版本

spring boot 3.2.1 spring seciruty 6.2.1

配置

• OAuth2 客户端配置文件 application.yml

spring:
  security:
    oauth2:
      client:
        registration:
          auth-client:
            provider: auth-server # 授权服务器（如果不配置，则provider需要使用auth-client作为key）
            client-id: oidc-client # 客户端ID
            client-name: 客户端 # 客户端名称
            client-secret: secret # 客户端密码
            authorization-grant-type: authorization_code # 授权方式
            redirect-uri: http://localhost:8080/login/oauth2/code/auth-server # 授权码模式完成授权后跳转的地址（最后一节为provider.key）
            scope: openid,profile # 请求的scope
        provider:
          auth-server:
            # issuer-uri: http://localhost:8081 自动从授权服务器获取元数据
            authorization-uri: http://localhost:8081/oauth2/authorize # 授权端点
            token-uri: http://localhost:8081/oauth2/token # 令牌获取端点
            user-info-uri: http://localhost:8081/userinfo # 用户信息端点
            jwk-set-uri: http://localhost:8081/oauth2/jwks # JWS端点
            user-name-attribute: sub # 用户名属性（OpenID Connect 默认使用sub声明字段保存用户名，如果自定义用户信息结构则需要改为对应声明字段名）

注： 如果授权服务器开放了元数据端点，可通过配置issuer-uri，自动通过授权服务器获取元数据，无需配置provider中的各端点uri

源码

• OAuth2客户端属性映射 org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper

public final class OAuth2ClientPropertiesMapper {
	private static ClientRegistration getClientRegistration(String registrationId,
			OAuth2ClientProperties.Registration properties, Map<String, Provider> providers) {
		// 尝试通过issuer配置获取客户端注册信息（授权服务器元数据）
		Builder builder = getBuilderFromIssuerIfPossible(registrationId, properties.getProvider(), providers);
		if (builder == null) {
			// 如果获取失败则根据配置构造
			builder = getBuilder(registrationId, properties.getProvider(), providers);
		}
		// 使用配置覆盖构造器默认值（没有配置或空值则不应用）
		PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
		map.from(properties::getClientId).to(builder::clientId);
		map.from(properties::getClientSecret).to(builder::clientSecret);
		map.from(properties::getClientAuthenticationMethod)
			.as(ClientAuthenticationMethod::new)
			.to(builder::clientAuthenticationMethod);
		map.from(properties::getAuthorizationGrantType)
			.as(AuthorizationGrantType::new)
			.to(builder::authorizationGrantType);
		map.from(properties::getRedirectUri).to(builder::redirectUri);
		map.from(properties::getScope).as(StringUtils::toStringArray).to(builder::scope);
		map.from(properties::getClientName).to(builder::clientName);
		return builder.build();
	}
	// 尝试通过issuer获取客户端注册信息构造器
	private static Builder getBuilderFromIssuerIfPossible(String registrationId, String configuredProviderId,
			Map<String, Provider> providers) {
		// 如果客户端注册配置中没有配置providerId，则使用客户端注册ID作为providerId
		String providerId = (configuredProviderId != null) ? configuredProviderId : registrationId;
		// provider配置了issuerUri,则通过issuer查询客户端注册信息
		if (providers.containsKey(providerId)) {
			Provider provider = providers.get(providerId);
			String issuer = provider.getIssuerUri();
			if (issuer != null) {
				Builder builder = ClientRegistrations.fromIssuerLocation(issuer).registrationId(registrationId);
				return getBuilder(builder, provider);
			}
		}
		return null;
	}
	// 获取客户端注册信息构造器
	private static Builder getBuilder(String registrationId, String configuredProviderId,
			Map<String, Provider> providers) {
		// 如果客户端注册配置中没有配置providerId，则使用客户端注册ID作为providerId
		String providerId = (configuredProviderId != null) ? configuredProviderId : registrationId;
		// 获取通用provider(GOOGLE,GITHUB,FACEBOOK,OKTA)
		CommonOAuth2Provider provider = getCommonProvider(providerId);
		if (provider == null && !providers.containsKey(providerId)) {
			throw new IllegalStateException(getErrorMessage(configuredProviderId, registrationId));
		}
		// 如果获取到通用provider, 则使用通用provider创建builder,否则使用客户端注册信息创建builder
		Builder builder = (provider != null) ? provider.getBuilder(registrationId)
				: ClientRegistration.withRegistrationId(registrationId);
		// 如果配置信息中包含了provider配置，则将配置信息应用到builder中
		if (providers.containsKey(providerId)) {
			return getBuilder(builder, providers.get(providerId));
		}
		return builder;
	}
}

• 客户端注册构造器工具类 org.springframework.security.oauth2.client.registration.ClientRegistrations

public final class ClientRegistrations {
	...
	// 从issuer获取客户端注册配置信息
	public static ClientRegistration.Builder fromIssuerLocation(String issuer) {
		Assert.hasText(issuer, "issuer cannot be empty");
		URI uri = URI.create(issuer);
		// 可支持从 OpenID Connect, OAuth授权服务器获取元数据
		return getBuilder(issuer, oidc(uri), oidcRfc8414(uri), oauth(uri));
	}
	...
}