器：

   @Bean
   public JwtAuthenticationConverter customJwtAuthenticationConverter() {
       // 处理permissions字段的转换器
       JwtGrantedAuthoritiesConverter permissionsConverter = new JwtGrantedAuthoritiesConverter();
       permissionsConverter.setAuthoritiesClaimName("permissions");
       permissionsConverter.setAuthorityPrefix(""); // 关闭默认前缀，直接使用permissions中的值
   
       // 处理scope字段的默认转换器
       JwtGrantedAuthoritiesConverter scopeConverter = new JwtGrantedAuthoritiesConverter();
   
       // 组合两个转换器的结果
       JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
       converter.setJwtGrantedAuthoritiesConverter(jwt -> {
           Collection<GrantedAuthority> authorities = new ArrayList<>();
           authorities.addAll(permissionsConverter.convert(jwt));
           authorities.addAll(scopeConverter.convert(jwt));
           return authorities;
       });
       return converter;
   }
   

4. 验证JWT受众（aud）配置
   Spring Security会校验JWT的aud字段是否与配置的受众一致，若不匹配可能导致令牌解析异常，进而使用默认逻辑。在配置文件中添加正确的受众：

   spring.security.oauth2.resourceserver.jwt.audience=https://test/api
   

5. 调试确认转换器是否被调用
   在自定义转换器的逻辑中添加日志或断点，确认是否进入了转换流程：

   converter.setJwtGrantedAuthoritiesConverter(jwt -> {
       System.out.println("自定义转换器触发，permissions值：" + jwt.getClaimAsStringList("permissions"));
       // 转换逻辑...
   });
   

内容的提问来源于stack exchange，提问作者RazorMx