如何使用Java配置在Google OAuth2 AccountChooser中设置托管域参数？

目前我有工作的OAuth2认证流程与下面的Java配置：如何使用Java配置在Google OAuth2 AccountChooser中设置托管域参数？

@Configuration 
@EnableOAuth2Client 
@Import(SecurityWebAppInitializer.class) 
public class OAuth2SecurityConfiguration { 

    @Resource 
    private GoogleClientSecrets googleClientSecrets; 

    @Resource 
    private AccessTokenRequest accessTokenRequest; 

    @Bean 
    public AuthorizationCodeResourceDetails googleResource() { 
     AuthorizationCodeResourceDetails details = new AuthorizationCodeResourceDetails(); 
     GoogleClientSecrets.Details web = googleClientSecrets.getWeb(); 
     details.setId((String) web.get("project_id")); 
     details.setClientId(web.getClientId()); 
     details.setClientSecret(web.getClientSecret()); 
     details.setAccessTokenUri(web.getTokenUri()); 
     details.setUserAuthorizationUri(web.getAuthUri()); 
     details.setTokenName((String) web.get("token_name")); 

     String commaSeparatedScopes = (String) web.get("scope"); 
     details.setScope(parseScopes(commaSeparatedScopes)); 
     details.setPreEstablishedRedirectUri(web.getRedirectUris().get(0)); 
     details.setUseCurrentUri(false); 
     details.setAuthenticationScheme(AuthenticationScheme.query); 
     details.setClientAuthenticationScheme(AuthenticationScheme.form); 
     return details; 
    } 

    private List<String> parseScopes(String commaSeparatedScopes) { 
     List<String> scopes = newArrayList(); 
     Collections.addAll(scopes, commaSeparatedScopes.split(",")); 
     return scopes; 
    } 

    @Bean 
    public OAuth2ClientAuthenticationProcessingFilter oAuth2AuthenticationProcessingFilter(
      OAuth2RestTemplate oAuth2RestTemplate, ResourceServerTokenServices resourceServerTokenServices) { 
     OAuth2ClientAuthenticationProcessingFilter filter = 
       new OAuth2ClientAuthenticationProcessingFilter("/googleLogin"); 
     filter.setRestTemplate(oAuth2RestTemplate); 
     filter.setTokenServices(resourceServerTokenServices); 
     return filter; 
    } 

    @Bean 
    public UserAuthenticationConverter userTokenConverter() { 
     return new DefaultUserAuthenticationConverter(); 
    } 

    @Bean 
    public AccessTokenConverter accessTokenConverter(UserAuthenticationConverter userTokenConverter) { 
     GoogleAccessTokenConverter accessTokenConverter = new GoogleAccessTokenConverter(); 
     accessTokenConverter.setUserTokenConverter(userTokenConverter); 
     return new GoogleAccessTokenConverter(); 
    } 

    @Bean 
    public GoogleTokenServices tokenServices(AccessTokenConverter accessTokenConverter) { 
     GoogleTokenServices tokenServices = new GoogleTokenServices(); 
     GoogleClientSecrets.Details web = googleClientSecrets.getWeb(); 
     tokenServices.setCheckTokenEndpointUrl("https://www.googleapis.com/oauth2/v1/tokeninfo"); 
     tokenServices.setClientId(web.getClientId()); 
     tokenServices.setClientSecret(web.getClientSecret()); 
     tokenServices.setAccessTokenConverter(accessTokenConverter); 
     return tokenServices; 
    } 

    @Bean 
    public OAuth2RestTemplate googleRestTemplate() { 
     return new OAuth2RestTemplate(googleResource(), new DefaultOAuth2ClientContext(accessTokenRequest)); 
    } 

    @Bean 
    public OAuth2ClientContextFilter oauth2ClientContextFilter() { 
     return new OAuth2ClientContextFilter(); 
    } 

    @Bean 
    public LoginUrlAuthenticationEntryPoint clientAuthenticationEntryPoint() { 
     return new LoginUrlAuthenticationEntryPoint("/googleLogin"); 
    } 
}

和client_secret.json我的谷歌服务：

{ 
    "web": { 
    "client_id": "...", 
    "project_id": "...", 
    "auth_uri": "https://accounts.google.com/o/oauth2/auth", 
    "token_uri": "https://accounts.google.com/o/oauth2/token", 
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", 
    "client_secret": "...", 
    "redirect_uris": [ 
     "http://localhost:8888/googleLogin", 
     "http://localhost:8888/googleLogin/" 
    ], 
    "scope": "https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile", 
    "token_name": "authorization_code" 
    } 
}

问题是我不知道在哪里设置在Java hosted domain参数码。我试图通过stackoverflow找到解决方案，但只能看到JS或PHP的解决方案。

来源

2017-04-11 Chernogorov Vladislav

我发现AuthorizationCodeAccessTokenProvider#getRedirectForAuthorization是负责构建重定向URI，但可用的参数有限制，因此唯一的选择就是HD参数client_secrets.json添加到auth_uri：

"auth_uri": "https://accounts.google.com/o/oauth2/auth?hd=<domain>",

来源

2017-04-12 08:22:44

添加HD参数的URL工作。将？hd = MYDOMAIN.com添加到security.oauth2.client.user-authorization-uri属性取得了诀窍。

这个基本的配置适用于我在application.properties - 你可以做到这一点或yaml。当登录请求显示谷歌登录时，域预填充在表单上。

如果您之前在由Google和Gmail帐户托管的私人域中登录，并且以前需要选择正确的帐户，则会自动选择具有匹配域的帐户并将您发送到受保护的资源。

security.oauth2.client.client-id=123456789-abc123456789.apps.googleusercontent.com 
security.oauth2.client.client-secret=yyyyyyyyyyyyyyyyy 
security.oauth2.client.access-token-uri=https://www.googleapis.com/oauth2/v3/token 
security.oauth2.client.user-authorization-uri=https://accounts.google.com/o/oauth2/auth?hd=MYDOMAIN.com 
security.oauth2.client.authentication-scheme=query 
security.oauth2.client.scope=email 
security.oauth2.client. 
security.oauth2.client.client-authentication-scheme=form 
security.oauth2.resource.user-info-uri=https://www.googleapis.com/plus/v1/people/me 
security.oauth2.resource.prefer-token-info=false

来源

2017-06-23 22:05:43 Randy

如何使用Java配置在Google OAuth2 AccountChooser中设置托管域参数？

回答

相关问题