How to update the spring security oauth2 related information stored in redis after token authentication (user information, etc.)

recently, I found that in my project, after modifying the user information in UserDetails, and then using access_token to obtain user information, I found that the information stored at the first login was not the modified information, but it was later found that the information in redis was not updated.
oauth2 configuration:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.provider.ClientDetailsService;
import org.springframework.security.oauth2.provider.approval.ApprovalStore;
import org.springframework.security.oauth2.provider.approval.TokenApprovalStore;
import org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler;
import org.springframework.security.oauth2.provider.client.JdbcClientDetailsService;
import org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;

import javax.sql.DataSource;

/**
 *
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Order(-1)
public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter
{

    @Autowired
    private DataSource dataSource;

    @Autowired
    private RedisConnectionFactory connectionFactory;

    @Autowired
    private PasswdAuthenticationProvider passwdAuthenticationProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception
    {
        auth.authenticationProvider(passwdAuthenticationProvider);
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http.requestMatchers().antMatchers(HttpMethod.OPTIONS, "/oauth/token").and().csrf().disable();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception
    {
        return super.authenticationManagerBean();
    }

    @Bean
    public ClientDetailsService clientDetailsService()
    {
        return new JdbcClientDetailsService(dataSource);
    }

    @Bean
    public TokenStore tokenStore()
    {
        RedisTokenStore redis = new RedisTokenStore(connectionFactory);
        return redis;
    }

    @Bean
    @Autowired
    public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore)
    {
        TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
        handler.setTokenStore(tokenStore);
        handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService()));
        handler.setClientDetailsService(clientDetailsService());
        return handler;
    }

    @Bean
    @Autowired
    public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception
    {
        TokenApprovalStore store = new TokenApprovalStore();
        store.setTokenStore(tokenStore);
        return store;
    }

}

get the information after authentication:

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            Object principal = authentication == null ? null : authentication.getPrincipal();

the information in principal is modified, but the information in redis is not modified. I wanted to directly manipulate the objects stored in redis, but for fear of disrupting the data structure stored by spring security itself, I struggled to find and studied it for two days, but I couldn"t find the answer. I hope the problem can be solved here.


live up to the dedicated person! Finally, I found a solution by myself. After reading the spring security source code, I found that the information was added to the Tokenstone API. Since the API does not provide a modification method, the new method was rewritten to cover the information in the redis.

@Autowired
private TokenStore tokenStore;
@Autowired
private RedisConnectionFactory connectionFactory;
private AuthenticationKeyGenerator authenticationKeyGenerator=new 
DefaultAuthenticationKeyGenerator();

private JdkSerializationStrategy serializationStrategy=new JdkSerializationStrategy();

 //redistoken
    OAuth2Authentication authentication = (OAuth2Authentication)SecurityContextHolder.getContext().getAuthentication();
    String key = authenticationKeyGenerator.extractKey(authentication);
    byte[] serializedKey =  serializationStrategy.serialize("auth_to_access:" + key);
    byte[] bytes = null;
    RedisConnection conn = connectionFactory.getConnection();
    try {
        bytes = conn.get(serializedKey);
    } finally {
        conn.close();
    }
    OAuth2AccessToken accessToken =serializationStrategy.deserialize(bytes, 
    OAuth2AccessToken.class);
    tokenStore.storeAccessToken(accessToken, authentication);

Thank you very much. After looking for it all day, I finally moved from boss to brick. Perfect solution to update the information of logged-in users.


does it have source code? How did you solve it? Currently encountered the problem of OAuth2Authentication overturning

Menu