使用Spring Security进行JWT解码

uinbv5nw 于 12个月前发布在 Spring

关注(0)|答案(2)|浏览(108)

我有一个关于JWT解码的问题。我正在为oauth2授权服务编写一个集成。我发送一个请求以获得授权令牌，并得到如下响应：

{
"access_token": "c76fb018-27c9-43f7-a751-62646eda7e1a-1",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "03e0be32-e72e-47ec-b740-a00b333a8ac4-1",
"id_token": "eyJhbGciOiJnb3N0MzQtMTAuMjAxMiJ9.eyJzdWIiOiIwZDYxNTI3NDRlNDhkMTU4Y2UwMWQ3ZDQwZTdjNzUwYmZhMTVmMWVhY2NkOTQ3YmYwYTU0NzRhNDkwMGMyZTdjIiwiaXNzIjoiaXNzLWRlZmF1bHQtdmFsdWUiLCJhdWQiOiIxMTQzIiwiZXhwIjoxNTE4NzAxMDcxLCJpYXQiOjE1MTg3MDA3NzEsImF1dGhfdGltZSI6MTUxODcwMDc1NiwiYWNyIjoibG9hLTMiLCJhbXIiOiJ7cHdkLCBtY2EsIG1mYSw
gb3RwLCBzbXN9IiwiYXpwIjoiMTE0MyIsIm5vbmNlIjoiN2JlNjZhYzktZDA3Yy00OTY3LWFkZWQtY2EyNzBhMjdlOWU4In0=.EdiC77+9bO+/vRzvv71677+977+977+9eAXvv73vv73vv71E77+977+977+977+9Re+/ve+/vTNbbdm0Bu+/vRY/eO+/vRvvv70q77+977+9LO+/vU4iZO+/vSNF0oFy77+977+977+9GQnvv73vv70v77+9QO+/vXk="
}

id_token -Base64编码的URL是标识用户所需的一组客户端属性。属性之间用“.”字符分隔，每个属性必须单独解码。

我不知道该怎么做我将感激任何帮助。
Application.yml

spring:
  security:
    oauth2:
      client:
        registration:
          sbb:
            client-id: *******
            client-secret: ******
            scope: openid
            client-authentication-method: post
            authorization-grant-type: authorization_code
            redirect-uri: '{baseUrl}/login/oauth2/code/{registrationId}'
        provider:
          sbb:
            authorization-uri: https://auth.site.com/ic/sso/api/v1/oauth/authorize
            token-uri: https://auth.site.com/ic/sso/api/v1/oauth/token
            user-info-uri: https://auth.site.com/ic/sso/api/v1/oauth/user-info
            user-name-attribute: sub

@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic().disable();
        http.cors().disable();
        http.csrf().disable();
        http
            .authorizeRequests().antMatchers("/login").permitAll().and()
            .authorizeRequests()
            .anyRequest()
            .authenticated()
            .and()
            .oauth2Login();
   }
}

当我启动我的应用程序时，我得到一个错误：org.springframework.security.oauth2.core.OAuth2AuthenticationException: [missing_signature_verifier] Failed to find a Signature Verifier for Client Registration: 'sbb'. Check to ensure you have configured the JwkSet URI.
我的提供程序不提供JwkSet URI。

spring-security

来源：https://stackoverflow.com/questions/65829429/jwt-decoding-with-spring-security

2条答案

按热度按时间

a9wyjsp71#

菲利普描述了here方法。我只是把它扩大了一点。

@Bean
  public JwtDecoderFactory<ClientRegistration> jwtDecoderFactory() {

    final JwtDecoder decoder = new JwtDecoder() {

      @SneakyThrows
      @Override
      public Jwt decode(String token) throws JwtException {
        JWT jwt = JWTParser.parse(token);
        return createJwt(token, jwt);
      }

      private Jwt createJwt(String token, JWT parsedJwt) {
        try {
          Map<String, Object> headers = new LinkedHashMap<>(parsedJwt.getHeader().toJSONObject());
          Map<String, Object> claims = parsedJwt.getJWTClaimsSet().getClaims();
          return Jwt.withTokenValue(token)
              .headers(h -> h.putAll(headers))
              .claims(c -> c.putAll(claims))
              .build();
        } catch (Exception ex) {
          if (ex.getCause() instanceof ParseException) {
            throw new JwtException(String.format(DECODING_ERROR_MESSAGE_TEMPLATE, "Malformed payload"));
          } else {
            throw new JwtException(String.format(DECODING_ERROR_MESSAGE_TEMPLATE, ex.getMessage()), ex);
          }
        }
      }
    };
    return context -> decoder;
  }

赞(0）回复(0）举报 12个月前

093gszye2#

以下是我使用我的ClientRegistration所做的，我希望这可以帮助：

import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.JwtDecoderFactory;

JwtDecoderFactory<ClientRegistration> jwtDecoderFactory = new OidcIdTokenDecoderFactory();
JwtDecoder jwtDecoder = jwtDecoderFactory.createDecoder(clientRegistration);
Jwt token = jwtDecoder.decode(token);

如果要删除验证：

((NimbusJwtDecoder)jwtDecoder).setJwtValidator(new DelegatingOAuth2TokenValidator<>(Arrays.asList()));

赞(0）回复(0）举报 12个月前

我来回答

使用Spring Security进行JWT解码

2条答案

相关问题

热门标签

最新问答