Spring Security 6.5: dlulisa ukushintshana kwekhodi yemvume ye-OAuth nge-proxy

Isiphequluli sifinyelela kumhlinzeki wobunikazi, bese ukungena kwehluleka lapho uhlelo lushintsha ikhodi yemvume ebuyisiwe. Lokho kushintshana isicelo esiphumayo esivela kuseva yohlelo, esineklayenti laso le-HTTP.

Nge-API esekelwe ku-RestClient etholakala ku-Spring Security 6.5, nika iklayenti lempendulo ye-token yekhodi yemvume imboni yezicelo eyazi i-proxy:

SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
factory.setProxy(new java.net.Proxy(
    java.net.Proxy.Type.HTTP,
    new java.net.InetSocketAddress("proxy.example", 8080)));
factory.setConnectTimeout(5000);
factory.setReadTimeout(15000);

RestClient tokenHttp = RestClient.builder()
    .requestFactory(factory)
    .messageConverters(converters -> {
        converters.clear();
        converters.add(new FormHttpMessageConverter());
        converters.add(new OAuth2AccessTokenResponseHttpMessageConverter());
    })
    .defaultStatusHandler(new OAuth2ErrorResponseErrorHandler())
    .build();

RestClientAuthorizationCodeTokenResponseClient tokenClient =
    new RestClientAuthorizationCodeTokenResponseClient();
tokenClient.setRestClient(tokenHttp);

Amakilasi e-converter nesibambi samaphutha agcina ukuziphatha okubhaliwe kwesicelo se-token se-Spring Security. I-RestClient ejwayelekile elungiselelwe kuphela i-JSON API engahlobene ayilona ukushintshwa okulinganayo.

Xhuma i-tokenClient efanayo ekulungiselelweni kokuphepha okukhona:

http.oauth2Login(login -> login
    .tokenEndpoint(token -> token
        .accessTokenResponseClient(tokenClient)));

Lezi zingcezu zokulungiselela zohlelo olunokubhaliswa kweklayenti ne-SecurityFilterChain kakade. Zikhetha i-proxy ye-HTTP ngaphandle kokuqinisekisa; i-proxy edinga ubufakazi idinga ukulungiselela kokuqinisekisa okuhambisana nokuthutha okukhethiwe. Endaweni yokugcina ye-token ye-HTTPS efinyeleleka emphakathini emzileni womphakathi ovunyelwe, umbhalo we-HTTP ovela kuhlu lwama-proxy e-HTTP ungagcwalisa lelo kheli le-proxy elingenayo i-akhawunti.

Gcina umsingathi we-proxy uhlukile kumbobo waso kanye nohlelo lwe-URL. Shiya i-URI ye-token yomhlinzeki wobunikazi njengendawo ekuyiwa kuyo. Isibonelo asithathi indawo yokuqinisekisa isitifiketi.

Izicelo zakamuva zidinga ukuhlolwa kobunikazi bazo. Ukuthola i-UserInfo, ukushintshana kwe-token yokuvuselela, izibonelelo ze-client-credentials kanye nezingcingo ze-API ezivikelwe kungasebenzisa ezinye izinto zeklayenti. Lungiselela iklayenti elisekelwayo elihambisanayo lapho lowo msebenzi nawo udinga umzila. Ngokugeleza kwe-client_credentials okusebenzayo kwe-Spring Security 6.5, lungiselela iklayenti le-token elisebenzayo kanye nomhlinzeki wezibonelelo waso ngokwahlukile.

Izibonelo zakudala ezisebenzisa i-OAuth2RestTemplate ne-AccessTokenProvider zingezeprojekthi endala ye-Spring Security OAuth. Khetha i-API esetshenziswa uhlelo olufakiwe ngaphambi kokulungisa ikhodi; ungahlanganisi lezo zinto kulokhu kulungiselela.