将Spring Zuul配置为对具有基本身份验证标头的请求进行OAuth2“资源所有者密码授予”

Question

我创建了一个非常基本的Spring Cloud Zuul应用程序，以充当资源服务器的令牌中继。 对于authorization_code授予，这非常简单。 下面正是我需要的：

package zuul;


import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
import org.springframework.cloud.netflix.zuul.EnableZuulProxy;

@SpringBootApplication
@EnableOAuth2Sso
@EnableZuulProxy
public class RelayProxy {

    public static void main(String[] args) {
        SpringApplication.run(RelayProxy.class, args);
    }

}

在application.yml中（我的授权服务器在端口9999上运行）：

server:
    port: 8000

security:
    oauth2:
        client:
            accessTokenUri: http://localhost:9999/oauth/token
            userAuthorizationUri: http://localhost:9999/oauth/authorize
            clientAuthenticationScheme: form
            clientId: client
            clientSecret: secret
        resource:
            jwt:
                key-uri: http://localhost:9999/oauth/token_key

zuul:
    routes:
        resource:
            path: /resource/**
            url: http://localhost:8002/

为了允许仅支持基本身份验证的遗留系统获得对资源服务器的访问权限，我希望截取带有基本身份验证标头的请求并执行密码授予以获取和中继访问令牌。 我试图使用Spring Security / OAuth2配置来配置它，但是无法使其正常工作。 下面的zuul过滤器是我当前正在使用的过滤器，它可以正常工作，但是我想知道是否可以通过正确的Spring配置获得相同的结果：

public class PasswordGrantZuulFilter extends ZuulFilter {

    @Value("${security.oauth2.client.accessTokenUri}")
    private String accessTokenUri;

    @Value("${security.oauth2.client.clientId}")
    private String clientId;

    @Value("${security.oauth2.client.clientSecret}")
    private String clientSecret;

    @Autowired
    private OAuth2ClientContext clientContext;

    @Override
    public String filterType() {
        return "pre";
    }

    @Override
    public int filterOrder() {
        return 10;
    }

    @Override
    public boolean shouldFilter() {
        RequestContext ctx = RequestContext.getCurrentContext();
        String header = ctx.getRequest().getHeader(HttpHeaders.AUTHORIZATION);

        return header != null && header.toLowerCase().startsWith("basic");
    }

    @Override
    public Object run() {
        RequestContext ctx = RequestContext.getCurrentContext();
        if (clientContext.getAccessToken() == null) {

            String header = ctx.getRequest().getHeader(HttpHeaders.AUTHORIZATION);

            String base64Credentials = header.substring("Basic".length()).trim();
            String credentials = new String(Base64.getDecoder().decode(base64Credentials), Charset.forName("UTF-8"));
            final String[] values = credentials.split(":", 2);
            HttpHeaders headers = new HttpHeaders();
            headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
            headers.put(HttpHeaders.AUTHORIZATION, Collections.singletonList("Basic " + Base64.getEncoder().encodeToString((clientId + ":" + clientSecret).getBytes())));

            MultiValueMap<String, String> map = new LinkedMultiValueMap<>();
            map.add("grant_type", "password");
            map.add("username", values[0]);
            map.add("password", values[1]);

            HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(map, headers);

            ResponseEntity<OAuth2AccessToken> response = new RestTemplate().postForEntity(accessTokenUri, request, OAuth2AccessToken.class);
            clientContext.setAccessToken(response.getBody());
        }

        ctx.addZuulRequestHeader(HttpHeaders.AUTHORIZATION, OAuth2AccessToken.BEARER_TYPE + " " + clientContext.getAccessToken().getValue());

        return null;
    }

}