如何使用Java配置在Google OAuth2 AccountChooser中設置託管域參數？

目前我有工作的OAuth2認證流程與下面的Java配置：如何使用Java配置在Google OAuth2 AccountChooser中設置託管域參數？

@Configuration 
@EnableOAuth2Client 
@Import(SecurityWebAppInitializer.class) 
public class OAuth2SecurityConfiguration { 

    @Resource 
    private GoogleClientSecrets googleClientSecrets; 

    @Resource 
    private AccessTokenRequest accessTokenRequest; 

    @Bean 
    public AuthorizationCodeResourceDetails googleResource() { 
     AuthorizationCodeResourceDetails details = new AuthorizationCodeResourceDetails(); 
     GoogleClientSecrets.Details web = googleClientSecrets.getWeb(); 
     details.setId((String) web.get("project_id")); 
     details.setClientId(web.getClientId()); 
     details.setClientSecret(web.getClientSecret()); 
     details.setAccessTokenUri(web.getTokenUri()); 
     details.setUserAuthorizationUri(web.getAuthUri()); 
     details.setTokenName((String) web.get("token_name")); 

     String commaSeparatedScopes = (String) web.get("scope"); 
     details.setScope(parseScopes(commaSeparatedScopes)); 
     details.setPreEstablishedRedirectUri(web.getRedirectUris().get(0)); 
     details.setUseCurrentUri(false); 
     details.setAuthenticationScheme(AuthenticationScheme.query); 
     details.setClientAuthenticationScheme(AuthenticationScheme.form); 
     return details; 
    } 

    private List<String> parseScopes(String commaSeparatedScopes) { 
     List<String> scopes = newArrayList(); 
     Collections.addAll(scopes, commaSeparatedScopes.split(",")); 
     return scopes; 
    } 

    @Bean 
    public OAuth2ClientAuthenticationProcessingFilter oAuth2AuthenticationProcessingFilter(
      OAuth2RestTemplate oAuth2RestTemplate, ResourceServerTokenServices resourceServerTokenServices) { 
     OAuth2ClientAuthenticationProcessingFilter filter = 
       new OAuth2ClientAuthenticationProcessingFilter("/googleLogin"); 
     filter.setRestTemplate(oAuth2RestTemplate); 
     filter.setTokenServices(resourceServerTokenServices); 
     return filter; 
    } 

    @Bean 
    public UserAuthenticationConverter userTokenConverter() { 
     return new DefaultUserAuthenticationConverter(); 
    } 

    @Bean 
    public AccessTokenConverter accessTokenConverter(UserAuthenticationConverter userTokenConverter) { 
     GoogleAccessTokenConverter accessTokenConverter = new GoogleAccessTokenConverter(); 
     accessTokenConverter.setUserTokenConverter(userTokenConverter); 
     return new GoogleAccessTokenConverter(); 
    } 

    @Bean 
    public GoogleTokenServices tokenServices(AccessTokenConverter accessTokenConverter) { 
     GoogleTokenServices tokenServices = new GoogleTokenServices(); 
     GoogleClientSecrets.Details web = googleClientSecrets.getWeb(); 
     tokenServices.setCheckTokenEndpointUrl("https://www.googleapis.com/oauth2/v1/tokeninfo"); 
     tokenServices.setClientId(web.getClientId()); 
     tokenServices.setClientSecret(web.getClientSecret()); 
     tokenServices.setAccessTokenConverter(accessTokenConverter); 
     return tokenServices; 
    } 

    @Bean 
    public OAuth2RestTemplate googleRestTemplate() { 
     return new OAuth2RestTemplate(googleResource(), new DefaultOAuth2ClientContext(accessTokenRequest)); 
    } 

    @Bean 
    public OAuth2ClientContextFilter oauth2ClientContextFilter() { 
     return new OAuth2ClientContextFilter(); 
    } 

    @Bean 
    public LoginUrlAuthenticationEntryPoint clientAuthenticationEntryPoint() { 
     return new LoginUrlAuthenticationEntryPoint("/googleLogin"); 
    } 
}

和client_secret.json我的谷歌服務：

{ 
    "web": { 
    "client_id": "...", 
    "project_id": "...", 
    "auth_uri": "https://accounts.google.com/o/oauth2/auth", 
    "token_uri": "https://accounts.google.com/o/oauth2/token", 
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", 
    "client_secret": "...", 
    "redirect_uris": [ 
     "http://localhost:8888/googleLogin", 
     "http://localhost:8888/googleLogin/" 
    ], 
    "scope": "https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile", 
    "token_name": "authorization_code" 
    } 
}

問題是我不知道在哪裏設置在Java hosted domain參數碼。我試圖通過stackoverflow找到解決方案，但只能看到JS或PHP的解決方案。

來源

2017-04-11 Chernogorov Vladislav

我發現AuthorizationCodeAccessTokenProvider#getRedirectForAuthorization是負責構建重定向URI，但可用的參數有限制，因此唯一的選擇就是HD參數client_secrets.json添加到auth_uri：

"auth_uri": "https://accounts.google.com/o/oauth2/auth?hd=<domain>",

來源

2017-04-12 08:22:44

添加HD參數的URL工作。將？hd = MYDOMAIN.com添加到security.oauth2.client.user-authorization-uri屬性取得了訣竅。

這個基本的配置適用於我在application.properties - 你可以做到這一點或yaml。當登錄請求顯示谷歌登錄時，域預填充在表單上。

如果您之前在由Google和Gmail帳戶託管的私人域中登錄，並且以前需要選擇正確的帳戶，則會自動選擇具有匹配域的帳戶並將您發送到受保護的資源。

security.oauth2.client.client-id=123456789-abc123456789.apps.googleusercontent.com 
security.oauth2.client.client-secret=yyyyyyyyyyyyyyyyy 
security.oauth2.client.access-token-uri=https://www.googleapis.com/oauth2/v3/token 
security.oauth2.client.user-authorization-uri=https://accounts.google.com/o/oauth2/auth?hd=MYDOMAIN.com 
security.oauth2.client.authentication-scheme=query 
security.oauth2.client.scope=email 
security.oauth2.client. 
security.oauth2.client.client-authentication-scheme=form 
security.oauth2.resource.user-info-uri=https://www.googleapis.com/plus/v1/people/me 
security.oauth2.resource.prefer-token-info=false

來源

2017-06-23 22:05:43 Randy

如何使用Java配置在Google OAuth2 AccountChooser中設置託管域參數？

回答

相關問題