配置OAuth2登录时遇OpenID Connect认证请求受限问题求助

问题重现 #

配置OAuth2登录时遇到以下错误，认证服务器返回invalid_scope，提示OpenID Connect 1.0 authentication requests are restricted：

2023-04-02T11:52:28.856+03:00 DEBUG 3866 --- [nio-9000-exec-2] org.apache.tomcat.util.http.Parameters   : Start processing with input [response_type=code&client_id=guitar-cloud-client&scope=openid&state=P3j3mwpUvm1UR_tVYjWelCDGauVZxf4ZOOcUyFVSc00%3D&redirect_uri=http://127.0.0.1:8080/login/oauth2/code/guitar-cloud-client-oidc&nonce=D-qBrlre2P-il99B1HW8ejFWfMR1fQHB2QG7WRHydNc]
2023-04-02T11:52:28.857+03:00 DEBUG 3866 --- [nio-9000-exec-2] .s.a.DefaultAuthenticationEventPublisher : No event was found for the exception org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationException
2023-04-02T11:52:28.857+03:00 DEBUG 3866 --- [nio-9000-exec-2] o.s.s.web.DefaultRedirectStrategy        : Redirecting to `http://127.0.0.1:8080/login/oauth2/code/guitar-cloud-client-oidc?error=invalid_scope&error_description=OpenID%20Connect%201.0%20authentication%20requests%20are%20restricted.&error_uri=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc6749%23section-4.1.2.1&state=P3j3mwpUvm1UR_tVYjWelCDGauVZxf4ZOOcUyFVSc00%3D`

此前已在认证服务器端通过添加以下代码启用OIDC：

http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
        .oidc(Customizer.withDefaults());

解决方案 #

1. 认证服务器端：确保客户端注册包含openid权限 #

在认证服务器的RegisteredClient配置中，必须为客户端添加openid scope，否则会限制OIDC请求：

RegisteredClient.withId("guitar-cloud-client")
    .clientId("guitar-cloud-client")
    .clientSecret("{noop}your-client-secret") // 根据实际加密方式调整
    .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
    .redirectUri("http://127.0.0.1:8080/login/oauth2/code/guitar-cloud-client-oidc")
    .scope("openid") // 必须添加这个scope
    .build();

2. 客户端端：正确配置OIDC客户端信息 #

方式一：通过配置文件（application.yml）

spring:
  security:
    oauth2:
      client:
        registration:
          guitar-cloud-client-oidc:
            client-id: guitar-cloud-client
            client-secret: your-client-secret
            scope: openid
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          guitar-cloud-client-oidc:
            issuer-uri: http://127.0.0.1:9000 # 认证服务器的issuer地址

方式二：Java代码配置Security Filter Chain

确保客户端的Security配置启用OAuth2登录：

@Bean
public SecurityFilterChain clientSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
        .oauth2Login(Customizer.withDefaults()); // 启用默认OAuth2登录配置，自动适配OIDC
    return http.build();
}

验证要点 #

• 确认认证服务器已启用OIDC端点（通过/.well-known/openid-configuration可查看元数据）
• 客户端请求的scope参数包含openid
• 认证服务器的客户端注册信息与客户端配置的client-id、redirect-uri完全匹配

内容的提问来源于stack exchange，提问作者Tony Cruelkid