如何从 OAuth2 客户端应用程序中的授权服务器获取作为访问令牌响应一部分的附加信息

Question

Access token response

{
    "access_token": "fd515395-ab03-4cc5-9ba4-03c42bdfdf189b73",
    "token_type": "bearer",
    "refresh_token": "176ee948-ebdc-4d51-9768-08aa1dfdd081442",
    "expires_in": 10799,
    "scope": "user_info",
    "instance_url": "https://xxxx.xxx.com/xx-xxx-service"
}

I've tried as below but no luck

@RequestMapping("/securedPage")
    public String securedPage( Model model, OAuth2AuthenticationToken authToken ) {

        OAuth2AuthorizedClient client = clientService.loadAuthorizedClient( authToken.getAuthorizedClientRegistrationId(), authToken.getName() );

        OAuth2AccessToken accessToken = client.getAccessToken();

        System.out.println( accessToken.getTokenValue() );
        System.out.println( accessToken.getExpiresAt() );
        System.out.println( client.getPrincipalName() );
        System.out.println( client.getRefreshToken().getTokenValue() );

        // Get "instance_url" here

        return "securedPage.html";
}

Answer 1

I see 3 possible ways to get the result:

1. Using injecting Principal object. For Spring OAuth2 it's implemented with class OAuth2Authentication . You can find most of the information in this object - in details , userAuthentication , storedRequest . Inspect it and you will see what you need.

2. Get directly all required parameters with authentication request:

Service method:

var resourceDetails = ((OAuth2RestTemplate) restTemplate).getResource();
var headers = new HttpHeaders();
headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
headers.setBasicAuth(resourceDetails.getClientId(), resourceDetails.getClientSecret());
var form = new LinkedMultiValueMap<String, String>();
form.add("grant_type", "password");
form.add("username", "<username>");
form.add("password", "<password>");
var request = new HttpEntity<>(form, headers);
var response = restTemplate.postForObject(resourceDetails.getAccessTokenUri(), request, LinkedHashMap.class);

The object response contains all parameters like in your access token response.

One thing - you need to use a specific restTemplate like next:

var resourceDetails = new ClientCredentialsResourceDetails();
resourceDetails.setClientId("<clientId>");
resourceDetails.setClientSecret("<clientSecret>");
resourceDetails.setAccessTokenUri("<accessTokenUri>");
resourceDetails.setScope("<scopes>");
resourceDetails.setAuthenticationScheme(AuthenticationScheme.header);
resourceDetails.setGrantType("client_credentials");
var restTemplate = new OAuth2RestTemplate(resourceDetails, new DefaultOAuth2ClientContext());
var requestFactory = new HttpComponentsClientHttpRequestFactory();
requestFactory.setConnectTimeout(10000);
requestFactory.setConnectionRequestTimeout(10000);
requestFactory.setReadTimeout(10000);
restTemplate.setRequestFactory(requestFactory);
var tokenProvider = new ClientCredentialsAccessTokenProvider();
tokenProvider.setRequestFactory(requestFactory);
restTemplate.setAccessTokenProvider(new AccessTokenProviderChain(Arrays.<AccessTokenProvider>asList(
        new AuthorizationCodeAccessTokenProvider(), new ImplicitAccessTokenProvider(),
        new ResourceOwnerPasswordAccessTokenProvider(), tokenProvider)));

3. Generate an object on the Authorization Server and to respond it with a similar restTemplate to the Client. This is an undesirable approach but it can be implemented also.