Spring OAuth2授权服务器如何允许无需认证调用/oauth2/introspect端点

问题原因 #

Spring Security OAuth2 Authorization Server 0.3.1版本中，框架会自动为/oauth2/introspect端点添加客户端认证要求，仅通过authorizeRequests().antMatchers("/oauth2/introspect**").permitAll()无法覆盖该规则，因为授权服务器的内部端点配置优先级更高。

解决方案 #

创建一个优先级更高的独立SecurityFilterChain，专门处理/oauth2/introspect端点，直接允许匿名访问。

修改后的代码 #

1. 新增introspect端点专用过滤器链 #

@Bean
@Order(Ordered.HIGHEST_PRECEDENCE)
public SecurityFilterChain introspectSecurityFilterChain(HttpSecurity http) throws Exception {
    http
            .requestMatchers(matchers -> matchers.antMatchers("/oauth2/introspect"))
            .authorizeRequests(authorize -> authorize.anyRequest().permitAll())
            .csrf(csrf -> csrf.ignoringAntMatchers("/oauth2/introspect"));
    return http.build();
}

2. 调整原授权服务器过滤器链 #

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    http.cors()
            .configurationSource(request -> new CorsConfiguration()
                    .applyPermitDefaultValues());

    OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer =
            new OAuth2AuthorizationServerConfigurer<>();
    RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();

    http.csrf().disable();
    http.requestMatcher(endpointsMatcher)
            .authorizeRequests(authorizeRequests ->
                    authorizeRequests.anyRequest().authenticated())
            .csrf(csrf -> csrf.ignoringAntMatchers("/oauth2/token**"))
            .apply(authorizationServerConfigurer);

    return http.build();
}

3. 保留原RegisteredClientRepository配置 #

@Bean
public RegisteredClientRepository registeredClientRepository() {
    RegisteredClient registeredClient = RegisteredClient
            .withId(UUID.randomUUID().toString())
            .clientId("client")
            .clientSecret("{noop}secret")
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
            .clientSettings(ClientSettings.builder()
                    .tokenEndpointAuthenticationSigningAlgorithm(SignatureAlgorithm.RS256)
                    .build())
            .tokenSettings(TokenSettings.builder()
                    .accessTokenFormat(OAuth2TokenFormat.REFERENCE)
                    .idTokenSignatureAlgorithm(SignatureAlgorithm.RS256)
                    .accessTokenTimeToLive(Duration.ofMinutes(15))
                    .build())
            .scope("read")
            .build();
    return new InMemoryRegisteredClientRepository(registeredClient);
}

说明 #

通过@Order(Ordered.HIGHEST_PRECEDENCE)让introspect端点的过滤器链优先执行，请求进入该链后直接被允许匿名访问，不会触发后续授权服务器的客户端认证检查，从而实现无需认证即可校验令牌的需求。

内容的提问来源于stack exchange，提问作者SpicySandwich