如何关闭用户会话/身份验证。 在 Spring OAuth2 中为用户/客户端发送访问令牌后的上下文

Question

I am implementing an app, let's call it OAuth2Client , whose authentication/authorization layer is managed with the spring OAuth2 protocol implementation on a different server, OAuth2Server . Everything is working great so far, I just want to divert a little bit from the "normal" OAuth2 flow.

So for example, in my third party app OAuth2Client , when users wants to log in, they have to authenticate via OAuth2Server . We then have the familiar OAuth2 flow where the user is redirected to the authentication page of the OAuth2Server , enters credentials, is asked for the permission to access his/her data etc.

If authentication is successful, he is redirected to the 'redirect_uri' registered with the OAuth2Client app, with the auth. 'code' included in the request. OAuth2Client then exchanges this 'code' with an 'access token' via an api call to the access token endpoint on the OAuth2Server .

What I want to do is close the user session/authentication context immediately after the user has successfully authenticated and has been provided with an access token.

I thought of using a filter to do that but I am not sure whether that's the best solution.

Any help would be appreciated thanks in advance...

Answer 1

I don't think you can attach the session event to the /token endpoint, but the session is actually not needed any more after the user has approved the grant and the authorization code is issued. So this would work:

@Controller
@SessionAttributes("authorizationRequest")
public class ApprovalEndpoint {

  @RequestMapping("/oauth/confirm_access")
  public ModelAndView getAccessConfirmation(Map<String, Object> model, HttpServletRequest request, SessionStatus status) throws Exception {
    String template = createTemplate(model, request);
    if (request.getAttribute("_csrf") != null) {
      model.put("_csrf", request.getAttribute("_csrf"));
    }
    status.setComplete();
    return new ModelAndView(new SpelView(template), model);
  }

}

Or you could use a Filter as you suggest, but since you probably want to customize the user experience for approval anyway, you might as well do it via this endpoint.

Answer 2

My oauth clients are set to autoApprove(true) , so I cannot do as Dave says. My solution is mapping /oauth/authorize to another endpoint ,and inject the origin AuthorizationEndpoint, after origin Endpoint finish his work, call request.getSession().invalidate();

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.oauth2.common.util.OAuth2Utils;
import org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.SessionAttributes;
import org.springframework.web.bind.support.SessionStatus;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.View;

import javax.servlet.http.HttpServletRequest;
import java.security.Principal;
import java.util.Map;

@Controller
@RequestMapping
@SessionAttributes({SessionClosedAuthorizationEndpoint.AUTHORIZATION_REQUEST_ATTR_NAME, SessionClosedAuthorizationEndpoint.ORIGINAL_AUTHORIZATION_REQUEST_ATTR_NAME})
public class SessionClosedAuthorizationEndpoint  {
    private AuthorizationEndpoint authorizationEndpoint;
    @Autowired
    public void setAuthorizationEndpoint(AuthorizationEndpoint authorizationEndpoint) {
        this.authorizationEndpoint = authorizationEndpoint;
    }

    static final String AUTHORIZATION_REQUEST_ATTR_NAME = "authorizationRequest";

    static final String ORIGINAL_AUTHORIZATION_REQUEST_ATTR_NAME = "org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.ORIGINAL_AUTHORIZATION_REQUEST";


    @RequestMapping(value = "/oauth/authorize/custom")
    public ModelAndView authorize(HttpServletRequest request, Map<String, Object> model, @RequestParam Map<String, String> parameters, SessionStatus sessionStatus, Principal principal) {
        ModelAndView authorize = authorizationEndpoint.authorize(model, parameters, sessionStatus, principal);
        request.getSession().invalidate();
        return authorize;
    }

    @RequestMapping(value = "/oauth/authorize/custom", method = RequestMethod.POST, params = OAuth2Utils.USER_OAUTH_APPROVAL)
    public View approveOrDeny(@RequestParam Map<String, String> approvalParameters, Map<String, ?> model,
                              SessionStatus sessionStatus, Principal principal){
        return authorizationEndpoint.approveOrDeny(approvalParameters,model,sessionStatus,principal);
    }

}