Spring Boot OAuth2：如何通过自定义SSLContext访问认证服务器？

核心思路 #

Spring Security的JWT解码器默认会复用Spring的RestTemplate配置，无需直接重写NimbusJwtDecoder，只需通过配置自定义ClientHttpRequestFactory注入SSL上下文，让JWT解码器自动复用该配置完成HTTPS通信。

具体步骤 #

1. 从应用属性加载证书并构建SSLContext #

先定义配置类读取自定义SSL相关属性，再构建SSLContext：

@ConfigurationProperties(prefix = "custom.ssl")
public class SslProperties {
    private String keyStorePath;
    private String keyStorePassword;
    private String trustStorePath;
    private String trustStorePassword;

    // 省略getter、setter
}

@Configuration
public class SslConfig {
    @Bean
    public SSLContext sslContext(SslProperties sslProperties) throws Exception {
        // 加载密钥库
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        try (InputStream is = new FileInputStream(sslProperties.getKeyStorePath())) {
            keyStore.load(is, sslProperties.getKeyStorePassword().toCharArray());
        }

        // 加载信任库
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        try (InputStream is = new FileInputStream(sslProperties.getTrustStorePath())) {
            trustStore.load(is, sslProperties.getTrustStorePassword().toCharArray());
        }

        // 初始化密钥管理器和信任管理器
        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, sslProperties.getKeyStorePassword().toCharArray());

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);

        // 构建SSLContext
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), new SecureRandom());
        return sslContext;
    }
}

2. 创建支持自定义SSL的请求工厂 #

用上面的SSLContext构建ClientHttpRequestFactory，供RestTemplate使用：

@Bean
public ClientHttpRequestFactory customClientHttpRequestFactory(SSLContext sslContext) {
    HttpClient httpClient = HttpClient.create()
            .secure(sslSpec -> sslSpec.sslContext(sslContext));
    return new ReactorClientHttpRequestFactory(httpClient);
}

3. 配置JwtDecoder使用自定义请求工厂 #

通过NimbusJwtDecoder的构建器注入自定义RestTemplate，让JWT解码器使用该配置与认证服务器通信：

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {

    @Bean
    public JwtDecoder jwtDecoder(OAuth2ResourceServerProperties properties, ClientHttpRequestFactory requestFactory) {
        RestTemplate restTemplate = new RestTemplate(requestFactory);
        return NimbusJwtDecoder.withJwkSetUri(properties.getJwt().getJwkSetUri())
                .restOperations(restTemplate)
                .build();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
        return http.build();
    }
}

方案优势 #

• 无需修改NimbusJwtDecoder核心逻辑，遵循Spring Security的扩展设计规范
• 复用Spring Boot配置体系，自定义SSL参数可通过应用属性统一管理
• 所有基于该RestTemplate的请求都会自动复用SSL配置，包括JWT的JWKS端点请求

内容的提问来源于stack exchange，提问作者norb