Spring Authorization Server测试用例中无client-id能否实现用户登录?
我对Spring Authorization Server的defaultAuthorizationServer示例项目中的测试用例感到好奇:该测试用例未关联client-id,但用户仍可完成登录:
@Test public void whenLoggingInAndRequestingTokenThenRedirectsToClientApplication() throws IOException { // Log in this.webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); this.webClient.getOptions().setRedirectEnabled(false); signIn(this.webClient.getPage("/login"), "user1", "password"); // Request token WebResponse response = this.webClient.getPage(AUTHORIZATION_REQUEST).getWebResponse(); assertThat(response.getStatusCode()).isEqualTo(HttpStatus.MOVED_PERMANENTLY.value()); String location = response.getResponseHeaderValue("location"); assertThat(location).startsWith(REDIRECT_URI); assertThat(location).contains("code="); }
我在自己的项目中运行了该测试用例,并且实现了AuthenticationProvider,通过RequestCache检测到clientId始终为null。我想知道是否存在用户无需client-id即可登录授权服务器的场景?我认为用户登录登录页面时应始终关联客户端应用或client-id。
以下是我的AuthenticationProvider实现:
@Service public class AuthenticationCallout implements AuthenticationProvider { private static final Logger LOG = LoggerFactory.getLogger(AuthenticationCallout.class); private RequestCache requestCache; private WebClient.Builder webClientBuilder; public AuthenticationCallout(WebClient.Builder webClientBuilder, RequestCache requestCache) { this.webClientBuilder = webClientBuilder; this.requestCache = requestCache; } @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { LOG.info("authenticate with username and password"); final String clientId = ClientIdUtil.getClientId(requestCache); LOG.info("clientId: {}", clientId); //client-id is always null because the login does not have a client association // ... 省略后续代码 } }
对应的ClientIdUtil实现:
public class ClientIdUtil { private static final Logger LOG = LoggerFactory.getLogger(ClientIdUtil.class); public static String getClientId(RequestCache requestCache) { var requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes(); var request = requestAttributes.getRequest(); var response = requestAttributes.getResponse(); var savedRequest = requestCache.getRequest(request, response); return ClientIdUtil.getParameter(savedRequest, OAuth2ParameterNames.CLIENT_ID); } }
内容的提问来源于stack exchange,提问作者Katlock
相关产品推荐
相关产品推荐

