仅在 JWT 令牌中添加附加信息，而不是在 OAuth2 令牌中

Question

在我的 Spring 引导应用程序中，我正在尝试配置 Oauth2 和 JWT，它工作正常，但我想隐藏来自 oauth2 令牌的附加信息，因为它们是纯文本格式并且相同的信息是重复的在 JWT 令牌中。

这是我的 Oauth2ServerConfig：

    @Configuration
    public class OAuth2ServerConfiguration {

        @Configuration
        @EnableAuthorizationServer
        protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

            private final AuthenticationManager authenticationManager;

            private final OAuth2ApprovalRepository oAuth2ApprovalRepository;

            private final OAuth2CodeRepository oAuth2CodeRepository;

            private final OAuth2ClientDetailsRepository oAuth2ClientDetailsRepository;


            public AuthorizationServerConfiguration(@Qualifier("authenticationManagerBean") AuthenticationManager authenticationManager) {
                this.authenticationManager = authenticationManager;
            }

            @Bean
            public ApprovalStore approvalStore() {
                return new MyDBApprovalStore(oAuth2ApprovalRepository);
            }

            @Bean
            protected AuthorizationCodeServices authorizationCodeServices() {
                return new MyDBAuthorizationCodeServices(oAuth2CodeRepository);
            }


            @Override
            public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
                TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
                tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(), accessTokenConverter()));

                endpoints.authorizationCodeServices(authorizationCodeServices())
                    .approvalStore(approvalStore())
                    .tokenStore(tokenStore())
                    .tokenEnhancer(tokenEnhancerChain)
                    .authenticationManager(authenticationManager);
            }


            @Bean
            public TokenEnhancer tokenEnhancer() {
                return new CustomTokenEnhancer();
            }


            @Bean
            public TokenStore tokenStore() {
                return new JwtTokenStore(accessTokenConverter());
            }


            @Bean
            public JwtAccessTokenConverter accessTokenConverter() {
                JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
                converter.setSigningKey("123");
                return converter;
            }


            @Override
            public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
                clients.withClientDetails(new MyClientDetailsService(oAuth2ClientDetailsRepository));
            }
        }

    }

我的自定义信息添加：

    public class CustomTokenEnhancer implements TokenEnhancer {

        @Override
        public OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {
            Map<String, Object> additionalInfo = new HashMap<>();
            additionalInfo.put("organizationId", "123");
    ((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(additionalInfo);
            return accessToken;
        }
    }

这是我的身份验证 WS 调用的响应示例：

{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmdhbml6YXRpb25JZCI6IjEyMyIsImF1ZCI6WyJyZXNfYmh1YiJdLCJ1c2VyX25hbWUiOiJhZG1pbiIsInNjb3BlIjpbInJlYWQiLCJ3cml0ZSJdLCJleHAiOjE0OTc4NjkyNDMsImF1dGhvcml0aWVzIjpbIlJPTEVfQURNSU4iLCJST0xFX1VTRVIiXSwianRpIjoiOGNhYTZjN2YtNTU0Yy00OTZmLTkwYTUtZTA4MjAyM2I3ZTFlIiwiY2xpZW50X2lkIjoiYmh1YmFwcCJ9.B58c2_tmfuV_L1py8ZzOPuTK3OZAhVFviL9W1gxRoec",
"token_type": "bearer",
"refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmdhbml6YXRpb25JZCI6IjEyMyIsImF1ZCI6WyJyZXNfYmh1YiJdLCJ1c2VyX25hbWUiOiJhZG1pbiIsInNjb3BlIjpbInJlYWQiLCJ3cml0ZSJdLCJhdGkiOiI4Y2FhNmM3Zi01NTRjLTQ5NmYtOTBhNS1lMDgyMDIzYjdlMWUiLCJleHAiOjE0OTc4Njk0NDMsImF1dGhvcml0aWVzIjpbIlJPTEVfQURNSU4iLCJST0xFX1VTRVIiXSwianRpIjoiMGJjNWJhYzctMWI3Ny00OGFiLWI1N2MtNDM4ZjMyN2JmNGM2IiwiY2xpZW50X2lkIjoiYmh1YmFwcCJ9.DkQoCEX47PmmxOEj0n9kb2L5Yu6DqFgmUh7HBSTO_z4",
"expires_in": 1799,
"scope": "read write",
"organizationId": "123",
"jti": "8caa6c7f-554c-496f-90a5-e082023b7e1e"

}

我不想将此令牌的 organizationId 公开给外部世界，并希望将此信息编码为仅 JWT 令牌 (access_token) .

如何使用 Spring Boot、OAuth2、JWT 实现？

Answer 1

如果连接是通过 HTTPS（它应该是），那么信息将不会暴露给外部世界（只有请求它的客户端）。

无论如何，您拥有的访问令牌只是一个 JWS（未加密），因此如果您将其放入其中，信息不会被隐藏（它只是 Base64 编码）。

Answer 2

我在这里找到了解决方案：

我也改了配置方法...

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
  tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer())); 
  endpoints
    .tokenStore(tokenStore())
    .tokenEnhancer(tokenEnhancerChain)
    .reuseRefreshTokens(false)
    .userDetailsService(userDetailsService)
    .authenticationManager(authenticationManager);
}

仅在 JWT 令牌中添加附加信息，而不是在 OAuth2 令牌中

Add additionnal information only in the JWT token and not in the OAuth2 token

java

spring-security

jwt

spring-boot

spring-security-oauth2