Spring Authorization Server 1.0.0中如何为Token添加用户ID声明

要在生成的Token中加入userId这类自定义声明，你可以按照以下步骤操作：

1. 暴露IamUserDetails中的用户ID #

首先在你的IamUserDetails类中添加一个公开方法，用来获取数据库中的用户ID：

data class IamUserDetails(
    private val user: User,
) : UserDetails {

    // 新增方法：返回用户ID，类型根据你的User实体调整
    fun getUserId(): Long = user.id

    override fun getAuthorities(): MutableCollection<out GrantedAuthority> = mutableListOf()
    
    override fun getPassword() = user.password
    
    override fun getUsername() = user.email
    
    override fun isAccountNonExpired() = true
    
    override fun isAccountNonLocked() = true
    
    override fun isCredentialsNonExpired() = true
    
    override fun isEnabled() = user.enabled
}

2. 自定义Token生成器 #

创建一个OAuth2TokenCustomizer实现类，在Token生成过程中注入userId声明：

import org.springframework.security.oauth2.core.oidc.OidcIdToken
import org.springframework.security.oauth2.core.oidc.OidcUserInfo
import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer

class CustomJwtTokenCustomizer : OAuth2TokenCustomizer<JwtEncodingContext> {
    override fun customize(context: JwtEncodingContext) {
        // 从认证主体中获取自定义的UserDetails
        val userDetails = context.principal.principal as IamUserDetails
        
        // 给JWT添加userId声明
        context.claims.claim("userId", userDetails.getUserId())

        // 如果需要同时在OIDC UserInfo响应中返回userId，补充以下逻辑
        if (context.tokenType.value == OidcIdToken.TOKEN_TYPE_VALUE) {
            val existingUserInfo = context.get(OidcUserInfo::class.java) ?: OidcUserInfo.builder().build()
            val updatedUserInfo = OidcUserInfo.builder()
                .claims { it.putAll(existingUserInfo.claims) }
                .claim("userId", userDetails.getUserId())
                .build()
            context.put(OidcUserInfo::class.java, updatedUserInfo)
        }
    }
}

3. 配置Authorization Server加载自定义Token处理器 #

在你的授权服务器配置类中，将自定义的CustomJwtTokenCustomizer注册到Token生成流程中：

import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer
import org.springframework.security.web.SecurityFilterChain

@Configuration
class AuthorizationServerConfig {

    @Bean
    fun authorizationServerSecurityFilterChain(http: HttpSecurity): SecurityFilterChain {
        // 应用默认授权服务器安全配置
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http)
        
        // 配置Token自定义器
        http.getConfigurer(OAuth2AuthorizationServerConfigurer::class.java)
            .tokenConfigurer { tokenConfig ->
                // 给Access Token和ID Token都应用自定义逻辑
                tokenConfig.accessTokenCustomizer(CustomJwtTokenCustomizer())
                    .idTokenCustomizer(CustomJwtTokenCustomizer())
            }
        
        return http.build()
    }

    // 注意：这里需要保留你项目中已有的其他Bean配置，比如客户端仓库、用户认证管理器等
}

完成以上配置后，重新生成的Token就会包含userId声明，示例如下：

{
  "sub": "user@example.com",
  "aud": "messaging-client",
  "nbf": 1670443075,
  "scope": ["openid"],
  "iss": "http://localhost:8080",
  "exp": 1670443375,
  "iat": 1670443075,
  "userId": 123 // 新增的用户ID声明
}

内容的提问来源于stack exchange，提问作者Crovitz