基于SAML2认证后，API网关如何将JSessionID兑换为OAuth2授权码？

针对你的场景（授权服务器已通过SAML2建立用户会话，网关作为机密客户端需要将JSessionID兑换为OAuth2令牌），可以通过以下两种方案解决：

方案一：利用授权码流的静默授权 #

由于用户已在授权服务器存在有效会话，网关可以直接发起授权码请求，授权服务器会跳过用户交互步骤，直接返回授权码，再兑换为访问令牌。

1. 授权服务器配置调整 #

在授权服务器的RegisteredClient配置中，为网关客户端启用授权码流，并设置合法的回调地址：

@Bean
public RegisteredClientRepository registeredClientRepository() {
    RegisteredClient gatewayClient = RegisteredClient.withId(UUID.randomUUID().toString())
            .clientId("gateway-client")
            .clientSecret("{bcrypt}$2a$10$Z8xX9eH7y6G5F3D2S1A0Q") // 替换为加密后的客户端密钥
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
            .redirectUri("https://your-gateway-domain/login/oauth2/code/gateway") // 网关内部回调端点
            .scope("resource-service:read")
            .scope("resource-service:write")
            .build();
    return new InMemoryRegisteredClientRepository(gatewayClient);
}

2. 网关端实现令牌兑换逻辑 #

网关需要配置OAuth2客户端，并且在请求转发前完成授权码获取与令牌兑换：

（1）OAuth2客户端管理器配置

@Configuration
public class GatewayOAuth2Config {
    @Bean
    public OAuth2AuthorizedClientManager authorizedClientManager(
            ClientRegistrationRepository clientRegistrationRepository,
            OAuth2AuthorizedClientService authorizedClientService) {
        OAuth2AuthorizedClientProvider provider = OAuth2AuthorizedClientProviderBuilder.builder()
                .authorizationCode()
                .refreshToken()
                .build();

        DefaultOAuth2AuthorizedClientManager manager = new DefaultOAuth2AuthorizedClientManager(
                clientRegistrationRepository, authorizedClientService);
        manager.setAuthorizedClientProvider(provider);

        // 传递请求中的JSessionID Cookie到授权服务器，用于识别用户会话
        manager.setContextAttributesMapper(authorizeRequest -> {
            Map<String, Object> attrs = new HashMap<>();
            HttpServletRequest request = authorizeRequest.getAttribute(HttpServletRequest.class.getName());
            if (request != null) {
                for (Cookie cookie : request.getCookies()) {
                    if ("JSESSIONID".equals(cookie.getName())) {
                        attrs.put("JSESSIONID", cookie.getValue());
                    }
                }
            }
            return attrs;
        });
        return manager;
    }
}

（2）网关过滤器实现令牌注入

@Component
public class TokenExchangeFilter implements GatewayFilter {
    private final OAuth2AuthorizedClientManager clientManager;

    public TokenExchangeFilter(OAuth2AuthorizedClientManager clientManager) {
        this.clientManager = clientManager;
    }

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        // 提取请求中的JSessionID Cookie
        Cookie jsessionIdCookie = exchange.getRequest().getCookies().getFirst("JSESSIONID");
        if (jsessionIdCookie == null) {
            // 无会话，重定向到授权服务器启动SAML2登录
            return chain.filter(exchange.mutate()
                    .request(req -> req.path("/oauth2/authorization/your-saml2-idp"))
                    .build());
        }

        // 发起授权请求，利用已有会话获取令牌
        OAuth2AuthorizeRequest authRequest = OAuth2AuthorizeRequest.withClientRegistrationId("gateway-client")
                .principal(new AnonymousAuthenticationToken("gateway", "anonymous", Collections.emptyList()))
                .attribute(HttpServletRequest.class.getName(), exchange.getRequest())
                .build();

        return Mono.fromCallable(() -> clientManager.authorize(authRequest))
                .flatMap(authorizedClient -> {
                    // 将访问令牌注入请求头，转发到资源服务
                    String token = authorizedClient.getAccessToken().getTokenValue();
                    ServerHttpRequest modifiedReq = exchange.getRequest().mutate()
                            .header(HttpHeaders.AUTHORIZATION, "Bearer " + token)
                            .build();
                    return chain.filter(exchange.mutate().request(modifiedReq).build());
                })
                .onErrorResume(e -> {
                    // 会话失效，重定向到登录
                    return chain.filter(exchange.mutate()
                            .request(req -> req.path("/oauth2/authorization/your-saml2-idp"))
                            .build());
                });
    }
}

方案二：自定义令牌交换端点（更直接） #

如果觉得授权码流的回调步骤冗余，可以在授权服务器自定义一个端点，直接验证JSessionID的有效性后颁发访问令牌给网关。

1. 授权服务器自定义端点 #

@RestController
@RequestMapping("/oauth2")
public class TokenExchangeEndpoint {
    private final AuthenticationManager authenticationManager;
    private final OAuth2TokenGenerator<? extends OAuth2Token> tokenGenerator;
    private final RegisteredClientRepository clientRepository;
    private final PasswordEncoder passwordEncoder;

    public TokenExchangeEndpoint(AuthenticationManager authenticationManager,
                                 OAuth2TokenGenerator<? extends OAuth2Token> tokenGenerator,
                                 RegisteredClientRepository clientRepository,
                                 PasswordEncoder passwordEncoder) {
        this.authenticationManager = authenticationManager;
        this.tokenGenerator = tokenGenerator;
        this.clientRepository = clientRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @PostMapping("/exchange-session")
    public ResponseEntity<OAuth2AccessTokenResponse> exchangeSession(
            @RequestHeader(HttpHeaders.AUTHORIZATION) String clientAuth,
            HttpServletRequest request) {
        // 1. 验证网关客户端身份（Basic认证）
        String[] clientCreds = extractClientCredentials(clientAuth);
        RegisteredClient client = clientRepository.findByClientId(clientCreds[0]);
        if (client == null || !passwordEncoder.matches(clientCreds[1], client.getClientSecret())) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
        }

        // 2. 验证用户会话有效性
        Authentication userAuth = SecurityContextHolder.getContext().getAuthentication();
        if (userAuth == null || !userAuth.isAuthenticated()) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
        }

        // 3. 生成访问令牌
        OAuth2TokenContext tokenContext = OAuth2TokenContext.builder()
                .registeredClient(client)
                .principal(userAuth)
                .tokenType(OAuth2TokenType.ACCESS_TOKEN)
                .authorizedScopes(client.getScopes())
                .build();

        OAuth2AccessToken accessToken = (OAuth2AccessToken) tokenGenerator.generate(tokenContext);
        return ResponseEntity.ok(OAuth2AccessTokenResponse.withToken(accessToken.getTokenValue())
                .tokenType(accessToken.getTokenType())
                .expiresIn(accessToken.getExpiresAt().getEpochSecond() - Instant.now().getEpochSecond())
                .scopes(accessToken.getScopes())
                .build());
    }

    private String[] extractClientCredentials(String authHeader) {
        String base64Creds = authHeader.replace("Basic ", "");
        String creds = new String(Base64.getDecoder().decode(base64Creds));
        return creds.split(":", 2);
    }
}

2. 网关调用自定义端点兑换令牌 #

在网关过滤器中，直接调用该端点获取令牌：

// 修改TokenExchangeFilter中的兑换逻辑
return webClient.post()
        .uri("https://your-auth-server/oauth2/exchange-session")
        .header(HttpHeaders.AUTHORIZATION, "Basic " + Base64.getEncoder().encodeToString(("gateway-client:secret").getBytes()))
        .cookie("JSESSIONID", jsessionIdCookie.getValue())
        .retrieve()
        .bodyToMono(OAuth2AccessTokenResponse.class)
        .flatMap(response -> {
            ServerHttpRequest modifiedReq = exchange.getRequest().mutate()
                    .header(HttpHeaders.AUTHORIZATION, "Bearer " + response.getAccessToken().getTokenValue())
                    .build();
            return chain.filter(exchange.mutate().request(modifiedReq).build());
        });

关键注意事项 #

• 会话共享：如果网关与授权服务器为不同域名，需配置跨域Cookie（SameSite=None、Secure）或使用分布式会话（如Redis Session）实现会话共享。
• 客户端认证：网关作为机密客户端，必须使用CLIENT_SECRET_BASIC或CLIENT_SECRET_POST完成身份认证，避免令牌泄露。
• 令牌验证：资源服务需配置Spring Security OAuth2资源服务器，验证访问令牌的有效性。

内容的提问来源于stack exchange，提问作者wileecoyote