客户端如果和认证端在同一台电脑上,登录成功还是会跳回到登录页面(可能出现的情况)
1.要注意客户端和认证端的cookie域名不能是同一个,下面是域名配置:
server:
reactive:
session:
cookie:
domain: //可以是外网IP地址也可以是localhost(如果是localhost,那认证端必须是127.0.0.1)
2.客户端的redirect_uris配置也要修改为cookie域名一致的IP地址(暂不清楚有没有问题)
这里附带一下我的客户端配置和认证端配置 客户端配置:
spring.security.oauth2.client.provider.custom-issuer.issuer-uri=http://127.0.0.1:8080
spring.security.oauth2.client.provider.custom-issuer.user-info-uri=${spring.security.oauth2.client.provider.custom-issuer.issuer-uri}/user
spring.security.oauth2.client.registration.messaging-client.provider=custom-issuer
spring.security.oauth2.client.registration.messaging-client.client-name=message-client
spring.security.oauth2.client.registration.messaging-client.client-id=messaging-client
spring.security.oauth2.client.registration.messaging-client.client-secret=123456
spring.security.oauth2.client.registration.messaging-client.client-authentication-method=client_secret_basic
spring.security.oauth2.client.registration.messaging-client.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.messaging-client.redirect-uri=http://192.168.239.1:8200/login/oauth2/code/messaging-client
spring.security.oauth2.client.registration.messaging-client.scope[0]=message.read
spring.security.oauth2.client.registration.messaging-client.scope[1]=message.write
认证端配置:
RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
// 客户端id
.clientId("messaging-client")
// 客户端秘钥,使用密码解析器加密
.clientSecret(passwordEncoder.encode("123456"))
// 客户端认证方式,基于请求头的认证
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
// 配置资源服务器使用该客户端获取授权时支持的方式
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
// 授权码模式回调地址,oauth2.1已改为精准匹配,不能只设置域名,并且屏蔽了localhost,本机使用127.0.0.1访问
.redirectUri("http://192.168.239.1:8200/login/oauth2/code/messaging-client")
// 该客户端的授权范围,OPENID与PROFILE是IdToken的scope,获取授权时请求OPENID的scope时认证服务会返回IdToken
.scope(OidcScopes.OPENID)
.scope(OidcScopes.PROFILE)
// 自定scope
.scope("message.read")
.scope("message.write")
// 客户端设置,设置用户需要确认授权
.clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
.build();
上面已经通过之后,经过授权,最后出现authorization_request_not_found的错误页面
如下图:
我这里遇到的问题是:
IP地址没有和cookie域名一致(原理还没弄清楚)