如何使用Spring Boot WebClient管理HTTPS双向认证，包括Bearer令牌？

huangapple
go评论107阅读模式
英文:

How to manage HTTPS Mutual Authentication including Bearer Token with Spring boot WebClient?

问题

我的帖子目标是直接分享我关于以下主题的答案。我还分享了帮助我的链接 => 我正在开发一个基于Spring WebFlux的后端。一个前端Angular应用程序连接到我的后端。
我的后端还通过HTTPS连接到业务服务器，基于双向身份验证。
我必须在每个向业务服务器的头部请求中设置一个承载令牌。
我通过HTTPS通过OAuth 2.0客户端凭据授权流程从服务器检索此令牌。下面是我如何管理实施的答案。

英文:

The goal of my post is to directly share my answer regarding the following topic. I share also the links that helped me => I'm developping a backend based on Spring webflux. A frontEnd angular application is connected to my backend.
My backend is also connected to a business server through HTTPS based on mutual authentication.
I have to set a bearer token in each header request to my business server.
I retrieve this token from a server through OAuth 2.0 client credentials grant flow through HTTPS. My answer below shows how I managed the implementation.

答案1

得分: 0

以下是翻译好的部分：

感谢以下链接：

我找到了以下解决方案：

  1. @Configuration
  2. @EnableWebFluxSecurity
  3. public class Oauth2ClientConfig {
  5.     // 基于 OAuth 2.0 客户端凭证授权流的 Bearer Token 管理
  6.     @Bean
  7.     ReactiveClientRegistrationRepository getRegistration() {
  8.         ClientRegistration registration = ClientRegistration
  9.                 .withRegistrationId("credentialProvider")
  10.                 .tokenUri("https://rhsso:8446/auth/token")
  11.                 .clientId("client_id").clientSecret("client_secret")
  12.                 .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
  13.                 .build();
  14.         return new InMemoryReactiveClientRegistrationRepository(registration);
  15.     }
  16.     // 使用 HTTPS 进行 Bearer Token 管理
  17.     @Bean
  18.     public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
  19.             ReactiveClientRegistrationRepository clientRegistrationRepository,
  20.             ReactiveOAuth2AuthorizedClientService authorizedClientService) throws IOException, KeyStoreException,
  21.             NoSuchAlgorithmException, CertificateException, UnrecoverableKeyException {
  23.         WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient = new WebClientReactiveClientCredentialsTokenResponseClient();
  25.         final FileInputStream keyStoreFile = new FileInputStream("C:\\keystore\\client_keystore.p12"); // 客户端私钥和客户端证书
  26.         final FileInputStream trustStoreFile = new FileInputStream("C:\\truststore\\server_truststore.p12");
  27.         final KeyStore keyStore = KeyStore.getInstance("PKCS12");
  28.         final KeyStore trustStore = KeyStore.getInstance("PKCS12");
  29.         final KeyManagerFactory keyManagerFactory = KeyManagerFactory
  30.                 .getInstance(KeyManagerFactory.getDefaultAlgorithm());
  31.         final TrustManagerFactory trustManagerFactory = TrustManagerFactory
  32.                 .getInstance(TrustManagerFactory.getDefaultAlgorithm());
  34.         String keyStorePassword = "keyStorePassword";
  35.         String trustStorePassword = "trustStorePassword";
  36.         keyStore.load(keyStoreFile, keyStorePassword.toCharArray());
  37.         keyManagerFactory.init(keyStore, keyStorePassword.toCharArray());
  38.         trustStore.load(trustStoreFile, trustStorePassword.toCharArray());
  39.         trustManagerFactory.init(trustStore);
  41.         // 通过 sslContext 进行 HTTPS 管理
  42.         SslContextBuilder sslContextBuilder = SslContextBuilder.forClient().keyManager(keyManagerFactory)
  43.                 .trustManager(trustManagerFactory);
  45.         SslContext sslContext = sslContextBuilder.build();
  47.         HttpClient httpSslClient = HttpClient.create().secure(ssl -> ssl.sslContext(sslContext));
  49.         ClientHttpConnector httpConnector = new ReactorClientHttpConnector(httpSslClient);
  51.         accessTokenResponseClient.setWebClient(WebClient.builder().clientConnector(httpConnector).build());
  53.         ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder
  54.                 .builder().clientCredentials(c -> {
  55.                     c.accessTokenResponseClient(accessTokenResponseClient);
  56.                 }).build();
  58.         AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager authorizedClientManager = new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(
  59.                 clientRegistrationRepository, authorizedClientService);
  60.         authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
  62.         return authorizedClientManager;
  63.     }
  65.     @Bean("CustomWebClient") //Qualifier to be used by my dedicated ClientAPI service in order to use the right one among available WebClient beans
  66.     public WebClient webClient(ReactiveOAuth2AuthorizedClientManager authorizedClientManager) throws KeyStoreException,
  67.             NoSuchAlgorithmException, CertificateException, IOException, UnrecoverableKeyException {
  68.         ServerOAuth2AuthorizedClientExchangeFilterFunction oauthFunction = new ServerOAuth2AuthorizedClientExchangeFilterFunction(
  69.                 authorizedClientManager);
  70.         oauthFunction.setDefaultClientRegistrationId("credentialProvider"); // 链接到上面管理的 Bearer token 的 ID
  72.         final FileInputStream keyStoreFile = new FileInputStream("C:\\keystore\\business_client_keystore.p12"); // 客户端私钥和客户端证书
  73.         final FileInputStream trustStoreFile = new FileInputStream("C:\\truststore\\business_server_truststore.p12");
  74.         final KeyStore keyStore = KeyStore.getInstance("PKCS12");
  75.         final KeyStore trustStore = KeyStore.getInstance("PKCS12");
  76.         final KeyManagerFactory keyManagerFactory = KeyManagerFactory
  77.                 .getInstance(KeyManagerFactory.getDefaultAlgorithm());
  78.         final TrustManagerFactory trustManagerFactory = TrustManagerFactory
  79.                 .getInstance(TrustManagerFactory.getDefaultAlgorithm());
  81.         String keyStorePassword = "business_keyStorePassword";
  82.         String trustStorePassword = "business_trustStorePassword";
  83.         keyStore.load(keyStoreFile, keyStorePassword.toCharArray());
  84.         keyManagerFactory.init(keyStore, keyStorePassword.toCharArray());
  85.         trustStore.load(trustStoreFile, trustStorePassword.toCharArray());
  87.         trustManagerFactory.init(trustStore);
  88.         // 创建 Netty SslContext、HttpClient
  89.         SslContextBuilder sslContextBuilder = SslContextBuilder.forClient().keyManager(keyManagerFactory)
  90.                 .trustManager(trustManagerFactory);
  92.         SslContext sslContext = sslContextBuilder.build();
  94.         HttpClient httpSslClient = HttpClient.create().secure(ssl -> ssl.sslContext(sslContext));
  96.         // 创建 Reactive ClientHttpConnector & WebClient
  97.         final ClientHttpConnector httpConnector = new ReactorClientHttpConnector(httpSslClient);
  99.         return WebClient.builder().clientConnector(httpConnector).filter(oauthFunction).build();
  101.     }
  103.     @Bean
  104.     public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
  105.         // 禁用前端界面的 CSRF，但通常不建议，只在特殊情况下使用
  106.         // 跨域管理以接受安装在本地主机上的前端应用程序，仅允许 POST 方法
  107.         http.csrf().disable().cors(corsCustomizer -> {
  108.             CorsConfigurationSource configurationSource = request -> {
  109.                 CorsConfiguration corsConfiguration = new CorsConfiguration();
  110.                 corsConfiguration.setAllowedOrigins(List.of("localhost:8080"));
  111.                 corsConfiguration.setAllowedMethods(List.of("POST"));
  112.                 return corsConfiguration;
  113.             };
  114.             corsCustomizer.configurationSource(configurationSource);
  115.         }).oauth2Client();
  117.         return http.build();
  118.     }
  120. }

基于上述配置的 Web 客户端：

  1. @Service
  2. public class ClientAPI {
  3.     
  5.     private WebClient webClient;
  6.     private String businessServiceUrl;
  8.     @Autowired
  9.     public ClientAPI(@Qualifier("CustomWebClient") WebClient webClient) {
  10.         this.businessServiceUrl = "https://hostServerName:8081/theService";
  11.         this.webClient = webClient;
  12.     }
  14.     public Mono<Response>
  16. <details>
  17. <summary>英文:</summary>
  19. Thanx to following links : 
  20. - &lt;https://stackoverflow.com/questions/62935967/spring-boot-oauth2-clientreactive-mutual-tls-ssl-token-uri&gt;
  21. - &lt;https://stackoverflow.com/questions/45418523/spring-5-webclient-using-ssl&gt;
  22. - &lt;https://stackoverflow.com/questions/62935967/spring-boot-oauth2-clientreactive-mutual-tls-ssl-token-uri&gt;
  23. - &lt;https://stackoverflow.com/questions/17173559/how-to-verify-if-java-sends-the-client-certificate-in-a-mutual-auth-scenario&gt; =&gt; useful to check Mutual authentication in debug mode
  26. I found out the following solution :
  28. ```java
  29. @Configuration
  30. @EnableWebFluxSecurity
  31. public class Oauth2ClientConfig {
  33. 	// Bearer Token management based on OAuth 2.0 client credentials grant flow
  34. 	@Bean
  35. 	ReactiveClientRegistrationRepository getRegistration() {
  36. 		ClientRegistration registration = ClientRegistration
  37. 				.withRegistrationId(&quot;credentialProvider&quot;)
  38. 				.tokenUri(&quot;https://rhsso:8446/auth/token&quot;)
  39. 				.clientId(&quot;client_id&quot;).clientSecret(&quot;client_secret&quot;)
  40. 				.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
  41. 				.build();
  42. 		return new InMemoryReactiveClientRegistrationRepository(registration);
  43. 	}
  44.     // Bearer Token management using HTTPS
  45. 	@Bean
  46. 	public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
  47. 			ReactiveClientRegistrationRepository clientRegistrationRepository,
  48. 			ReactiveOAuth2AuthorizedClientService authorizedClientService) throws IOException, KeyStoreException,
  49. 			NoSuchAlgorithmException, CertificateException, UnrecoverableKeyException {
  51. 		WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient = new WebClientReactiveClientCredentialsTokenResponseClient();
  52. 		      
  53. 		final FileInputStream keyStoreFile = new FileInputStream(&quot;C:\\keystore\\client_keystore.p12&quot;); // client private key and client certificate
  54. 		final FileInputStream trustStoreFile = new FileInputStream(&quot;C:\\truststore\\server_truststore.p12&quot;);
  55. 		final KeyStore keyStore = KeyStore.getInstance(&quot;PKCS12&quot;);
  56. 		final KeyStore trustStore = KeyStore.getInstance(&quot;PKCS12&quot;);
  57. 		final KeyManagerFactory keyManagerFactory = KeyManagerFactory
  58. 				.getInstance(KeyManagerFactory.getDefaultAlgorithm());
  59. 		final TrustManagerFactory trustManagerFactory = TrustManagerFactory
  60. 				.getInstance(TrustManagerFactory.getDefaultAlgorithm());
  62. 		String keyStorePassword = &quot;keyStorePassword&quot;;
  63. 		String trustStorePassword = &quot;trustStorePassword&quot;;
  64. 		keyStore.load(keyStoreFile, keyStorePassword.toCharArray());
  65. 		keyManagerFactory.init(keyStore, keyStorePassword.toCharArray());
  66. 		trustStore.load(trustStoreFile, trustStorePassword.toCharArray());
  67. 		trustManagerFactory.init(trustStore);
  68. 		
  69. 		// HTTPS management through sslContext
  70. 		SslContextBuilder sslContextBuilder = SslContextBuilder.forClient().keyManager(keyManagerFactory)
  71. 				.trustManager(trustManagerFactory);
  73. 		SslContext sslContext = sslContextBuilder.build();
  75. 		HttpClient httpSslClient = HttpClient.create().secure(ssl -&gt; ssl.sslContext(sslContext));
  77. 		ClientHttpConnector httpConnector = new ReactorClientHttpConnector(httpSslClient);
  79. 		accessTokenResponseClient.setWebClient(WebClient.builder().clientConnector(httpConnector).build()); 
  81. 		ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder
  82. 				.builder().clientCredentials(c -&gt; {
  83. 					c.accessTokenResponseClient(accessTokenResponseClient);
  84. 				}).build();
  86. 		
  87. 		AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager authorizedClientManager = new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(
  88. 				clientRegistrationRepository, authorizedClientService);
  89. 		authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
  91. 		return authorizedClientManager;
  92. 	}
  94. 	@Bean(&quot;CustomWebClient&quot;) //Qualifier to be used by my dedicated ClientAPI service in order to use the right one among available WebClient beans
  95. 	public WebClient webClient(ReactiveOAuth2AuthorizedClientManager authorizedClientManager) throws KeyStoreException,
  96. 			NoSuchAlgorithmException, CertificateException, IOException, UnrecoverableKeyException {
  97. 		ServerOAuth2AuthorizedClientExchangeFilterFunction oauthFunction = new ServerOAuth2AuthorizedClientExchangeFilterFunction(
  98. 				authorizedClientManager);
  99. 		oauthFunction.setDefaultClientRegistrationId(&quot;credentialProvider&quot;); // Link to Bearer token managed above through Its ID
  101. 		final FileInputStream keyStoreFile = new FileInputStream(&quot;C:\\keystore\\business_client_keystore.p12&quot;); // client private key and client certificate
  102. 		final FileInputStream trustStoreFile = new FileInputStream(&quot;C:\\truststore\\business_server_truststore.p12&quot;);
  103. 		final KeyStore keyStore = KeyStore.getInstance(&quot;PKCS12&quot;);
  104. 		final KeyStore trustStore = KeyStore.getInstance(&quot;PKCS12&quot;);
  105. 		final KeyManagerFactory keyManagerFactory = KeyManagerFactory
  106. 				.getInstance(KeyManagerFactory.getDefaultAlgorithm());
  107. 		final TrustManagerFactory trustManagerFactory = TrustManagerFactory
  108. 				.getInstance(TrustManagerFactory.getDefaultAlgorithm());
  110. 		String keyStorePassword = &quot;business_keyStorePassword&quot;;
  111. 		String trustStorePassword = &quot;business_trustStorePassword&quot;;
  112. 		keyStore.load(keyStoreFile, keyStorePassword.toCharArray());
  113. 		keyManagerFactory.init(keyStore, keyStorePassword.toCharArray());
  114. 		trustStore.load(trustStoreFile, trustStorePassword.toCharArray());
  116. 		trustManagerFactory.init(trustStore);
  117. 		// Create Netty SslContext, HttpClient
  118. 		SslContextBuilder sslContextBuilder = SslContextBuilder.forClient().keyManager(keyManagerFactory)
  119. 				.trustManager(trustManagerFactory);
  121. 		SslContext sslContext = sslContextBuilder.build();
  123. 		HttpClient httpSslClient = HttpClient.create().secure(ssl -&gt; ssl.sslContext(sslContext));
  125. 		// Create Reactive ClientHttpConnector &amp; WebClient
  126. 		final ClientHttpConnector httpConnector = new ReactorClientHttpConnector(httpSslClient);
  128. 		return WebClient.builder().clientConnector(httpConnector).filter(oauthFunction).build();
  130. 	}
  132. 	@Bean
  133. 	public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
  134. 		// disable csrf with frontend interface but generally not recommended otherwise only in special cases
  135. 		// cors management in order to accept FrontEnd application installed localhost and only POST method is allowed 
  136. 		http.csrf().disable().cors(corsCustomizer -&gt; {
  137. 			CorsConfigurationSource configurationSource = request-&gt;{
  138. 				CorsConfiguration corsConfiguration = new CorsConfiguration();
  139. 				corsConfiguration.setAllowedOrigins(List.of(&quot;localhost:8080&quot;));
  140. 				corsConfiguration.setAllowedMethods(List.of(&quot;POST&quot;));
  141. 				return corsConfiguration;
  142. 			};
  143. 			corsCustomizer.configurationSource(configurationSource);
  144. 		}).oauth2Client(); 
  145. 		
  146. 		return http.build();
  147. 	}
  149. }

My webclient based on my beans above :

  1. @Service
  2. public class ClientAPI {
  3. 	
  5. 	private WebClient webClient;
  6. 	private String businessServiceUrl;
  8. 	@Autowired
  9. 	public ClientAPI(@Qualifier(&quot;CustomWebClient&quot;) WebClient webClient) {
  10. 		this.businessServiceUrl = &quot;https://hostServerName:8081/theService&quot;;
  11. 		this.webClient = webClient;
  12. 	}
  14. 	public Mono&lt;Response&gt; sendRequest(Request bodyRequest) {
  16. 		Mono&lt;Response&gt; result = this.webClient.post().uri(this.businessServiceUrl)
  17. 				.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
  18. 				.body(Mono.just(bodyRequest), Request.class).retrieve().bodyToMono(Response.class);
  20. 		return result;
  21. 	}
  23. }

huangapple
  • 本文由 发表于 2023年7月12日 21:28:56
  • 转载请务必保留本文链接：https://go.coder-hub.com/76671125.html
  • bearer-token
  • https
  • mutual-authentication
  • spring-boot
  • spring-webflux
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定