虽然这似乎是一项容易的任务，但事实恰恰相反。我正在尝试为 OAuth2 客户端身份验证请求自定义错误处理。这样做的目的是从响应消息中删除异常堆栈跟踪/消息。

上下文

• vanilla Oauth2 Spring Security 实现
• Java Spring 配置

完成任务所采取的步骤

1. 创建 OAuth2ExceptionRenderer 的自定义实现

2. 创建 OAuth2AuthenticationEntryPoint 的 @Bean 实例

   @Bean
   public OAuth2AuthenticationEntryPoint clientAuthEntryPoint()
   {
       OAuth2AuthenticationEntryPoint clientEntryPoint = new OAuth2AuthenticationEntryPoint();
       clientEntryPoint.setTypeName("Basic");
       clientEntryPoint.setRealmName("my-realm/client");
       clientEntryPoint.setExceptionRenderer(new CustomOAuth2ExceptionRenderer());
       return clientEntryPoint;
   }
   

3. 创建拒绝访问处理程序

   @Bean
   public OAuth2AccessDeniedHandler accessDeniedHandler()
   {
       OAuth2AccessDeniedHandler adh = new OAuth2AccessDeniedHandler();
       adh.setExceptionRenderer(new CustomOAuth2ExceptionRenderer());
       return adh;
   }
   

4. 使用 AuthorizationServerConfiguration 中的这些专门实现来增强 AuthorizationServerSecurityConfigurer 等

   @Configuration
   @EnableAuthorizationServer
   protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter
   {
       @Override
       public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception
       {
           oauthServer.authenticationEntryPoint(clientAuthEntryPoint());
           oauthServer.accessDeniedHandler(accessDeniedHandler());
           oauthServer.realm("my-realm");
       }
   }
   

OAuth2 请求

我们使用 curl 启动 OAuth2 请求。这是我们用来测试客户端身份验证的命令:

curl --insecure -H "Accept: application/json" -X POST -iu adfadsf:asdvadfgadf "https://localhost:8430/oauth/token?grant_type=password$username=john&pasword=johny"

观察到的行为

由于客户端认证是Basic认证，Spring Security会为该步骤分配一个BasicAuthenticationFilter。如果后端恰好有与此步骤相关的错误(例如 SQL 异常)，Spring Security 将不会选择 OAuth2AuthenticationEntryPoint 并将回退到默认入口点 BasicAuthenticationEntryPoint.

日志

o.s.s.authentication.ProviderManager     : Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
o.s.s.w.a.www.BasicAuthenticationFilter  : Authentication request for failed: org.springframework.security.authentication.InternalAuthenticationServiceException: show me the money
s.w.a.DelegatingAuthenticationEntryPoint : Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]
s.w.a.DelegatingAuthenticationEntryPoint : No match found. Using default entry point org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint@649f92da
s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed```

最佳答案

您可以尝试 Roman Wozniak 在您的问题单上发布的解决方案 #483 .它对我来说效果很好:)

• Roman Wozniak 的代码:

  @Configuration
  @EnableAuthorizationServer
  protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
  
    //...
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
          oauthServer
                      .realm(RESOURCE_ID + "/client")
                      .accessDeniedHandler(accessDeniedHandler)
                      .authenticationEntryPoint(entryPoint);
  
          // This allows you to replace default filter for Basic authentication and customize error responses
          oauthServer.addTokenEndpointAuthenticationFilter(
                  new BasicAuthenticationFilter(authenticationManager, entryPoint));
          }
  }
  

关于java - 使用 Spring Security 自定义客户端身份验证的 OAuth2 错误响应，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/30262600/