FeignClient 在 oauth2 中与 hystrix 线程策略冲突问题造成的权限问题

---

问题描述

在springcloud 系统中，通过feignclient 传递oauth2 token的时候，出现 no full authentication 问题

问题原因

hystrix 默认的线程策略是thread。也就是说在 hystrix启用状态下，当执行feignclient 调用的时候，会另起一个线程，导致安全上下问题传递不到子线程中。

问题解决方法

方法1 直接禁用 hystrix

通过在配置文件application.yaml 中加入如下内容,关闭feign 中的hystrix，但是现实场景最好不关闭。

feign:  hystrix:    enabled: false

方法2 设置hystrix 线程策略

通过在配置文件application.yaml 中加入如下内容,设置hystrix的线程策略

hystrix:  command:    default:      execution:        isolation:          thread:            timeoutInMilliseconds: 60000          #这里将线程策略设置为SEMAPHORE          strategy: SEMAPHORE

最后的工作 OAuth2FeignRequestInterceptor

添加 OAuth2FeignRequestInterceptor 自定义类

/** *  author chen roger */package com.springcloud.template.common.security.jwt.Interceptor;import lombok.extern.slf4j.Slf4j;import org.springframework.cloud.security.oauth2.client.feign.OAuth2FeignRequestInterceptor;import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;import org.springframework.security.oauth2.client.OAuth2ClientContext;import org.springframework.security.oauth2.client.token.AccessTokenProvider;import org.springframework.security.oauth2.client.token.AccessTokenProviderChain;import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsAccessTokenProvider;import org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeAccessTokenProvider;import org.springframework.security.oauth2.client.token.grant.implicit.ImplicitAccessTokenProvider;import org.springframework.security.oauth2.client.token.grant.password.ResourceOwnerPasswordAccessTokenProvider;import java.util.ArrayList;import java.util.Collections;import java.util.List;@Slf4jpublic class MyOAuth2FeignRequestInterceptor extends OAuth2FeignRequestInterceptor {    private final OAuth2ClientContext oAuth2ClientContext;    private final AccessTokenProvider accessTokenProvider;    public MyOAuth2FeignRequestInterceptor(OAuth2ClientContext oAuth2ClientContext) {        super(oAuth2ClientContext, null);        HttpComponentsClientHttpRequestFactory httpComponentsClientHttpRequestFactory = new HttpComponentsClientHttpRequestFactory();        this.oAuth2ClientContext=oAuth2ClientContext;        List<AccessTokenProvider> chain = new ArrayList<>();        AuthorizationCodeAccessTokenProvider authorizationCodeAccessTokenProvider= new AuthorizationCodeAccessTokenProvider();        authorizationCodeAccessTokenProvider.setRequestFactory(httpComponentsClientHttpRequestFactory);        chain.add(authorizationCodeAccessTokenProvider);        ImplicitAccessTokenProvider implicitAccessTokenProvider = new ImplicitAccessTokenProvider();        implicitAccessTokenProvider.setRequestFactory(httpComponentsClientHttpRequestFactory);        chain.add(implicitAccessTokenProvider);        ResourceOwnerPasswordAccessTokenProvider resourceOwnerPasswordAccessTokenProvider = new ResourceOwnerPasswordAccessTokenProvider();        resourceOwnerPasswordAccessTokenProvider.setRequestFactory(httpComponentsClientHttpRequestFactory);        chain.add(resourceOwnerPasswordAccessTokenProvider);        ClientCredentialsAccessTokenProvider clientCredentialsAccessTokenProvider = new ClientCredentialsAccessTokenProvider();        clientCredentialsAccessTokenProvider.setRequestFactory(httpComponentsClientHttpRequestFactory);        chain.add(clientCredentialsAccessTokenProvider);        List<AccessTokenProvider> providers=Collections.unmodifiableList(chain);        accessTokenProvider=new AccessTokenProviderChain(providers);    }}

注册自定义的 OAuth2FeignRequestInterceptor

/** *  author chen roger */package com.springcloud.template.common.security.jwt;import com.springcloud.template.common.security.jwt.Interceptor.MyOAuth2FeignRequestInterceptor;import feign.RequestInterceptor;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;import org.springframework.security.oauth2.client.OAuth2ClientContext;@Configuration@EnableGlobalMethodSecurity(prePostEnabled = true)public class GlobalMethodSecurityConfiguration {    @Bean    public RequestInterceptor oAuth2FeignRequestInterceptor(OAuth2ClientContext oAuth2ClientContext){        return new MyOAuth2FeignRequestInterceptor(oAuth2ClientContext);    }}