Spring Authorization Server用户Scope权限差异化控制方案问询

核心结论 #

Spring Authorization Server本身支持基于用户的Scope过滤，这没有超出它的职责范围——框架提供了专门的扩展点来实现这类权限控制，无需依赖硬编码的客户端Scope配置。

具体实现方案 #

1. 通过OAuth2TokenCustomizer过滤用户可访问的Scope #

在令牌生成阶段，根据当前认证用户的身份，过滤掉用户无权限的Scope：

@Bean
public OAuth2TokenCustomizer<JwtEncodingContext> jwtTokenCustomizer() {
    return context -> {
        Authentication principal = context.getPrincipal();
        // 从用户身份信息中获取其允许的Scope列表（可替换为从数据库/权限系统查询）
        Collection<String> userAllowedScopes = getUserAllowedScopes(principal.getName());
        
        // 仅保留用户有权限且客户端请求过的Scope
        Set<String> authorizedScopes = context.getAuthorizedScopes().stream()
                .filter(userAllowedScopes::contains)
                .collect(Collectors.toSet());
        
        context.setAuthorizedScopes(authorizedScopes);
    };
}

// 模拟用户Scope权限查询逻辑
private Collection<String> getUserAllowedScopes(String username) {
    if ("user1".equals(username)) {
        return Set.of(OidcScopes.OPENID, OidcScopes.PROFILE, "message.read");
    } else if ("user2".equals(username)) {
        return Set.of(OidcScopes.OPENID, OidcScopes.PROFILE, "message.read", "message.write");
    }
    // 默认返回基础身份Scope
    return Set.of(OidcScopes.OPENID, OidcScopes.PROFILE);
}

2. 结合UserDetails加载用户专属Scope #

更规范的做法是将用户的Scope权限与用户信息绑定，通过自定义UserDetailsService加载：

// 自定义UserDetails，扩展存储用户Scope字段
public class CustomUserDetails implements UserDetails {
    private final Collection<String> scopes;
    private final String username;
    private final String password;

    public CustomUserDetails(String username, String password, Collection<String> scopes) {
        this.username = username;
        this.password = password;
        this.scopes = scopes;
    }

    public Collection<String> getScopes() {
        return scopes;
    }

    // 实现UserDetails其余必填方法...
    @Override
    public String getUsername() { return username; }
    @Override
    public String getPassword() { return password; }
    @Override
    public boolean isAccountNonExpired() { return true; }
    @Override
    public boolean isAccountNonLocked() { return true; }
    @Override
    public boolean isCredentialsNonExpired() { return true; }
    @Override
    public boolean isEnabled() { return true; }
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return Collections.emptyList();
    }
}

// 自定义UserDetailsService加载用户Scope
@Service
public class CustomUserDetailsService implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 实际场景中从数据库查询用户及对应Scope
        if ("user1".equals(username)) {
            return new CustomUserDetails("user1", "{noop}password1",
                    Set.of(OidcScopes.OPENID, OidcScopes.PROFILE, "message.read"));
        } else if ("user2".equals(username)) {
            return new CustomUserDetails("user2", "{noop}password2",
                    Set.of(OidcScopes.OPENID, OidcScopes.PROFILE, "message.read", "message.write"));
        }
        throw new UsernameNotFoundException("用户不存在");
    }
}

// 在TokenCustomizer中获取用户Scope并过滤
@Bean
public OAuth2TokenCustomizer<JwtEncodingContext> jwtTokenCustomizer() {
    return context -> {
        CustomUserDetails userDetails = (CustomUserDetails) context.getPrincipal().getPrincipal();
        Collection<String> userAllowedScopes = userDetails.getScopes();
        
        Set<String> authorizedScopes = context.getAuthorizedScopes().stream()
                .filter(userAllowedScopes::contains)
                .collect(Collectors.toSet());
        
        context.setAuthorizedScopes(authorizedScopes);
    };
}

3. 自定义同意页（可选） #

如果需要让用户在授权流程中明确选择自己有权限的Scope，可以自定义同意页面，渲染时根据用户身份过滤可选Scope：

• 自定义同意页控制器：

@Controller
public class CustomConsentController {
    @GetMapping("/oauth2/consent")
    public String consentPage(Model model, OAuth2AuthorizationRequest authorizationRequest) {
        Authentication principal = SecurityContextHolder.getContext().getAuthentication();
        CustomUserDetails userDetails = (CustomUserDetails) principal.getPrincipal();
        
        // 过滤客户端请求的Scope，仅保留用户有权限的选项
        Set<String> allowedScopes = authorizationRequest.getScopes().stream()
                .filter(userDetails.getScopes()::contains)
                .collect(Collectors.toSet());
        
        model.addAttribute("authorizationRequest", authorizationRequest);
        model.addAttribute("allowedScopes", allowedScopes);
        return "consent";
    }
}

• Thymeleaf模板（consent.html）示例：

<div th:each="scope : ${allowedScopes}">
    <input type="checkbox" name="scope" th:value="${scope}" checked>
    <label th:text="${scope}"></label>
</div>

职责范围说明 #

Spring Authorization Server的核心是处理OAuth2/OIDC授权流程、令牌生成与验证，但它通过扩展点（如OAuth2TokenCustomizer、自定义授权端点、UserDetailsService）开放了权限控制的能力。用户级Scope过滤属于授权流程的核心环节，完全可以在框架内实现，不属于超出职责范围的需求。

内容的提问来源于stack exchange，提问作者kfaria