spring-boot 1.3.0.RC1：从会话获取oauth2用户信息的ClassCastException持久存在于Redis中

Question

我正在使用具有OAuth2单点登录功能的春季启动应用程序（正在开发中，但已经可以使用）。

我将会话存储从Tomcat更改为Redis。

问题

尝试从SecurityContextHolder获取User对象时，出现ClassCastException 。

将用户对象存储到UsernamePasswordAuthenticationToken

@Service
@Transactional
public class MyTokenService implements ResourceServerTokenServices {

  @Setter
  private OAuth2RestOperations restTemplate;

  @Autowired
  ResourceServerProperties sso;

  @Override
  public OAuth2Authentication loadAuthentication(String accessToken)
      throws AuthenticationException, InvalidTokenException {

    // get from http://some-auth-provider/me
    MyUser myUser = getMyInfo();

    // persist to mysql
    UserEntity user = save(myUser);

    OAuth2Request request =
        new OAuth2Request(null, sso.getClientId(), null, true, null, null, null, null, null);

    // org.springframework.boot.devtools.restart.classloader.RestartClassLoader@3d66ad6e
    logger.info(user.getClass().getClassLoader().toString());

    UsernamePasswordAuthenticationToken token =
        new UsernamePasswordAuthenticationToken(user.getId(), "N/A", user.getAuthorities());
    token.setDetails(user);

    return new OAuth2Authentication(request, token);
  }

  @Override
  public OAuth2AccessToken readAccessToken(String accessToken) {
    throw new UnsupportedOperationException("Not supported: read access token");
  }
}

认证后的会话

127.0.0.1:6379> keys *
1) "spring:session:expirations:1445309400000"
2) "spring:session:sessions:3447d160-5f41-49c9-abf9-2bf0ef2e6bc2"
127.0.0.1:6379> hkeys spring:session:sessions:3447d160-5f41-49c9-abf9-2bf0ef2e6bc2
1) "sessionAttr:SPRING_SECURITY_SAVED_REQUEST"
2) "sessionAttr:org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.CSRF_TOKEN"
3) "lastAccessedTime"
4) "maxInactiveInterval"
5) "sessionAttr:SPRING_SECURITY_LAST_EXCEPTION"
6) "sessionAttr:SPRING_SECURITY_CONTEXT"
7) "creationTime"
127.0.0.1:6379> type spring:session:sessions:3447d160-5f41-49c9-abf9-2bf0ef2e6bc2:sessionAttr:SPRING_SECURITY_CONTEXT
none

检索用户对象（认证后）

public UserEntity getMyInfo() {

  OAuth2Authentication oAuth2Authentication =
      (OAuth2Authentication) SecurityContextHolder.getContext().getAuthentication();

  Long userId = (Long) oAuth2Authentication.getPrincipal();

  UsernamePasswordAuthenticationToken userAuthentication =
        (UsernamePasswordAuthenticationToken) oAuth2Authentication.getUserAuthentication();

  try {
    // sun.misc.Launcher$AppClassLoader@14dad5dc
    logger.info(userAuthentication.getDetails().getClass().getClassLoader().toString());

    return (UserEntity) userAuthentication.getDetails(); 
  } catch (Exception e) {
    // fixme ClassCastException

    // workaround
    return userRepository.accountDetail(userId);
  }
}

我调试userAuthentication对象，并确认userAuthentication.details具有MyUser对象。 所以ClassCastException发生在将UserEntity强制转换为UserEntity时，但是为什么呢？

我可以正确获取主体（= UserEntity.id）。

有人有什么解决方案吗？

以下是当前配置的一部分。

依赖

springBootVersion = '1.3.0.RC1'

compile("org.springframework.boot:spring-boot-starter-redis")
compile("org.springframework.session:spring-session")
compile("com.github.kstyrc:embedded-redis:0.6")

Redis配置

@Configuration
@EnableRedisHttpSession
public class RedisConfig {

  private static RedisServer redisServer;

  @Profile({"local", "unit"})
  @Bean
  public RedisConnectionFactory connectionFactory() throws IOException {

    RedisExecProvider customProvider = RedisExecProvider.defaultProvider()
      .override(OS.MAC_OS_X, Architecture.x86_64, "/path/to/redis/3.0.2/redis-server");

    redisServer = new RedisServerBuilder()
      .redisExecProvider(customProvider)
      .port(Protocol.DEFAULT_PORT)
      .build();

    redisServer.start();

    return new JedisConnectionFactory();
  }

  @Profile({"local", "unit"})
  @PreDestroy
  public void destroy() {

    if (redisServer != null) {
      redisServer.stop();
    }
  }

  @Bean
  @ConditionalOnMissingBean(RequestContextFilter.class)
  public RequestContextFilter requestContextFilter() {

    return new RequestContextFilter();
  }

  @Bean
  public FilterRegistrationBean requestContextFilterChainRegistration(
  @Qualifier("requestContextFilter") Filter securityFilter) {

    FilterRegistrationBean registration = new FilterRegistrationBean(securityFilter);
    registration.setOrder(SessionRepositoryFilter.DEFAULT_ORDER + 1);
    registration.setName("requestContextFilter");

    return registration;
  }

OAuth2 Sso配置

@Configuration
@EnableOAuth2Sso
@EnableWebSecurity
public class OAuth2Config extends WebSecurityConfigurerAdapter {

  @Autowired
  ResourceServerProperties sso;

  @Autowired
  @Qualifier("userInfoRestTemplate")
  private OAuth2RestOperations restTemplate;

  @Primary
  @Bean
  public ResourceServerTokenServices userInfoTokenServices() {

    MyTokenService tokenService = new MyTokenService();
    tokenService.setRestTemplate(restTemplate);

    return tokenService;
  }

  // ...
}

类似问题

使用spring-session和spring-cloud-security时，OAuth2ClientContext（spring-security-oauth2）在Redis中不持久

我按照上面的答案更改了过滤器的顺序（在RedisConfig.java中），但是它不起作用。

我当前的过滤器顺序如下。

o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'metricFilter' to: [/*]
o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'springSessionRepositoryFilter' to: [/*]
o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'requestContextFilter' to: [/*]
o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'characterEncodingFilter' to: [/*]
o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'OAuth2ClientContextFilter' to: [/*]
o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'springSecurityFilterChain' to: [/*]
o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'webRequestLoggingFilter' to: [/*]
o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'applicationContextIdFilter' to: [/*]

更新代码

ClassCastException的原因是ClassLoader的不匹配。

org.springframework.boot.devtools.restart.classloader.RestartClassLoader和sun.misc.Launcher$AppClassLoader

但我一如既往地不知道要解决这个问题。

解决了！

我在下面更改过滤器顺序，并且可以正常工作。

1. RequestContextFilter两个
2. oAuth2ClientContextFilter
3. springSessionRepositoryFilter