我最近用Spring Cloud Gateway和Auth0创建了一个微服务架构。我写了我是如何在Auth0 blog上创建它的。这不是有趣的部分。有趣的部分是JHipster生成一个ReactiveJwtDecoder，如果某些声明在访问令牌中不可用，它将调用/userinfo端点。这样，在接入令牌被中继到下游微服务之前，接入令牌被丰富了身份信息。

@Bean
ReactiveJwtDecoder jwtDecoder(ReactiveClientRegistrationRepository registrations) {
    Mono<ClientRegistration> clientRegistration = registrations.findByRegistrationId("oidc");

    return clientRegistration
        .map(oidc ->
            createJwtDecoder(
                oidc.getProviderDetails().getIssuerUri(),
                oidc.getProviderDetails().getJwkSetUri(),
                oidc.getProviderDetails().getUserInfoEndpoint().getUri()
            )
        )
        .block();
}

private ReactiveJwtDecoder createJwtDecoder(String issuerUri, String jwkSetUri, String userInfoUri) {
    NimbusReactiveJwtDecoder jwtDecoder = new NimbusReactiveJwtDecoder(jwkSetUri);
    OAuth2TokenValidator<Jwt> audienceValidator = new AudienceValidator(jHipsterProperties.getSecurity().getOauth2().getAudience());
    OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuerUri);
    OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);

    jwtDecoder.setJwtValidator(withAudience);

    return new ReactiveJwtDecoder() {
        @Override
        public Mono<Jwt> decode(String token) throws JwtException {
            return jwtDecoder.decode(token).flatMap(jwt -> enrich(token, jwt));
        }

        private Mono<Jwt> enrich(String token, Jwt jwt) {
            // Only look up user information if identity claims are missing
            if (jwt.hasClaim("given_name") && jwt.hasClaim("family_name")) {
                return Mono.just(jwt);
            }
            // Retrieve user info from OAuth provider if not already loaded
            return users.get(
                jwt.getSubject(),
                s -> {
                    WebClient webClient = WebClient.create();

                    return webClient
                        .get()
                        .uri(userInfoUri)
                        .headers(headers -> headers.setBearerAuth(token))
                        .retrieve()
                        .bodyToMono(new ParameterizedTypeReference<Map<String, Object>>() {})
                        .map(userInfo ->
                            Jwt
                                .withTokenValue(jwt.getTokenValue())
                                .subject(jwt.getSubject())
                                .audience(jwt.getAudience())
                                .headers(headers -> headers.putAll(jwt.getHeaders()))
                                .claims(claims -> {
                                    String username = userInfo.get("preferred_username").toString();
                                    // special handling for Auth0
                                    if (userInfo.get("sub").toString().contains("|") && username.contains("@")) {
                                        userInfo.put("email", username);
                                    }
                                    // Allow full name in a name claim - happens with Auth0
                                    if (userInfo.get("name") != null) {
                                        String[] name = userInfo.get("name").toString().split("\\s+");
                                        if (name.length > 0) {
                                            userInfo.put("given_name", name[0]);
                                            userInfo.put("family_name", String.join(" ", Arrays.copyOfRange(name, 1, name.length)));
                                        }
                                    }
                                    claims.putAll(userInfo);
                                })
                                .claims(claims -> claims.putAll(jwt.getClaims()))
                                .build()
                        );
                }
            );
        }
    };
}