我们在生产中成功使用了弹簧授权服务器0.3.1。
我想整合可以在GitHub上找到的联合身份样本：
https://github.com/spring-projects/spring-authorization-server/tree/main/main/samples/federated-indentity-authorizationserver
我们做得如此成功。这个难题的最后一部分是分发标准化令牌。我的意思是，我们为带有自定义索赔的春季授权服务器解决方案提供自定义令牌。我们想将传入的联合令牌（从Google，FB等）转换为我们的自定义令牌。
这里有一些关于Interwebz的文档：
https://github.com/spring-projects/spring-projects/spring-security-security/issues/sissues/sissues/ 10033
目标是将任何远程联合令牌拿走并将其转换为自定义本地生成的Spring授权服务器令牌带有额外的索赔，可以通过我们的自定义器添加，然后将其返回给我们的单个分类应用程序用户。水疗中心需要额外的索赔才能运行。
此外，水疗中心将尝试使用SAS或联合身份提供商刷新令牌。远程系统将失败，因为尚未远程设置重定向的URI。
流：
- 用户从SPA 1登录
- 用户被重定向到SAS实例用户
- 选择使用Google联合的身份提供商
- 用户对Google用户进行身份验证的
- 使用有效的令牌登录SAS实例
- 登录，如果系统中不存在用户，则 ，我们保存新的用户记录
- 令牌将转换为我们自己类型的令牌
- 用户，将其重定向回到Spa 1
- Spa 1与SAS服务器的对话，以检索新创建的代币
- 生活和生活很好
We are using Spring Authorization Server 0.3.1 successfully in production.
I want to integrate the federated identity sample that can be found on Github here:
https://github.com/spring-projects/spring-authorization-server/tree/main/samples/federated-identity-authorizationserver
We did so successfully. The last part to this puzzle is distributing normalized tokens. By that I mean, we have custom tokens for our Spring Authorization Server solution with custom claims. We want to convert the incoming federated token [from Google, FB etc] to our custom token.
There are some documentation on the Interwebz around this here:
https://github.com/spring-projects/spring-security/issues/10033
The goal is to take any remote federated token and convert it to a custom locally generated Spring Authorization Server token with extra claims that get added through our customizer and then return that to our Single Paged Application user. The SPAs require the extra claims to operate.
Also, the SPA will try to refresh the token with SAS or the federated identity provider. It will fail with the remote system as the redirect URIs have not been set up remotely.
Flow:
- User logs in from SPA 1
- User is redirected to SAS instance
- User chooses to log in with Google's federated identity provider
- User authenticates with Google
- User comes back to SAS instance with a valid token
- If user doesn't yet exist in the system, we save a new user record
- Token gets converted to our own type of token
- User is redirected back to SPA 1
- SPA 1 talks to SAS server to retrieve the newly created token
- Life goes on and life is good ????♂️
Any advice is appreciated.
发布评论
评论（1）
正如@steveriesenberg在评论中指出的那样，联合的安全示例已经显示了如何使用自定义器来实现和删除索赔，以及将主名正常化。
如何自定义索赔。
如何正常化主名称
谢谢史蒂夫！
As @steveriesenberg pointed out in the comments, the federated security examples already show how adding and removing claims can be accomplished with the customizer as well as normalizing the principal name.
How to customize claims.
How to normalize principal name
Thank you Steve!