2
2
3
3
import com .github .thomasdarimont .keycloak .webapp .support .HttpSessionOAuth2AuthorizedClientService ;
4
4
import com .github .thomasdarimont .keycloak .webapp .support .security .KeycloakLogoutHandler ;
5
+ import jakarta .servlet .http .HttpServletRequest ;
6
+ import jakarta .servlet .http .HttpServletResponse ;
5
7
import lombok .RequiredArgsConstructor ;
8
+ import lombok .extern .slf4j .Slf4j ;
6
9
import org .springframework .boot .actuate .autoconfigure .endpoint .web .CorsEndpointProperties ;
7
10
import org .springframework .context .annotation .Bean ;
8
11
import org .springframework .context .annotation .Configuration ;
12
15
import org .springframework .security .core .authority .mapping .GrantedAuthoritiesMapper ;
13
16
import org .springframework .security .oauth2 .client .OAuth2AuthorizedClientService ;
14
17
import org .springframework .security .oauth2 .client .endpoint .DefaultAuthorizationCodeTokenResponseClient ;
18
+ import org .springframework .security .oauth2 .client .endpoint .OAuth2AccessTokenResponseClient ;
15
19
import org .springframework .security .oauth2 .client .endpoint .OAuth2AuthorizationCodeGrantRequest ;
16
20
import org .springframework .security .oauth2 .client .endpoint .OAuth2AuthorizationCodeGrantRequestEntityConverter ;
21
+ import org .springframework .security .oauth2 .client .endpoint .RestClientAuthorizationCodeTokenResponseClient ;
17
22
import org .springframework .security .oauth2 .client .registration .ClientRegistrationRepository ;
18
23
import org .springframework .security .oauth2 .client .web .AuthorizationRequestRepository ;
19
24
import org .springframework .security .oauth2 .client .web .DefaultOAuth2AuthorizationRequestResolver ;
28
33
import org .springframework .util .MultiValueMap ;
29
34
30
35
import java .util .HashSet ;
31
- import java .util .List ;
32
36
37
+ @ Slf4j
33
38
@ Configuration
34
39
@ RequiredArgsConstructor
35
40
class WebSecurityConfig {
@@ -76,20 +81,37 @@ public SecurityFilterChain filterChain(HttpSecurity http, ClientRegistrationRepo
76
81
private static void customizeTokenEndpointRequest (OAuth2LoginConfigurer <HttpSecurity > o2lc ) {
77
82
// customize the token endpoint request parameters
78
83
o2lc .tokenEndpoint (tec -> {
79
- DefaultAuthorizationCodeTokenResponseClient accessTokenResponseClient = new DefaultAuthorizationCodeTokenResponseClient ();
80
- accessTokenResponseClient .setRequestEntityConverter (new OAuth2AuthorizationCodeGrantRequestEntityConverter (){
81
- @ Override
82
- protected MultiValueMap <String , String > createParameters (OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest ) {
83
-
84
- // if used with instance specific backchannel logout url: https://${application.session.host}:4633/webapp/logout
85
- MultiValueMap <String , String > parameters = super .createParameters (authorizationCodeGrantRequest );
86
- parameters .add ("client_session_state" , "bubu123" );
87
- parameters .add ("client_session_host" , "apps.acme.test" );
88
- return parameters ;
89
- }
90
- });
91
- tec .accessTokenResponseClient (accessTokenResponseClient );
84
+
85
+ tec .accessTokenResponseClient (
86
+ createCustomAccessTokenResponseClientNew ()
87
+ // createCustomAccessTokenResponseClientOld()
88
+ );
89
+ });
90
+ }
91
+
92
+ private static OAuth2AccessTokenResponseClient <OAuth2AuthorizationCodeGrantRequest > createCustomAccessTokenResponseClientNew () {
93
+ var accessTokenResponseClient = new RestClientAuthorizationCodeTokenResponseClient ();
94
+ accessTokenResponseClient .setParametersCustomizer (parameters -> {
95
+ parameters .add ("client_session_state" , "bubu123" );
96
+ parameters .add ("client_session_host" , "apps.acme.test" );
97
+ });
98
+ return accessTokenResponseClient ;
99
+ }
100
+
101
+ private static OAuth2AccessTokenResponseClient <OAuth2AuthorizationCodeGrantRequest > createCustomAccessTokenResponseClientOld () {
102
+ var accessTokenResponseClient = new DefaultAuthorizationCodeTokenResponseClient ();
103
+ accessTokenResponseClient .setRequestEntityConverter (new OAuth2AuthorizationCodeGrantRequestEntityConverter (){
104
+ @ Override
105
+ protected MultiValueMap <String , String > createParameters (OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest ) {
106
+
107
+ // if used with instance specific backchannel logout url: https://${application.session.host}:4633/webapp/logout
108
+ MultiValueMap <String , String > parameters = super .createParameters (authorizationCodeGrantRequest );
109
+ parameters .add ("client_session_state" , "bubu123" );
110
+ parameters .add ("client_session_host" , "apps.acme.test" );
111
+ return parameters ;
112
+ }
92
113
});
114
+ return accessTokenResponseClient ;
93
115
}
94
116
95
117
/**
@@ -112,8 +134,7 @@ public OAuth2AuthorizedClientRepository authorizedClientRepository() {
112
134
@ Bean
113
135
public OAuth2AuthorizedClientService oAuth2AuthorizedClientService (OAuth2AuthorizedClientRepository clientRegistrationRepository ) {
114
136
// var oauthAuthorizedClientService = new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
115
- var oauthAuthorizedClientService = new HttpSessionOAuth2AuthorizedClientService (clientRegistrationRepository );
116
- return oauthAuthorizedClientService ;
137
+ return new HttpSessionOAuth2AuthorizedClientService (clientRegistrationRepository );
117
138
}
118
139
119
140
private GrantedAuthoritiesMapper userAuthoritiesMapper () {
@@ -129,6 +150,7 @@ private GrantedAuthoritiesMapper userAuthoritiesMapper() {
129
150
// TODO extract roles from userInfo response
130
151
// List<SimpleGrantedAuthority> groupAuthorities = userInfo.getClaimAsStringList("groups").stream().map(g -> new SimpleGrantedAuthority("ROLE_" + g.toUpperCase())).collect(Collectors.toList());
131
152
// mappedAuthorities.addAll(groupAuthorities);
153
+ log .info ("Got userinfo. userinfo={}" , userInfo );
132
154
}
133
155
});
134
156
0 commit comments