zoukankan      html  css  js  c++  java
  • 如何更新redis中存储的spring security oauth2认证后的token相关信息(用户信息等)

    最近发现自己的工程中,修改了UserDetails中的用户信息后,再用access_token获取用户信息后,发现总是获取的第一次登录时存储的信息,不是修改后的信息,后来才发现是没有更新redis中的信息。
    oauth2配置:

    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.core.annotation.Order;
    import org.springframework.data.redis.connection.RedisConnectionFactory;
    import org.springframework.http.HttpMethod;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.oauth2.provider.ClientDetailsService;
    import org.springframework.security.oauth2.provider.approval.ApprovalStore;
    import org.springframework.security.oauth2.provider.approval.TokenApprovalStore;
    import org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler;
    import org.springframework.security.oauth2.provider.client.JdbcClientDetailsService;
    import org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory;
    import org.springframework.security.oauth2.provider.token.TokenStore;
    import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;
    
    import javax.sql.DataSource;
    
    /**
     *
     */
    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    @Order(-1)
    public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter
    {
    
        @Autowired
        private DataSource dataSource;
    
        @Autowired
        private RedisConnectionFactory connectionFactory;
    
        @Autowired
        private PasswdAuthenticationProvider passwdAuthenticationProvider;
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception
        {
            auth.authenticationProvider(passwdAuthenticationProvider);
        }
    
    
        @Override
        protected void configure(HttpSecurity http) throws Exception
        {
            http.requestMatchers().antMatchers(HttpMethod.OPTIONS, "/oauth/token").and().csrf().disable();
        }
    
        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception
        {
            return super.authenticationManagerBean();
        }
    
        @Bean
        public ClientDetailsService clientDetailsService()
        {
            return new JdbcClientDetailsService(dataSource);
        }
    
        @Bean
        public TokenStore tokenStore()
        {
            RedisTokenStore redis = new RedisTokenStore(connectionFactory);
            return redis;
        }
    
        @Bean
        @Autowired
        public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore)
        {
            TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
            handler.setTokenStore(tokenStore);
            handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService()));
            handler.setClientDetailsService(clientDetailsService());
            return handler;
        }
    
        @Bean
        @Autowired
        public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception
        {
            TokenApprovalStore store = new TokenApprovalStore();
            store.setTokenStore(tokenStore);
            return store;
        }
    
    }

    获取认证后的信息:

    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
                Object principal = authentication == null ? null : authentication.getPrincipal();

    修改的就是principal 中的信息,但没有修改redis中的信息,本想直接操作redis中存储的对象,但担心打乱spring security自身存储的数据结构,苦苦寻找并自己研究了两天,始终没能找到答案。

    spring security源码后,发现信息是在Tokenstone接口中新增的,由于该接口没有提供修改方法,所以重写了新增的方法,覆盖了redis中的信息。

    @Autowired
    private TokenStore tokenStore;
    @Autowired
    private RedisConnectionFactory connectionFactory;
    private AuthenticationKeyGenerator authenticationKeyGenerator=new 
    DefaultAuthenticationKeyGenerator();
    
    private JdkSerializationStrategy serializationStrategy=new JdkSerializationStrategy();
    
     //更新redis中的token相关信息
        OAuth2Authentication authentication = (OAuth2Authentication)SecurityContextHolder.getContext().getAuthentication();
        String key = authenticationKeyGenerator.extractKey(authentication);
        byte[] serializedKey =  serializationStrategy.serialize("auth_to_access:" + key);
        byte[] bytes = null;
        RedisConnection conn = connectionFactory.getConnection();
        try {
            bytes = conn.get(serializedKey);
        } finally {
            conn.close();
        }
        OAuth2AccessToken accessToken =serializationStrategy.deserialize(bytes, 
        OAuth2AccessToken.class);
        tokenStore.storeAccessToken(accessToken, authentication);
  • 相关阅读:
    【Difference Between Primes HDU
    【Pet HDU
    《Java程序设计实验》 软件工程18-1,3 OO实验2
    【数据结构作业】-【带头结点的单链表就地逆置】
    【Miscalculation UVALive
    【Bit String Reordering UVALive
    【Bazinga HDU
    (转载)博弈汇总【巴什博奕,威佐夫博弈,尼姆博弈,斐波那契博弈】
    【Audiophobia UVA
    【Calling Circles UVA
  • 原文地址:https://www.cnblogs.com/hzcya1995/p/13317315.html
Copyright © 2011-2022 走看看