Spring Data REST中OAuth2登录后获取用户ID的方案咨询

你的方案完全可行，这是Spring Security整合OAuth2与本地用户数据的标准实践之一，能有效避免每次通过邮箱查询用户ID的繁琐流程。以下是具体实现步骤及更安全的优化方式：

一、核心实现步骤 #

1. 自定义UserDetails类，携带本地用户ID #

扩展Spring Security的UserDetails接口，加入本地User表的主键ID、邮箱等核心字段：

public class CustomUserDetails implements UserDetails {
    private final Long userId;
    private final String email;
    private final Collection<? extends GrantedAuthority> authorities;

    public CustomUserDetails(Long userId, String email, Collection<? extends GrantedAuthority> authorities) {
        this.userId = userId;
        this.email = email;
        this.authorities = authorities;
    }

    // 实现UserDetails接口的必填方法
    @Override
    public String getPassword() { return null; } // OAuth2场景无需本地密码
    @Override
    public String getUsername() { return email; }
    @Override
    public boolean isAccountNonExpired() { return true; }
    @Override
    public boolean isAccountNonLocked() { return true; }
    @Override
    public boolean isCredentialsNonExpired() { return true; }
    @Override
    public boolean isEnabled() { return true; }

    // 自定义getter
    public Long getUserId() { return userId; }
}

2. 实现UserDetailsService加载本地用户 #

根据OAuth2返回的邮箱查询本地User表，封装成CustomUserDetails：

@Service
public class CustomUserDetailsService implements UserDetailsService {
    private final UserRepository userRepository;

    public CustomUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
        User localUser = userRepository.findByEmail(email)
                .orElseThrow(() -> new UsernameNotFoundException("用户不存在：" + email));

        // 转换本地用户角色为Spring Security权限
        Collection<GrantedAuthority> authorities = localUser.getRoles().stream()
                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
                .collect(Collectors.toList());

        return new CustomUserDetails(localUser.getId(), localUser.getEmail(), authorities);
    }
}

3. 配置OAuth2登录关联本地用户数据 #

在Security配置中，让OAuth2认证成功后自动加载本地用户信息，将CustomUserDetails作为认证主体：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    private final CustomUserDetailsService userDetailsService;

    public SecurityConfig(CustomUserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/users/{id}").access("@userAuthChecker.check(authentication, #id)")
                        .anyRequest().authenticated()
                )
                .oauth2Login(oauth2 -> oauth2
                        .userInfoEndpoint(userInfo -> userInfo
                                .userService(customOAuth2UserService())
                        )
                );
        return http.build();
    }

    private OAuth2UserService<OAuth2UserRequest, OAuth2User> customOAuth2UserService() {
        DefaultOAuth2UserService delegate = new DefaultOAuth2UserService();
        return request -> {
            // 获取Google返回的用户信息
            OAuth2User googleUser = delegate.loadUser(request);
            String email = googleUser.getAttribute("email");

            // 加载本地用户信息
            CustomUserDetails localUser = (CustomUserDetails) userDetailsService.loadUserByUsername(email);

            // 合并权限与属性，返回自定义认证主体
            return new DefaultOAuth2User(
                    localUser.getAuthorities(),
                    googleUser.getAttributes(),
                    "email"
            );
        };
    }
}

4. 实现用户权限校验逻辑 #

创建权限校验组件，限制普通用户仅能访问自身ID的/users/{id}端点：

@Component("userAuthChecker")
public class UserAuthorizationChecker {
    public boolean check(Authentication authentication, Long userId) {
        if (!(authentication.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }

        CustomUserDetails currentUser = (CustomUserDetails) authentication.getPrincipal();
        // 管理员直接放行，普通用户仅能访问自己的资源
        return authentication.getAuthorities().stream()
                .anyMatch(auth -> auth.getAuthority().equals("ROLE_ADMIN"))
                || currentUser.getUserId().equals(userId);
    }
}

二、更安全的优化方式 #

1. 自动处理新用户注册 #

对于首次通过Google登录的用户，自动在本地User表创建记录，避免UsernameNotFoundException：

// 修改CustomUserDetailsService的loadUserByUsername方法
@Override
public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
    return userRepository.findByEmail(email)
            .map(this::convertToUserDetails)
            .orElseGet(() -> {
                // 创建默认普通用户
                User newUser = new User();
                newUser.setEmail(email);
                newUser.setRoles(Collections.singletonList(new Role("USER")));
                userRepository.save(newUser);
                return convertToUserDetails(newUser);
            });
}

private CustomUserDetails convertToUserDetails(User user) {
    Collection<GrantedAuthority> authorities = user.getRoles().stream()
            .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
            .collect(Collectors.toList());
    return new CustomUserDetails(user.getId(), user.getEmail(), authorities);
}

2. 在Spring Data Repository层直接做权限控制 #

利用Spring Data REST的@PreAuthorize注解，直接在Repository层实现权限校验，更贴合REST风格：

@RepositoryRestResource(collectionResourceRel = "users", path = "users")
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByEmail(String email);

    @Override
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.userId")
    Optional<User> findById(Long id);
}

3. 封装认证主体工具类 #

避免代码中多次强转Authentication.getPrincipal()，封装工具类统一处理：

public final class AuthUtils {
    private AuthUtils() {}

    public static Long getCurrentUserId(Authentication authentication) {
        if (authentication == null || !(authentication.getPrincipal() instanceof CustomUserDetails)) {
            throw new AccessDeniedException("无效的认证信息");
        }
        return ((CustomUserDetails) authentication.getPrincipal()).getUserId();
    }
}

内容的提问来源于stack exchange，提问作者fire_water