spring authorization server 随记(客户端和认证端在同一台电脑上可能遇到的问题)

262 阅读1分钟

客户端如果和认证端在同一台电脑上,登录成功还是会跳回到登录页面(可能出现的情况)

1.要注意客户端和认证端的cookie域名不能是同一个,下面是域名配置:
server:  
  reactive:  
    session:  
      cookie:  
        domain: //可以是外网IP地址也可以是localhost(如果是localhost,那认证端必须是127.0.0.1)
2.客户端的redirect_uris配置也要修改为cookie域名一致的IP地址(暂不清楚有没有问题)

这里附带一下我的客户端配置和认证端配置 客户端配置:

spring.security.oauth2.client.provider.custom-issuer.issuer-uri=http://127.0.0.1:8080
spring.security.oauth2.client.provider.custom-issuer.user-info-uri=${spring.security.oauth2.client.provider.custom-issuer.issuer-uri}/user
spring.security.oauth2.client.registration.messaging-client.provider=custom-issuer
spring.security.oauth2.client.registration.messaging-client.client-name=message-client
spring.security.oauth2.client.registration.messaging-client.client-id=messaging-client
spring.security.oauth2.client.registration.messaging-client.client-secret=123456
spring.security.oauth2.client.registration.messaging-client.client-authentication-method=client_secret_basic
spring.security.oauth2.client.registration.messaging-client.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.messaging-client.redirect-uri=http://192.168.239.1:8200/login/oauth2/code/messaging-client
spring.security.oauth2.client.registration.messaging-client.scope[0]=message.read
spring.security.oauth2.client.registration.messaging-client.scope[1]=message.write

认证端配置:

RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())  
// 客户端id  
.clientId("messaging-client")  
// 客户端秘钥,使用密码解析器加密  
.clientSecret(passwordEncoder.encode("123456"))  
// 客户端认证方式,基于请求头的认证  
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)  
// 配置资源服务器使用该客户端获取授权时支持的方式  
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)  
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)  
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)  
// 授权码模式回调地址,oauth2.1已改为精准匹配,不能只设置域名,并且屏蔽了localhost,本机使用127.0.0.1访问  
.redirectUri("http://192.168.239.1:8200/login/oauth2/code/messaging-client") 
// 该客户端的授权范围,OPENID与PROFILE是IdToken的scope,获取授权时请求OPENID的scope时认证服务会返回IdToken  
.scope(OidcScopes.OPENID)  
.scope(OidcScopes.PROFILE)  
// 自定scope  
.scope("message.read")  
.scope("message.write")  
// 客户端设置,设置用户需要确认授权  
.clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())  
.build();

上面已经通过之后,经过授权,最后出现authorization_request_not_found的错误页面

如下图:

DE4175D45D41C0A8291EF29D5F602001.png 我这里遇到的问题是: IP地址没有和cookie域名一致(原理还没弄清楚)