如何覆盖OAuth2AuthorizationServerSecurity的配置？

Question

对于this project.I，希望在独立的前端和后端体系结构上构建OAuth2服务器。后端基于spring-authorization-server，前端基于VUE。

在OAuth2登录流程中，它重定向到/login页面，但我需要重定向到vue前端的登录页面，比如"http://front-end ip:port/loginPage“。

如何在org.springframework.security.config.annotation.web.configuration.OAuth2AuthorizationServerSecurity中定制authenticationEntryPoint，如下所示：

    .formLogin(withDefaults()).exceptionHandling().authenticationEntryPoint(xxx)

有什么想法吗？

Answer 1

注意： OAuth2AuthorizationServerSecurity已被删除。下面的代码是最新的master。

sample authorization server应用程序具有以下默认配置：

@Configuration(proxyBeanMethods = false)
@Import(OAuth2AuthorizationServerConfiguration.class)
public class AuthorizationServerConfig {

    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
                .clientId("messaging-client")
                .clientSecret("secret")
                .clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
                .redirectUri("http://localhost:8080/authorized")
                .scope("message.read")
                .scope("message.write")
                .clientSettings(clientSettings -> clientSettings.requireUserConsent(true))
                .build();
        return new InMemoryRegisteredClientRepository(registeredClient);
    }

    @Bean
    public CryptoKeySource keySource() {
        return new StaticKeyGeneratingCryptoKeySource();
    }
}

为了自定义默认配置，不要 @Import(OAuth2AuthorizationServerConfiguration.class)，而是提供以下内容：

@Configuration(proxyBeanMethods = false)
public class AuthorizationServerConfig {

    @Bean
    @Order(Ordered.HIGHEST_PRECEDENCE)
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);

        // TODO Customize http

        return http.build();
    }

    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
                .clientId("messaging-client")
                .clientSecret("secret")
                .clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
                .redirectUri("http://localhost:8080/authorized")
                .scope("message.read")
                .scope("message.write")
                .clientSettings(clientSettings -> clientSettings.requireUserConsent(true))
                .build();
        return new InMemoryRegisteredClientRepository(registeredClient);
    }

    @Bean
    public CryptoKeySource keySource() {
        return new StaticKeyGeneratingCryptoKeySource();
    }
}

这为您提供了对HttpSecurity的访问权限，因此您可以自定义所需的任何内容。