spring-authorization-server对接企业自有OIDC服务器可行性及配置咨询

Spring Authorization Server完全支持对接企业内部的OIDC服务器，核心是利用它的OAuth2身份提供者（Identity Provider, IDP）联邦能力，把企业OIDC服务配置成外部身份源，让Spring Authorization Server作为中间层代理认证请求，完全符合你统一认证入口、按环境区分配置的需求。

1. 基础依赖配置 #

确保项目引入Spring Authorization Server和Spring Security的核心依赖（以Maven为例）：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-authorization-server</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

2. 企业OIDC服务器配置（按环境区分） #

通过Spring Profile隔离公开网络和隔离区的OIDC配置，在application.yml中定义：

# 默认公开网络环境配置
spring:
  security:
    oauth2:
      client:
        registration:
          corporate-oidc-public:
            provider: corporate-public
            client-id: ${PUBLIC_OIDC_CLIENT_ID}
            client-secret: ${PUBLIC_OIDC_CLIENT_SECRET}
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: openid,profile,email
        provider:
          corporate-public:
            issuer-uri: https://public-corp-oidc.example.com/oidc
            user-name-attribute: sub

# 隔离区环境专属配置
---
spring:
  config:
    activate:
      on-profile: internal
  security:
    oauth2:
      client:
        registration:
          corporate-oidc-internal:
            provider: corporate-internal
            client-id: ${INTERNAL_OIDC_CLIENT_ID}
            client-secret: ${INTERNAL_OIDC_CLIENT_SECRET}
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: openid,profile,email
        provider:
          corporate-internal:
            issuer-uri: https://internal-corp-oidc.example.com/oidc
            user-name-attribute: sub

• issuer-uri：企业OIDC服务器的颁发者URI，Spring会自动通过OIDC发现机制获取授权、令牌、用户信息等端点地址
• user-name-attribute：指定企业OIDC返回的用户唯一标识字段（通常为sub）

3. 集成企业OIDC到Spring Authorization Server认证流程 #

编写配置类，将外部OIDC认证纳入Spring Authorization Server的登录流程：

@Configuration
public class AuthorizationServerConfig {

    @Bean
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
        // 应用Spring Authorization Server默认安全配置
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        // 启用OIDC支持
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
                .oidc(Customizer.withDefaults());

        // 配置登录流程，引导用户通过企业OIDC登录
        http.formLogin(Customizer.withDefaults())
                .oauth2Login(oauth2 -> oauth2
                        .loginPage("/login")
                        .clientRegistrationRepository(clientRegistrationRepository())
                        .authorizedClientService(authorizedClientService()));

        return http.build();
    }

    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        // 可根据当前激活的Profile动态加载对应OIDC配置，这里以公开环境为例
        ClientRegistration publicOidcRegistration = ClientRegistrations.fromIssuerLocation(
                        System.getenv("PUBLIC_OIDC_ISSUER_URI"))
                .registrationId("corporate-oidc-public")
                .clientId(System.getenv("PUBLIC_OIDC_CLIENT_ID"))
                .clientSecret(System.getenv("PUBLIC_OIDC_CLIENT_SECRET"))
                .scope("openid", "profile", "email")
                .build();

        return new InMemoryClientRegistrationRepository(publicOidcRegistration);
    }

    @Bean
    public OAuth2AuthorizedClientService authorizedClientService(ClientRegistrationRepository repo) {
        return new InMemoryOAuth2AuthorizedClientService(repo);
    }

    // 配置Spring Authorization Server所需的JWK源（用于签发自身令牌）
    @Bean
    public JWKSource<SecurityContext> jwkSource() {
        RSAKey rsaKey = generateRsa();
        JWKSet jwkSet = new JWKSet(rsaKey);
        return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
    }

    private static RSAKey generateRsa() {
        KeyPair keyPair = generateRsaKey();
        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
        return new RSAKey.Builder(publicKey)
                .privateKey(privateKey)
                .keyID(UUID.randomUUID().toString())
                .build();
    }

    private static KeyPair generateRsaKey() {
        try {
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
            keyPairGenerator.initialize(2048);
            return keyPairGenerator.generateKeyPair();
        } catch (NoSuchAlgorithmException ex) {
            throw new IllegalStateException(ex);
        }
    }
}

4. 业务应用统一对接Spring Authorization Server #

所有业务应用只需配置对接你的Spring Authorization Server，无需直接关联企业OIDC服务。示例配置（application.yml）：

spring:
  security:
    oauth2:
      client:
        registration:
          spring-auth-server:
            provider: spring-auth
            client-id: app-client-id
            client-secret: app-client-secret
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: openid,profile,email
        provider:
          spring-auth:
            issuer-uri: https://your-spring-auth-server.example.com

关键注意事项 #

• 环境切换：部署时只需激活对应Spring Profile（如--spring.profiles.active=internal），即可自动切换对接的企业OIDC服务器
• 用户信息映射：如果企业OIDC返回的用户字段需要自定义转换，可实现OAuth2UserService接口处理用户信息映射
• 令牌自定义：如需调整Spring Authorization Server颁发的令牌格式或内容，可自定义OAuth2TokenCustomizer实现

内容的提问来源于stack exchange，提问作者Steve Storck