基于Spring Cloud Netflix微服务的ReactJS单点登录实现技术问询

Hey there! Let’s dive into your Spring Cloud Netflix SSO setup with Zuul and OAuth2. Based on the partial config you shared, here are some key points and actionable solutions to common pitfalls you might encounter:

First, let’s format your provided code snippet for clarity:

/** 
 * SSO security config. 
 */ 
@Configuration 
@EnableZuulProxy 
@EnableOAuth2Sso 
@EnableWebSecurity 
public class SsoSecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private OAuth2ClientAuthenticationProcessingFilter ssoFilter; 

    @Autowired 
    private Aut... // Your incomplete dependency here
}

1. Complete the Filter Integration #

Since you’ve autowired the ssoFilter, you need to explicitly add it to the security filter chain to ensure it intercepts authentication requests. Add this override to your configuration class:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
            // Public endpoints that don't require authentication
            .antMatchers("/login", "/error", "/oauth/**", "/actuator/**")
            .permitAll()
            // All other requests need authentication
            .anyRequest()
            .authenticated()
        .and()
        // Insert the SSO filter before the basic auth filter to prioritize it
        .addFilterBefore(ssoFilter, BasicAuthenticationFilter.class)
        // Disable CSRF if your backend services don't require it (adjust based on your needs)
        .csrf().disable();
}

2. Propagate OAuth2 Tokens to Backend Services #

Zuul needs to pass the authenticated user’s token to downstream microservices so they can validate the request. Create a pre-filter to relay the token in request headers:

@Component
public class OAuth2TokenRelayFilter extends ZuulFilter {

    @Autowired
    private OAuth2AuthenticationDetails authenticationDetails;

    @Override
    public String filterType() {
        return "pre"; // Run before the request is routed to the backend
    }

    @Override
    public int filterOrder() {
        return 1; // Set priority relative to other filters
    }

    @Override
    public boolean shouldFilter() {
        // Only run if the user is authenticated via OAuth2
        return SecurityContextHolder.getContext().getAuthentication() instanceof OAuth2Authentication;
    }

    @Override
    public Object run() {
        RequestContext ctx = RequestContext.getCurrentContext();
        // Add the Bearer token to the request header for backend services
        ctx.addZuulRequestHeader("Authorization", "Bearer " + authenticationDetails.getTokenValue());
        return null;
    }
}

3. Validate OAuth2 Server Configuration #

Double-check your gateway’s application properties/yaml to ensure it’s correctly connected to your OAuth2 server. For JWT tokens, this would look like:

security:
  oauth2:
    client:
      client-id: your-gateway-client-id
      client-secret: your-gateway-client-secret
      access-token-uri: http://your-oauth2-server/oauth/token
      user-authorization-uri: http://your-oauth2-server/oauth/authorize
    resource:
      jwt:
        # Endpoint to fetch public key for JWT validation
        key-uri: http://your-oauth2-server/oauth/token_key

4. Fix Common SSO Pitfalls #

• CORS Issues: If your frontend runs on a separate domain, add CORS configuration to avoid blocked requests:

  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.cors().configurationSource(corsConfigurationSource());
      // ... existing config
  }
  
  private CorsConfigurationSource corsConfigurationSource() {
      CorsConfiguration config = new CorsConfiguration();
      config.setAllowedOrigins(Arrays.asList("https://your-frontend-domain.com"));
      config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
      config.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type"));
      config.setAllowCredentials(true);
      UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
      source.registerCorsConfiguration("/**", config);
      return source;
  }
  

• Redirect Loops: Ensure your OAuth2 server’s registered callback URL matches the gateway’s path, and avoid conflicting login page configurations in HttpSecurity.
• Permission Denied Errors: Verify that user authorities (roles/permissions) are correctly mapped from the OAuth2 server to the gateway, and that backend services validate these authorities.

If you can share the rest of your SsoSecurityConfig code or specific issues you’re facing (like authentication failures, token validation errors, etc.), I can provide more targeted help!

内容的提问来源于stack exchange，提问作者Niaz Bibkaev