Spring OAuth2安全性-客户端凭据-自定义AuthenticationProvider

Question

I am writing an authentication service in our service architecture that will basically be an implementation of Spring OAuth2 Authorization Server. From this I will need to authenticate provided credentials against many different sources to support a legacy environment.

I am primarily concentrated on using the client credentials flow where users (other services) will use their own credentials to obtain a token and, for the time being, will not require OAuth2's authorize or refresh.

I have successfully been able to spin up a Spring Boot application that is protected with Spring Security ( @EnableWebSecurity ). I have also successfully set up the Authorization Server ( @EnableAuthorizationServer ) which provides the necessary endpoints ( /oauth/token ) to provide a token. I have been able to configure the Authorization Server with in memory and custom ClientDetailsService to successfully get a token. This is all just to demonstrate to myself that I can get something working.

My problem is that I need to authenticate the credentials against a custom source. I do not have direct access to the passwords and certainly do not know how they are encoded.

After digging through the Spring code, I could see that through the DaoAuthenticationProvider , it accomplishes authentication by calling PasswordEncoder.matches() . Unfortunately, I do not get a password from the ClientDetailsService , nor do I know how the password is encoded if I did, so a custom PasswordEncoder does not do me much good (also I would need match in multiple ways with only one PasswordEncoder ). So, I'm left with defining my own AuthenticationProvider (or AuthenticationManager ).

I was able to implement my own AuthenticationProvider and provide that to the Spring Security configuration. This worked perfectly and I was able to defer the authentication to my own provider which can do whatever I see fit (such as delegating to another service to authenticate), but this only worked for the non-OAuth2 endpoints.

Now this is where everything starts to fall apart. For whatever reason, I cannot get the /oauth/token endpoint to use the defined AuthenticationManager or AuthenticationProvider s that I supply. It always defaults to an AuthenticationManger with AnonymousAuthenticationProvider and DaoAuthenticationProvider .

WebSecurity

Not much interesting here. I'm exposing the authentication manager globally in an attempt to register it in the OAuth2 configuration. I've left in some commented code to show some other things I've tried, but they all pretty much accomplish the same thing: it works with everything but the OAuth2 endpoints.

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public AuthenticationProvider customAuthenticationProvider;

    @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
//      return new ProviderManager(Arrays.asList(customAuthenticationProvider));
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .anyRequest()
            .authenticated()
        .and()
            .httpBasic();
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .authenticationProvider(customAuthenticationProvider);
    }

//   @Autowired
//   public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
//       auth.authenticationProvider(customAuthenticationProvider);
//   }
}

AuthServer

I've stripped this down to what I believe should be the correct configuration. I've purposefully left out ClientDetailsService as it's part of the provider configuration and it is working properly. I'm ignoring the TokenStore and using the defaults until I can get authentication out of the way. Again, the authenticationManager here should be the global one exposed from WebSecurity. I've also tried creating a new ProviderManager in the endpoints configurer, but that also did not work for me.

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {        
        oauthServer
            .tokenKeyAccess("permitAll()")
            .checkTokenAccess("permitAll()")
        ;
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }
}

I've also tried extending AuthorizationServerSecurityConfiguration without success:

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig2 extends AuthorizationServerSecurityConfiguration {

    @Autowired
    public AuthenticationProvider customAuthenticationProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }
}

I would expect my custom AuthenticationProvider would show in the list, but it will not with everything I've tried.

This may be intentional, but if that is the case, what is the correct way to go about providing custom authentication schemes?

I would really like to avoid it, but am I truly required to implement a custom filter and bypass all of the nice things Spring provides? If yes, how would I go about doing that?

Answer 1

I ended up configuring an additional BasicAuthenticationFilter to the token endpoint. To me, this is a little messy as now there are two of the same filters in the Security Filter chain, but it does the trick.

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    @Autowired
    private UserService userService;

    @Autowired
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer
            .tokenKeyAccess("isAuthenticated()")
            .checkTokenAccess("isAuthenticated()");

        // override the default basic authentication filter in order to provide
        // a custom authentication manager
        oauthServer.addTokenEndpointAuthenticationFilter(new BasicAuthenticationFilter(authenticationManager, new BasicAuthenticationEntryPoint()));
    }
}