Spring Boot OAuth2银行AD场景：授权类型选型及代码改造咨询

Hey there! Let's work through your problem step by step, since you're dealing with an AD-integrated web app that needs to get OAuth2 tokens without re-authenticating users.

1. 最适配的授权类型：授权码流（Authorization Code Flow） #

First off, Authorization Code Flow is the clear winner here—and here's why:

• Better security: Unlike the Implicit Flow (which sends tokens directly to the frontend), the Authorization Code Flow uses a backend-to-backend exchange to get the access token. This keeps tokens out of browser storage, reducing the risk of XSS attacks or token theft—critical since you're using these tokens for API calls.
• Fits your AD scenario perfectly: We can extend the flow to let your web app send the already-authenticated AD user ID to the authorization server. The server validates the user via LDAP, then issues an authorization code (which the app exchanges for a token) without asking the user to log in again.
• Future-proof: Implicit Flow is actually discouraged in OAuth 2.1 because of its security flaws, so going with Authorization Code Flow aligns with modern best practices.

Why not Implicit Flow? Simple—tokens are exposed directly to the frontend, which is a big red flag for enterprise apps that need to protect API access. Plus, Implicit Flow doesn't support refresh tokens, so you'd have to re-authenticate users more often than necessary.

2. 授权服务器与资源服务器的代码修改 #

Let's dive into the specific changes you'll need to make to your Spring Boot OAuth2 setup.

2.1 授权服务器（Spring Boot OAuth2 Authorization Server） #

Your main goals here are: integrate LDAP for AD user validation, extend the authorization code flow to accept the AD user ID, and add user group data to the issued tokens.

Step 1: Set up LDAP integration

First, add the LDAP starter to your pom.xml:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-ldap</artifactId>
</dependency>

Then configure your AD LDAP connection in application.yml:

spring:
  ldap:
    urls: ldap://your-ad-server:389
    base: dc=your-domain,dc=com
    username: cn=admin,dc=your-domain,dc=com
    password: your-admin-password

Create a service to handle LDAP user checks and group retrieval:

@Service
public class LdapUserService {
    private final LdapTemplate ldapTemplate;

    public LdapUserService(LdapTemplate ldapTemplate) {
        this.ldapTemplate = ldapTemplate;
    }

    // Validate if the AD user ID exists in your directory
    public boolean isAdUserValid(String userId) {
        // Adjust the filter to match your AD's user attribute (usually sAMAccountName)
        return ldapTemplate.exists(LdapQuery.query().where("sAMAccountName").is(userId));
    }

    // Fetch all AD groups the user belongs to
    public List<String> getUserAdGroups(String userId) {
        List<String> groupNames = new ArrayList<>();
        // Update the base DN and filter to match your AD's group structure
        List<Attributes> groupAttributes = ldapTemplate.search(
            LdapQuery.query()
                .base("ou=Groups,dc=your-domain,dc=com")
                .where("member").has("CN=" + userId + ",ou=Users,dc=your-domain,dc=com"),
            (AttributesMapper<Attributes>) attrs -> attrs
        );

        for (Attributes attrs : groupAttributes) {
            try {
                groupNames.add((String) attrs.get("cn").get());
            } catch (NamingException e) {
                // Log the error instead of swallowing it in production!
                e.printStackTrace();
            }
        }
        return groupNames;
    }
}

Step 2: Extend the authorization code flow to accept AD user IDs

Since your web app already has the authenticated AD user ID, we need to skip the login form and auto-validate the user. Create a custom authorization request resolver:

@Component
public class AdAuthRequestResolver implements OAuth2AuthorizationRequestResolver {
    private final OAuth2AuthorizationRequestResolver defaultResolver;
    private final LdapUserService ldapUserService;

    public AdAuthRequestResolver(OAuth2AuthorizationRequestResolver defaultResolver, LdapUserService ldapUserService) {
        this.defaultResolver = defaultResolver;
        this.ldapUserService = ldapUserService;
    }

    @Override
    public OAuth2AuthorizationRequest resolve(HttpServletRequest request) {
        OAuth2AuthorizationRequest authRequest = defaultResolver.resolve(request);
        if (authRequest != null && request.getParameter("ad_user_id") != null) {
            String adUserId = request.getParameter("ad_user_id");
            
            // Validate the AD user against LDAP
            if (!ldapUserService.isAdUserValid(adUserId)) {
                throw new OAuth2AuthenticationException(
                    new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST, "Invalid AD user ID", null)
                );
            }

            // Set the authenticated user in the security context so the flow proceeds
            Authentication auth = new UsernamePasswordAuthenticationToken(
                adUserId, null, Collections.emptyList()
            );
            SecurityContextHolder.getContext().setAuthentication(auth);
        }
        return authRequest;
    }

    @Override
    public OAuth2AuthorizationRequest resolve(HttpServletRequest request, String clientId) {
        return defaultResolver.resolve(request, clientId);
    }
}

Now update your authorization server config to use this resolver, add a token enhancer to include group data, and configure your client:

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    private final AdAuthRequestResolver adAuthRequestResolver;
    private final AuthenticationManager authenticationManager;
    private final LdapUserService ldapUserService;

    public AuthServerConfig(AdAuthRequestResolver adAuthRequestResolver, 
                            AuthenticationManager authenticationManager,
                            LdapUserService ldapUserService) {
        this.adAuthRequestResolver = adAuthRequestResolver;
        this.authenticationManager = authenticationManager;
        this.ldapUserService = ldapUserService;
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
            .authenticationManager(authenticationManager)
            .authorizationRequestResolver(adAuthRequestResolver)
            .tokenEnhancer(tokenEnhancer()); // Add user groups to tokens
    }

    // Custom token enhancer to inject AD groups into the access token
    private TokenEnhancer tokenEnhancer() {
        return (accessToken, authentication) -> {
            if (authentication.getPrincipal() instanceof String) {
                String userId = (String) authentication.getPrincipal();
                Map<String, Object> extraClaims = new HashMap<>();
                extraClaims.put("groups", ldapUserService.getUserAdGroups(userId));
                ((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(extraClaims);
            }
            return accessToken;
        };
    }

    // Configure your web app client (adjust for your production setup!)
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("web-app-client")
            .secret("{noop}your-client-secret") // Use BCrypt in production!
            .authorizedGrantTypes("authorization_code")
            .scopes("api.read", "api.write")
            .redirectUris("http://your-web-app/callback") // Your app's callback URL
            .autoApprove(true); // Auto-approve since user is already authenticated via AD
    }
}

2.2 资源服务器（Spring Boot OAuth2 Resource Server） #

Your resource server needs to validate tokens and use the embedded group data for authorization checks.

Step 1: Basic resource server config

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .anyRequest().authenticated();
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId("your-api-resource-id");
    }
}

Step 2: Use AD groups for authorization

You can use method-level security to restrict access based on user groups. First, enable global method security:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
}

Then use @PreAuthorize in your API controllers to check group membership:

@RestController
@RequestMapping("/api")
public class ApiController {
    @GetMapping("/admin-data")
    @PreAuthorize("hasAuthority('GROUP_ADMIN')")
    public String getAdminData(Authentication auth) {
        // Extract groups from the token details
        Map<String, Object> tokenDetails = (Map<String, Object>) auth.getDetails();
        List<String> userGroups = (List<String>) tokenDetails.get("groups");
        return "Admin-only data for user groups: " + userGroups;
    }

    @GetMapping("/user-data")
    @PreAuthorize("hasAnyAuthority('GROUP_USER', 'GROUP_ADMIN')")
    public String getUserData() {
        return "User-accessible data";
    }
}

If you're using JWT tokens, add this to application.yml to let the resource server validate tokens against your authorization server:

security:
  oauth2:
    resource:
      jwt:
        key-uri: http://your-auth-server/oauth/token_key

Wrap-up #

To recap:

• Go with Authorization Code Flow for security and compliance with modern OAuth standards
• Modify your authorization server to integrate LDAP, accept AD user IDs, and inject group data into tokens
• Update your resource server to validate tokens and enforce access control based on AD groups

内容的提问来源于stack exchange，提问作者Suraj Kumar