如何在 Spring Cloud Gateway 中验证 OAuth 令牌

Question

我有一个 Spring Cloud 网关应用程序，它目前支持“HTTP 基本身份验证”。 我计划使用 OAuth 2.0 和 Keycloak 作为提供程序。 我首先添加了所需的包（如下所列）。

 implementation "org.springframework.boot:spring-boot-starter-security"
 implementation "org.springframework.boot:spring-boot-starter-oauth2-client"

我是新手，并希望支持以下内容。

1. 将客户端动态注册到 Keycloak
2. 使用 Keycloak 验证当前请求令牌以允许/拒绝请求

我的SecurityConfig.java如下所示。

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        http.csrf().disable()
                .formLogin().disable()
                .logout().disable()
                .authorizeExchange(exchanges -> exchanges.anyExchange().permitAll())
                .oauth2Client();

        return http.build();
    }

    @Bean
    public WebClientHttpRoutingFilter webClientHttpRoutingFilter(
            @Qualifier("webClient") WebClient webClient,
            ObjectProvider<List<HttpHeadersFilter>> headerFilters) {

        return new WebClientHttpRoutingFilter(webClient, headerFilters);
    }

    @Bean
    public WebClient webClient(
            @Qualifier("reactiveOAuth2AuthorizedClientManager")
                    ReactiveOAuth2AuthorizedClientManager reactiveOAuth2AuthorizedClientManager) {

        ServerOAuth2AuthorizedClientExchangeFilterFunction oauth =
                new ServerOAuth2AuthorizedClientExchangeFilterFunction(reactiveOAuth2AuthorizedClientManager);

        oauth.setDefaultOAuth2AuthorizedClient(true);

        oauth.setDefaultClientRegistrationId("keycloak");

        return WebClient.builder()
                .filter(oauth)
                .build();
    }

    @Bean
    public ReactiveOAuth2AuthorizedClientManager reactiveOAuth2AuthorizedClientManager(
            ReactiveClientRegistrationRepository clientRegistrationRepository,
            ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

        ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
                ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
                        .clientCredentials()
                        .build();

        DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
                new DefaultReactiveOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientRepository);

        authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

        return authorizedClientManager;
    }

}