Spring 启动 Oauth 安全性 - 客户端凭据授予类型中主体中的用户（自定义信息）信息

Question

I'm using "client-credentials" grant type for the rest calls that I make from front-end service to other back-end services. Client-credentials grant type is being used among other back-end services as well. By doing so, I am not able to get who is the actual invoker (currently logged in user) of a request. Is there a way to inject authentication and authorization info of the principal to the token that is being issued in the client-credentials grant? (user info means the id or details of the user who has the client credentials). I can add some custom data to the token by using a custom token enhancer. But I couldn't find out how we can get it in the principal( SpringSecurityPrincipal springSecurityPrincipal = (SpringSecurityPrincipal)oAuth2Authentication.getPrincipal(); ), normally in the password flow we can achieve this by using custom AuthenticationProvider implementation like that is there any class that I can implement and use to add custom principal?

Thanks for the help.

Answer 1

You could create a custom UserDetailsService and create a custom Principal according to your requirements. You might pick some ideas from here: Authentication with a Database-backed UserDetailsService