33 lines
1.8 KiB
Java
33 lines
1.8 KiB
Java
|
package com.baiyue.common.security;
|
||
|
|
|
||
|
|
import org.springframework.beans.factory.annotation.Value;
|
||
|
|
import org.springframework.boot.autoconfigure.AutoConfiguration;
|
||
|
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
|
||
|
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
|
||
|
|
import org.springframework.context.annotation.Bean;
|
||
|
|
import org.springframework.security.oauth2.jwt.JwtDecoder;
|
||
|
|
import org.springframework.security.oauth2.jwt.JwtValidators;
|
||
|
|
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
|
||
|
|
import org.springframework.security.oauth2.jwt.JwtClaimValidator;
|
||
|
|
import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
|
||
|
|
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
|
||
|
|
|
||
|
|
import java.util.List;
|
||
|
|
|
||
|
|
/** 海外服务仅通过可轮换 JWKS 验证 RS256，不访问国内 Redis。 */
|
||
|
|
@AutoConfiguration(before = BaiyueSecurityAutoConfiguration.class)
|
||
|
|
@ConditionalOnProperty(name="baiyue.security.jwt-mode",havingValue="jwks")
|
||
|
|
public class JwksJwtDecoderAutoConfiguration {
|
||
|
|
@Bean @ConditionalOnMissingBean(JwtDecoder.class)
|
||
|
|
JwtDecoder jwksJwtDecoder(@Value("${baiyue.security.jwk-set-uri}") String uri,
|
||
|
|
@Value("${baiyue.security.issuer:auth-service}") String issuer,
|
||
|
|
@Value("${baiyue.security.audience:lastleg-api}") String audience) {
|
||
|
|
NimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(uri)
|
||
|
|
.jwsAlgorithm(SignatureAlgorithm.RS256).build();
|
||
|
|
decoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(
|
||
|
|
JwtValidators.createDefaultWithIssuer(issuer),
|
||
|
|
new JwtClaimValidator<List<String>>("aud", values -> values != null && values.contains(audience))));
|
||
|
|
return decoder;
|
||
|
|
}
|
||
|
|
}
|