如何配置Pac4J适配Facebook非标准OpenID Connect受限登录？

Facebook的Limited Login实现确实偏离了标准OpenID Connect（OIDC）流程，它省略了token端点，要求直接验证JWT形式的令牌。针对这个场景，无法仅通过Pac4J的标准OidcConfiguration和OIDCProviderMetadata完成适配，需要自定义部分核心接口来覆盖默认的认证流程，具体步骤如下：

1. 手动配置OIDC元数据 #

跳过自动发现流程，手动构建OIDCProviderMetadata，填入Facebook Limited Login要求的核心字段：

OIDCProviderMetadata metadata = new OIDCProviderMetadata();
metadata.setIssuer("https://www.facebook.com");
metadata.setJwksUri("https://www.facebook.com/.well-known/oauth/openid/jwks/");
// 按需设置授权端点等其他必要字段

将元数据绑定到OidcConfiguration：

OidcConfiguration config = new OidcConfiguration();
config.setClientId("你的Facebook客户端ID");
config.setClientSecret("你的Facebook客户端密钥");
config.setProviderMetadata(metadata);
config.setUseNonce(true); // 按Facebook要求启用nonce验证

2. 自定义Credentials提取逻辑 #

默认的OidcAuthorizationCodeCredentialsExtractor会尝试调用token端点换取令牌，这在Facebook场景下不可行。需要重写该类，直接从回调请求中提取JWT令牌：

public class FacebookLimitedLoginCredentialsExtractor extends OidcAuthorizationCodeCredentialsExtractor {

    public FacebookLimitedLoginCredentialsExtractor(OidcConfiguration configuration) {
        super(configuration);
    }

    @Override
    public Optional<Credentials> extract(WebContext context, SessionStore sessionStore) {
        String idToken = context.getRequestParameter("id_token");
        if (StringUtils.isBlank(idToken)) {
            return Optional.empty();
        }
        OidcCredentials credentials = new OidcCredentials();
        credentials.setIdToken(idToken);
        validateNonce(context, sessionStore, credentials);
        return Optional.of(credentials);
    }
}

3. 自定义JWT验证逻辑 #

替换默认的OidcAuthenticator，实现符合Facebook指南的JWT验证逻辑：

public class FacebookLimitedLoginAuthenticator extends OidcAuthenticator {

    private final JwtValidator jwtValidator;

    public FacebookLimitedLoginAuthenticator(OidcConfiguration configuration) {
        super(configuration);
        this.jwtValidator = new JwtValidator(configuration.getProviderMetadata().getJwksUri());
        // 添加必要的验证规则
        jwtValidator.addRule(new IssuerRule(configuration.getProviderMetadata().getIssuer()));
        jwtValidator.addRule(new AudienceRule(configuration.getClientId()));
        jwtValidator.addRule(new ExpirationRule());
    }

    @Override
    public void validate(Credentials credentials, WebContext context, SessionStore sessionStore) {
        OidcCredentials oidcCredentials = (OidcCredentials) credentials;
        String idToken = oidcCredentials.getIdToken();
        Jwt jwt = jwtValidator.validate(idToken);
        
        // 将JWT声明映射为CommonProfile
        CommonProfile profile = new CommonProfile();
        profile.setId(jwt.getClaim("sub"));
        profile.setDisplayName(jwt.getClaim("name"));
        profile.setEmail(jwt.getClaim("email"));
        oidcCredentials.setUserProfile(profile);
    }
}

4. 配置OidcClient使用自定义组件 #

将自定义的提取器和验证器绑定到OidcClient：

OidcClient client = new OidcClient(config);
client.setCredentialsExtractor(new FacebookLimitedLoginCredentialsExtractor(config));
client.setAuthenticator(new FacebookLimitedLoginAuthenticator(config));

之后即可使用你原有的回调代码完成认证：

Optional<Credentials> credentials = client.getCredentials(context, sessionStore);
return client.getUserProfile(credentials.orElse(null), context, sessionStore)
    .map(CommonProfile.class::cast)
    .orElse(null);

关键说明 #

• 标准配置无法适配的核心原因是Facebook省略了OIDC标准中的token端点流程，Pac4J默认实现依赖该端点完成令牌交换和验证，因此必须自定义提取和验证逻辑。
• 需严格按照Facebook要求完成JWT验证：包括用其公钥校验签名、验证iss、aud、exp、nonce等字段，避免安全风险。

内容的提问来源于stack exchange，提问作者Simon Tenbeitel