为什么 SecurityContextHolder.getContext().getAuthentication() 返回 null 值？

Question

我正在尝试使用 keycloak 身份验证在 spring-cloud-gateway 中构建身份验证，并且一切正常，但是当尝试获取 SecurityContextHolder.getContext().getAuthentication() 时，它给出了 null 我不确定为什么？

这是我的代码安全配置：

@Configuration
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfig {

    @Bean
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http,
                                                            ReactiveClientRegistrationRepository clientRegistrationRepository) {
        // Authenticate through configured OpenID Provider
        http.authorizeExchange()
                .pathMatchers("/app/**").authenticated().and().oauth2Login();

        // Also logout at the OpenID Connect provider
        http.logout(logout -> logout.logoutSuccessHandler(
                new OidcClientInitiatedServerLogoutSuccessHandler(clientRegistrationRepository)));

        // Require authentication for all requests
        http.authorizeExchange().anyExchange().authenticated();

        // Allow showing /home within a frame
        http.headers().frameOptions().mode(XFrameOptionsServerHttpHeadersWriter.Mode.SAMEORIGIN);

        // Disable CSRF in the gateway to prevent conflicts with proxied service CSRF
        http.csrf().disable();
        return http.build();
    }

}

我试图获取数据的 controller 如下所示：

@RestController
@RequestMapping("/app")
public class UserController {

    @Autowired
    DataSource dataSource;

    @PostMapping(path = "/authenticate", produces = MediaType.APPLICATION_JSON_VALUE)
    public String getAuth(@RequestBody Map<String, Object> data) {
     Authentication authentication =
            SecurityContextHolder.getContext().getAuthentication();
     //But it is always null
    }

}

我几乎没有得到 stackoverflow 的回答，但它无法正常工作，因为 SecurityConfig class 存在一些问题，但我无法得到它。 请帮助它。

Answer 1

在反应式应用程序中， SecurityContext包含在ReactiveSecurityContextHolder中，它应该用于以反应式方式获取Authentication ，如下所示：

Mono<Authentication> getAuthentication() {
    return ReactiveSecurityContextHolder.getContext()
            .switchIfEmpty(Mono.error(new IllegalStateException("ReactiveSecurityContext is empty!")))
            .map(SecurityContext::getAuthentication);
}