Spring 引导中匿名用户的 oAuth 令牌

Question

Team

Using Spring boot I am able to accomplish workflows, where oAuth server can generate the token for the logged-in user. However, how does the oAuth server generate a unique token for each anonymous user?

For eg if 2 concurrent users are trying to access the resource server from their respective browsers, then I would like the resource server to identify the 2 different users in each subsequent requests that they make. For that, I would like to generate different tokens for each anonymous user. Is that possible and if yes then how?

Answer 1

It is simple thing, you are making it complex.

I would like to generate different tokens for each anonymous user. Is that possible

Once you generate valid token, user will become authenticated user.

You might think about validating token and setting ROLE='ROLE_ANONYMOUS' . As I told it will be like making simple thing to complex. Making authenticated user to Anonymous user is not good approach. You can create a new role like ROLE_SEMIANONYMOUS and grant authorities which were open for ANONYMOUS user.

(but this approach doesn't make any sense for me so explaining alternative to achieve your requirement of identifying AnonymousUser)

As "Anonymous User = UnAuthenticated User".

For anonymous user if you print principal

String principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

principal = "anonymousUser"

You can create a session for anonymous user for identifying him as given below

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
Object principal = authentication.getPrincipal();

if(principal instanceof String && ((String)principal).equalsIgnoreCase("anonymousUser"))
{
    if(request.getSession(false) == null)
    {
        HttpSession session = request.getSession();
        session.setMaxInactiveInterval(300); // As per Your requirement
    //  store session id from session and ip address from request in to DB or cache if required and use it
    }
    else
    {
        //identify anonymous user against session id and stored details
    }
}

You can achieve this by registering a filter

• In convetional spring order of filter should be after springSecurityFilterChain.
• In spring boot you can achieve it by FilterRegistrationBean