Spring Authorization Server审计功能咨询及新增建议问询

一、当前是否内置该功能？ #

目前Spring Authorization Server没有内置专门的、结构化且用户可直接访问的审计功能——你提到的OAuth2AuthorizationCodeAuthenticationProvider类附近仅处理授权码认证逻辑，未包含审计记录相关实现，官方也暂未针对该功能创建公开工单。

二、是否应作为可配置功能加入？ #

完全建议将其作为可配置功能纳入官方特性：

• 结构化审计是身份认证服务的核心需求之一，能满足合规审计、故障排查、安全分析等多场景需求
• 作为可配置项，既不会增加默认使用复杂度，也能精准覆盖有需求的用户群体
• 可基于现有认证事件体系扩展，无需大幅改动核心逻辑

三、JDBC示例实现方案 #

你可以通过监听Spring Security的认证事件来实现，以下是基于JDBC的完整示例：

1. 定义审计数据表与实体类 #

先创建存储审计记录的SQL表：

CREATE TABLE auth_audit_logs (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    event_type VARCHAR(50) NOT NULL, -- 枚举值如LOGIN_SUCCESS、LOGIN_FAILURE、AUTHORIZATION_SUCCESS
    username VARCHAR(100),
    client_id VARCHAR(100) NOT NULL,
    ip_address VARCHAR(50),
    timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    details TEXT -- 存储额外信息，比如失败原因、授权范围等
);

对应的Java实体类：

public class AuthAuditLog {
    private Long id;
    private String eventType;
    private String username;
    private String clientId;
    private String ipAddress;
    private LocalDateTime timestamp;
    private String details;

    // 构造函数、getter、setter省略
}

2. 实现JDBC审计数据仓库 #

@Repository
public class JdbcAuthAuditRepository {
    private final JdbcTemplate jdbcTemplate;

    public JdbcAuthAuditRepository(JdbcTemplate jdbcTemplate) {
        this.jdbcTemplate = jdbcTemplate;
    }

    public void save(AuthAuditLog log) {
        String sql = "INSERT INTO auth_audit_logs (event_type, username, client_id, ip_address, details) VALUES (?, ?, ?, ?, ?)";
        jdbcTemplate.update(sql,
                log.getEventType(),
                log.getUsername(),
                log.getClientId(),
                log.getIpAddress(),
                log.getDetails());
    }
}

3. 监听认证事件并记录审计日志 #

通过Spring事件监听机制，捕获登录成败等关键事件并写入数据库：

@Component
public class AuthAuditEventListener {
    private final JdbcAuthAuditRepository auditRepository;
    private final HttpServletRequest request;

    public AuthAuditEventListener(JdbcAuthAuditRepository auditRepository,
                                  @Autowired(required = false) HttpServletRequest request) {
        this.auditRepository = auditRepository;
        this.request = request;
    }

    // 监听登录成功事件
    @EventListener
    public void handleAuthenticationSuccess(AuthenticationSuccessEvent event) {
        Authentication auth = event.getAuthentication();
        if (auth instanceof OAuth2AuthorizationCodeAuthenticationToken) {
            OAuth2AuthorizationCodeAuthenticationToken token = (OAuth2AuthorizationCodeAuthenticationToken) auth;
            AuthAuditLog log = new AuthAuditLog();
            log.setEventType("LOGIN_SUCCESS");
            log.setUsername(auth.getName());
            log.setClientId(token.getClientRegistration().getClientId());
            log.setIpAddress(getClientIp());
            log.setDetails("授权范围：" + token.getAuthorities().stream()
                    .map(GrantedAuthority::getAuthority)
                    .collect(Collectors.joining(",")));
            auditRepository.save(log);
        }
    }

    // 监听登录失败事件
    @EventListener
    public void handleAuthenticationFailure(AuthenticationFailureBadCredentialsEvent event) {
        Authentication auth = event.getAuthentication();
        if (auth instanceof OAuth2AuthorizationCodeAuthenticationToken) {
            OAuth2AuthorizationCodeAuthenticationToken token = (OAuth2AuthorizationCodeAuthenticationToken) auth;
            AuthAuditLog log = new AuthAuditLog();
            log.setEventType("LOGIN_FAILURE");
            log.setUsername(auth.getName());
            log.setClientId(token.getClientRegistration().getClientId());
            log.setIpAddress(getClientIp());
            log.setDetails("失败原因：" + event.getException().getMessage());
            auditRepository.save(log);
        }
    }

    private String getClientIp() {
        if (request == null) {
            return "UNKNOWN";
        }
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("Proxy-Client-IP");
        }
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("WL-Proxy-Client-IP");
        }
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }
        return ip;
    }
}

4. 配置可开关的审计功能 #

通过配置属性控制审计功能是否启用：

@Configuration
@ConditionalOnProperty(prefix = "security.auth.audit", name = "enabled", havingValue = "true", matchIfMissing = false)
public class AuthAuditConfiguration {
    // 此处可注册审计相关Bean，如监听器、仓库等
}

该方案实现了可配置的、基于JDBC的结构化审计功能，能记录登录成败、客户端信息等关键数据，且与核心认证逻辑解耦。

内容的提问来源于stack exchange，提问作者Geir Hedemark