我正在为我的Oauth服务器使用FusionAuth,我有一个问题。Spring security将成功解码JWT,但没有角色!
这是我在JSON中的完整身份验证对象:
https://jsoneditoronline.org/#left=cloud.911cb58e717544ab9168632ed221aae1
如你所见,我在我的主体中有角色和角色对象。但当我尝试在@PreAuthroize中使用它,甚至记录它时。它是空的。
WebSecurityConfigurerAdapter:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests(authorizeRequests ->
authorizeRequests
.antMatchers(HttpMethod.GET, "v1/balance/**").permitAll()
.antMatchers(HttpMethod.POST, "v1/balance/**").permitAll()
.antMatchers(HttpMethod.GET, "/actuator/**").permitAll()
.anyRequest().authenticated()
)
.oauth2ResourceServer(oauth2ResourceServer ->
oauth2ResourceServer
.jwt(jwt ->
jwt.decoder(JwtDecoders.fromIssuerLocation(issuerUri)).jwkSetUri(jwksUrl)
)
);
}这是我尝试记录角色的方式:
@GetMapping("/currency/{currency}")
// @PreAuthorize("hasAnyRole('admin')")
public CurrencyBalance getWalletByCurrency(@PathVariable String currency, Principal principal){
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
Set<String> roles = authentication.getAuthorities().stream()
.map(r -> r.getAuthority()).collect(Collectors.toSet());
System.out.println(roles);
System.out.println(new Gson().toJson(authentication));
System.out.println(authentication.getAuthorities());
System.out.println(authentication.getCredentials().toString());
System.out.println(authentication.getDetails());
System.out.println(authentication.getPrincipal());
System.out.println(authentication.getName());
return null;
// return balanceService.getWalletByCurrency(principal.getName(),currency);
}发布于 2021-01-03 21:26:43
首先,您需要了解JWT身份验证是如何工作的

JwtAuthenticationConverter将JWT转换为认证授权,默认情况下,它只将JWT的作用域解码为授权。(请查看JwtGrantedAuthoritiesConverter)。
如果要解码JwtAuthenticationConverter的自定义属性,则必须创建JWT的子类并覆盖extractAuthorities方法。最后,将自定义子类声明为Bean,spring security将自动使用它
https://stackoverflow.com/questions/65518172
复制相似问题