FeignClient 在 oauth2 中与 hystrix 线程策略冲突问题造成的权限问题

问题描述

在springcloud 系统中，通过feignclient 传递oauth2 token的时候，出现 no full authentication 问题

问题原因

hystrix 默认的线程策略是thread。也就是说在 hystrix启用状态下，当执行feignclient 调用的时候，会另起一个线程，导致安全上下问题传递不到子线程中。

问题解决方法

方法1 直接禁用 hystrix

通过在配置文件application.yaml 中加入如下内容,关闭feign 中的hystrix，但是现实场景最好不关闭。

feign:
  hystrix:
    enabled: false

方法2 设置hystrix 线程策略

通过在配置文件application.yaml 中加入如下内容,设置hystrix的线程策略

hystrix:
  command:
    default:
      execution:
        isolation:
          thread:
            timeoutInMilliseconds: 60000
          #这里将线程策略设置为SEMAPHORE
          strategy: SEMAPHORE

最后的工作 OAuth2FeignRequestInterceptor

添加 OAuth2FeignRequestInterceptor 自定义类

/**
 *  author chen roger
 */
package com.springcloud.template.common.security.jwt.Interceptor;

import lombok.extern.slf4j.Slf4j;
import org.springframework.cloud.security.oauth2.client.feign.OAuth2FeignRequestInterceptor;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.security.oauth2.client.OAuth2ClientContext;
import org.springframework.security.oauth2.client.token.AccessTokenProvider;
import org.springframework.security.oauth2.client.token.AccessTokenProviderChain;
import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsAccessTokenProvider;
import org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeAccessTokenProvider;
import org.springframework.security.oauth2.client.token.grant.implicit.ImplicitAccessTokenProvider;
import org.springframework.security.oauth2.client.token.grant.password.ResourceOwnerPasswordAccessTokenProvider;

import java.util.ArrayList;
import java.util.Collections;
import java.util.List;

@Slf4j
public class MyOAuth2FeignRequestInterceptor extends OAuth2FeignRequestInterceptor {



    private final OAuth2ClientContext oAuth2ClientContext;


    private final AccessTokenProvider accessTokenProvider;

    public MyOAuth2FeignRequestInterceptor(OAuth2ClientContext oAuth2ClientContext) {
        super(oAuth2ClientContext, null);
        HttpComponentsClientHttpRequestFactory httpComponentsClientHttpRequestFactory = new HttpComponentsClientHttpRequestFactory();
        this.oAuth2ClientContext=oAuth2ClientContext;
        List<AccessTokenProvider> chain = new ArrayList<>();

        AuthorizationCodeAccessTokenProvider authorizationCodeAccessTokenProvider= new AuthorizationCodeAccessTokenProvider();
        authorizationCodeAccessTokenProvider.setRequestFactory(httpComponentsClientHttpRequestFactory);
        chain.add(authorizationCodeAccessTokenProvider);

        ImplicitAccessTokenProvider implicitAccessTokenProvider = new ImplicitAccessTokenProvider();
        implicitAccessTokenProvider.setRequestFactory(httpComponentsClientHttpRequestFactory);
        chain.add(implicitAccessTokenProvider);

        ResourceOwnerPasswordAccessTokenProvider resourceOwnerPasswordAccessTokenProvider = new ResourceOwnerPasswordAccessTokenProvider();
        resourceOwnerPasswordAccessTokenProvider.setRequestFactory(httpComponentsClientHttpRequestFactory);
        chain.add(resourceOwnerPasswordAccessTokenProvider);

        ClientCredentialsAccessTokenProvider clientCredentialsAccessTokenProvider = new ClientCredentialsAccessTokenProvider();
        clientCredentialsAccessTokenProvider.setRequestFactory(httpComponentsClientHttpRequestFactory);
        chain.add(clientCredentialsAccessTokenProvider);
        List<AccessTokenProvider> providers=Collections.unmodifiableList(chain);
        accessTokenProvider=new AccessTokenProviderChain(providers);



    }


}

注册自定义的 OAuth2FeignRequestInterceptor

/**
 *  author chen roger
 */

package com.springcloud.template.common.security.jwt;

import com.springcloud.template.common.security.jwt.Interceptor.MyOAuth2FeignRequestInterceptor;
import feign.RequestInterceptor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.oauth2.client.OAuth2ClientContext;

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class GlobalMethodSecurityConfiguration {

    @Bean
    public RequestInterceptor oAuth2FeignRequestInterceptor(OAuth2ClientContext oAuth2ClientContext){
        return new MyOAuth2FeignRequestInterceptor(oAuth2ClientContext);
    }

}