Spring Security和OAuth2之间Principal接口的两种不同实现

Question

There had been being a monolithic java-application that is configured by Spring Security. Whenever I want to get the authenticated user, the org.springframework.serurity.authentication.UsernamePasswordAuthenticationToken object gives me like this:

User user = (User)SecurityContextHolder.getContext().getAuthentication().getPrincipal();

This piece of code had been working correctly until I changed the configuration from Spring Security to Oauth2 .
In order to OAuth2, org.springframework.serurity.oauth2.provider.OAuth2Authentication object gives me the authenticated user like this:

OAuth2Authentication oAuth2Authentication = (OAuth2Authentication) SecurityContextHolder.getContext().getAuthentication();
LinkedHashMap linkedHashMap = (LinkedHashMap) oAuth2Authentication.getUserAuthentication().getDetails();
return linkedHashMap.get("principal");

So the result of SecurityContextHolder.getContext().getAuthentication().getPrincipal() is difference between OAuth2 and Spring Security .
What is the problem:
My problem is that
1- I have to rewrite every where contains SecurityContextHolder.getContext().getAuthentication().getPrincipal()
with

           Object obj = SecurityContextHolder.getContext().getAuthentication();
            if (obj instanceof OAuth2Authentication) {
                OAuth2Authentication oAuth2Authentication = (OAuth2Authentication) SecurityContextHolder.getContext().getAuthentication();
                LinkedHashMap linkedHashMap = (LinkedHashMap) oAuth2Authentication.getUserAuthentication().getDetails();
                linkedHashMap.get("principal");
                LinkedHashMap  result = linkedHashMap.get("principal");
                User user = new User();
                user.setId((Integer)result.get("id"));
                user.setName((String)result.get("name"));
                //As same way to set other its attributes@@@@@@@@@@
                return user;
            } else
                return (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal();

2- As it is seen in above code that is marked by @@@@@@@@@ , the number of field of User object is near to 20, so I have to repeat user.setField(result.get("filed")) 20 times and it is so tedious.
The solution is that I have to either rewrite as same as above code or other thing that I do not know?

Answer 1

Yes, indeed, both of those Authentications are different between Spring Security and Spring Oauth2. You could create some sort of @Service or @Component class that handles giving you back what you are looking for. This can then be injected/autowired where ever you need it. So basically, this new class becomes the single source of truth for retrieving your principal. If you happen to change the security implementation again, your code should not be affected because the security handling service is abstracted away by a new interface.

See sample below:

@Service
public class Oauth2PrincipalService implements PrincipalService {

  public User retreivePrincipalUser(){
    //retreive user stuff here as you need using the oauth2 code you provided..

  }

}

public interface PrincipalService {

  User retreivePrincipalUser();

}