Spring Boot OAuth2资源服务器认证成功监听器实现咨询

当然存在对应的处理方式，以下是几种实用的实现方案，根据你的资源服务器OAuth2模式选择即可：

1. 监听AuthenticationSuccessEvent事件 #

Spring Security会在认证成功后自动发布AuthenticationSuccessEvent事件，你可以通过实现事件监听器来捕获这个时机，处理本地用户的创建/复制：

@Component
public class OAuth2AuthSuccessListener implements ApplicationListener<AuthenticationSuccessEvent> {

    private final UserRepository userRepository;

    public OAuth2AuthSuccessListener(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public void onApplicationEvent(AuthenticationSuccessEvent event) {
        Authentication auth = event.getAuthentication();
        if (auth instanceof OAuth2AuthenticationToken) {
            OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) auth;
            OAuth2User oauth2User = oauthToken.getPrincipal();
            
            String username = oauth2User.getAttribute("username");
            String email = oauth2User.getAttribute("email");
            
            if (!userRepository.existsByUsername(username)) {
                User localUser = new User();
                localUser.setUsername(username);
                localUser.setEmail(email);
                // 补充其他必要字段
                userRepository.save(localUser);
            }
        }
    }
}

2. 自定义OAuth2UserService（授权码模式优先） #

如果你的资源服务器基于授权码模式对接第三方授权服务，可以自定义OAuth2UserService，在加载第三方用户信息的阶段直接完成本地用户的同步：

@Service
public class CustomOAuth2UserService extends DefaultOAuth2UserService {

    private final UserRepository userRepository;

    public CustomOAuth2UserService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
        OAuth2User oauth2User = super.loadUser(userRequest);
        
        String username = oauth2User.getAttribute("username");
        if (!userRepository.existsByUsername(username)) {
            User localUser = new User();
            localUser.setUsername(username);
            localUser.setEmail(oauth2User.getAttribute("email"));
            userRepository.save(localUser);
        }
        
        return oauth2User;
    }
}

配置类中指定自定义Service：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final CustomOAuth2UserService customOAuth2UserService;

    public SecurityConfig(CustomOAuth2UserService customOAuth2UserService) {
        this.customOAuth2UserService = customOAuth2UserService;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .oauth2Login()
                .userInfoEndpoint()
                    .userService(customOAuth2UserService);
    }
}

3. 自定义JwtAuthenticationConverter（JWT令牌模式优先） #

如果资源服务器使用JWT令牌做身份验证，自定义JwtAuthenticationConverter可以在JWT转换为Authentication对象的过程中，同步处理本地用户：

@Component
public class CustomJwtAuthenticationConverter extends JwtAuthenticationConverter {

    private final UserRepository userRepository;

    public CustomJwtAuthenticationConverter(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    protected AbstractAuthenticationToken extractAuthentication(Jwt jwt) {
        AbstractAuthenticationToken auth = super.extractAuthentication(jwt);
        
        String username = jwt.getClaim("sub");
        String email = jwt.getClaim("email");
        
        if (!userRepository.existsByUsername(username)) {
            User localUser = new User();
            localUser.setUsername(username);
            localUser.setEmail(email);
            userRepository.save(localUser);
        }
        
        return auth;
    }
}

配置类中绑定转换器：

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    private final CustomJwtAuthenticationConverter customJwtAuthenticationConverter;

    public ResourceServerConfig(CustomJwtAuthenticationConverter customJwtAuthenticationConverter) {
        this.customJwtAuthenticationConverter = customJwtAuthenticationConverter;
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.jwt()
            .jwtAuthenticationConverter(customJwtAuthenticationConverter);
    }
}

注意事项 #

• 处理用户创建逻辑时要添加异常捕获，避免因数据库操作失败导致认证流程中断。
• 分布式环境下要考虑并发问题，比如给用户名字段加唯一约束，或使用乐观锁防止重复创建。
• 根据你实际使用的OAuth2模式选择对应方案：JWT模式选方案3，授权码模式选方案2，通用场景选方案1。

内容的提问来源于stack exchange，提问作者Thirumal