Spring Security集成Cognito实现授权：转换器配置求助

1. 依赖配置 #

确保项目引入最新的Spring Security OAuth2资源服务器依赖，Spring Boot项目示例：

<!-- Maven -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

// Gradle
implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'

2. 自定义JWT权限转换器 #

替代已废弃的CognitoAccessTokenConverter，自定义转换器解析Cognito的cognito:groups声明，转换为Spring Security的权限对象：

import org.springframework.core.convert.converter.Converter;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.oauth2.jwt.Jwt;

import java.util.Collection;
import java.util.Collections;
import java.util.List;
import java.util.stream.Collectors;

public class CognitoJwtGrantedAuthoritiesConverter implements Converter<Jwt, Collection<GrantedAuthority>> {
    private static final String COGNITO_GROUPS_CLAIM = "cognito:groups";
    private static final String AUTHORITY_PREFIX = "ROLE_";

    @Override
    public Collection<GrantedAuthority> convert(Jwt jwt) {
        List<String> groups = jwt.getClaimAsStringList(COGNITO_GROUPS_CLAIM);
        if (groups == null || groups.isEmpty()) {
            return Collections.emptyList();
        }
        return groups.stream()
                .map(group -> new SimpleGrantedAuthority(AUTHORITY_PREFIX + group.toUpperCase()))
                .collect(Collectors.toList());
    }
}

3. 集成到Spring Security配置类 #

在SecurityFilterChain中配置自定义转换器，同时指定Cognito的JWT验证规则：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth
                        // 按需求配置资源权限控制
                        .requestMatchers("/admin/**").hasRole("ADMIN")
                        .requestMatchers("/user/**").hasAnyRole("ADMIN", "USER")
                        .anyRequest().authenticated()
                )
                .oauth2ResourceServer(oauth2 -> oauth2
                        .jwt(jwt -> jwt
                                .jwtAuthenticationConverter(jwtAuthenticationConverter())
                        )
                );
        return http.build();
    }

    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        // 注入自定义权限转换器
        converter.setJwtGrantedAuthoritiesConverter(new CognitoJwtGrantedAuthoritiesConverter());
        return converter;
    }
}

4. 配置文件补充 #

添加Cognito的验证配置，让Spring Security能正确校验JWT签名：

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json
          issuer-uri: https://cognito-idp.{region}.amazonaws.com/{userPoolId}

替换{region}和{userPoolId}为你的Cognito用户池实际信息。

关键说明 #

• 旧版CognitoAccessTokenConverter所属的spring-security-oauth2-autoconfigure模块已废弃，最新版本统一使用spring-security-oauth2-resource-server的JWT组件。
• 自定义转换器将Cognito组转换为带ROLE_前缀的权限，可直接配合hasRole()/hasAnyRole()方法做权限校验。
• JwtAuthenticationConverter是Spring Security提供的标准转换器，通过注入自定义权限转换器实现业务逻辑集成。

内容的提问来源于stack exchange，提问作者LostInCode-dvp