安全OAuth2单一注销

Question

我有两个客户端(客户端1、客户端2(和一个OAuth(授权、资源(。

我想从其中一个客户端注销，另一个将注销。我已经尝试过这个春季登录，但这只是注销了我的客户端1，客户端2仍然登录！

然后，当我使用下面的代码时，我试图撤销我的代币：

String username = principal.getName();
Collection<OAuth2AccessToken> accessTokens = tokenStore.findTokensByClientIdAndUserName("client1", username);
accessTokens.forEach(a -> tokenServices.revokeToken(a.getValue()));

此代码不起作用，即使客户端1仍在登录！虽然我看到我的redi是空的，而且已经没有令牌了，但我的client1仍然登录！这怎么可能？

===========================================================================这是我的配置：

客户端-应用程序.yml:

server:
port: 8081
servlet:
context-path: /clt1
spring:
application:
name: client1
thymeleaf: 
cache: false
security:
oauth2:
client:
client-id: client1 
client-secret: secret1
userAuthorizationUri: http://localhost:8000/oa/oauth/authorize
access-token-uri: http://localhost:8000/oa/oauth/token
scope: read, write
#pre-established-redirect-uri: http://localhost:8081/clt1/callback 
#registered-redirect-uri: http://localhost:8081/clt1/callback
#use-current-uri: false 
resource:
user-info-uri: http://localhost:8000/oa/user 
#jwt:
#  key-uri: http://localhost:8000/oa/oauth/token_key 
logging:
level:
root: info

客户端-安全配置：

@Configuration
@EnableOAuth2Sso
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.antMatcher("/**")
.authorizeRequests()
.antMatchers().permitAll()
.anyRequest().authenticated()
.and()
.logout().logoutSuccessUrl("http://localhost:8000/oa/revokeClient").permitAll();
}
}

Oauth-应用程序。yml:

server:
port: 8000
servlet:
context-path: /oa
spring:
application:
name: security
redis:
host: 127.0.0.1
port: 6379
thymeleaf: 
cache: false
logging:
level:
root: info

Oauth-AuthorizationConfig:

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
@Autowired
private TokenStore tokenStore;
@Autowired
private PasswordEncoder passwordEncoder;
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients
.inMemory()
.withClient("client1")
.secret(passwordEncoder.encode("secret1"))
.scopes("read", "write")
.redirectUris("http://localhost:8081/clt1/login")
.authorizedGrantTypes("authorization_code", "refresh_token")
.autoApprove(true)
.and()
.withClient("client2")
.secret(passwordEncoder.encode("secret2"))
.scopes("read", "write")
.redirectUris("http://localhost:8082/clt2/login")
.authorizedGrantTypes("authorization_code", "refresh_token")
.autoApprove(true);
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.tokenStore(tokenStore);
}
}

Oauth-资源配置：

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
@Override
public void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/**")
.authorizeRequests().anyRequest().authenticated();
}
}

Oauth-安全配置：

@Configuration
@EnableWebSecurity
@Order(1)//SecurityConfig >> ResourceConfig
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private PasswordEncoder passwordEncoder;
@Autowired
private CustomUserDetailsService customUserDetailsService;
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.requestMatchers()
.antMatchers("/loginPage", "/login**", "/registerPage", "/register", "/oauth/authorize", "/revokeClient")
.and()
.authorizeRequests()
.antMatchers("/registerPage", "/register").permitAll()
.anyRequest()
.authenticated()
.and()
.formLogin().loginPage("/loginPage").loginProcessingUrl("/login").permitAll();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder);
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/css/**", "/docs/**", "/fonts/**", "/img/**", "/js/**", "/plugins/**");
}
}

Oauth-应用程序：

@SpringBootApplication
@Configuration
public class SsoDemoOauthApplication {
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Autowired
private RedisConnectionFactory connectionFactory;
@Bean
public TokenStore tokenStore() {
return new RedisTokenStore(connectionFactory);
}
public static void main(String[] args) {
SpringApplication.run(SsoDemoOauthApplication.class, args);
}
}

Answer 1

我承认不是太聪明，但放怎么样

.logout().logoutSuccessUrl("http://localhost:8000/oa/logout").permitAll();

而不是

.logout().logoutSuccessUrl("http://localhost:8000/oa/revokeClient").permitAll();

在客户端应用程序的SecurityConfig中？有什么缺点吗？