首页/文章/ 技术

ThingsBoard 源码中的 OAuth2 登录实现

技术 4 分钟阅读

Thingsboard 启用 OAuth2 功能

使用 sysadmin@thingsboard.org / sysadmin 账号登录 Thingsboard 系统之后，在安全 -> OAuth2.0 页面，点击OAuth2.0客户端，先创建一个客户端，这里我创建的是 Github 客户端。

create-oauth2-client-in-thingsboard

然后，创建一个域：

create-domain-in-thingsboard

域名的名称可以是 ip 加端口，也可以是域名，如果是名称，需要做好 DNS 解析。

注意：

这里的重定向 URL 模版是 localhost:8080/login/oauth2/code/，而不是 localhost:8080/login/oauth2/code/{registrationId}。

注销登录之后，在登录页面可以看到 使用 Github 登录的按钮。

login-github-page-in-thingsboard

源码实现

Thingsboard OAuth2 的相关配置在 ThingsboardSecurityConfiguration 类的 filterChain(HttpSecurity http) 方法中。

    if (oauth2Configuration != null) {
            http.oauth2Login(login -> login
                    .authorizationEndpoint(config -> config
                            .authorizationRequestRepository(httpCookieOAuth2AuthorizationRequestRepository)
                            .authorizationRequestResolver(oAuth2AuthorizationRequestResolver))
                    .loginPage("/oauth2Login")
                    .loginProcessingUrl(oauth2Configuration.getLoginProcessingUrl())
                    .successHandler(oauth2AuthenticationSuccessHandler)
                    .failureHandler(oauth2AuthenticationFailureHandler));
        }

以上代码对 OAuth2 Login 配置了 5 ：

  • loginProcessingUrl：处理登录请求的地址，默认值为 “/login/oauth2/code/*“，该地址由 OAuth2LoginAuthenticationFilter 过滤器使用正则表达式进行批判和处理。

  • loginPage：登录页面地址。

  • httpCookieOAuth2AuthorizationRequestRepository：持久化 OAuth2AuthorizationRequest，默认是使用 Seesion 持久化，对应实现类是 HttpSessionOAuth2AuthorizationRequestRepository。Thingsboard 提供了 HttpCookieOAuth2AuthorizationRequestRepository 使用 Cookie 来持久化 。

  • oAuth2AuthorizationRequestResolver：从 Request 中解析 OAuth2AuthorizationRequest，默认实现是 DefaultOAuth2AuthorizationRequestResolver。Thingsboard 使用 CustomOAuth2AuthorizationRequestResolver 重写了该类。

  • oauth2AuthenticationSuccessHandler：登录成功处理器

  • oauth2AuthenticationFailureHandler：登录失败处理器

OAuth2Configuration 类上也 @Configuration 注解，在应用启动过程中会由 SpringBoot 自动装配。

@Configuration
@ConfigurationProperties(prefix = "security.oauth2")
@Data
public class OAuth2Configuration {
    private String loginProcessingUrl;
    private Map<String, String> githubMapper;
}

其默认值在 thingsboard.yml：

# Security parameters
security:
  oauth2:
    # Redirect URL where access code from external user management system will be processed
    loginProcessingUrl: "${SECURITY_OAUTH2_LOGIN_PROCESSING_URL://login/oauth2/code/}"
    githubMapper:
      # The email addresses that will be mapped from the URL
      emailUrl: "${SECURITY_OAUTH2_GITHUB_MAPPER_EMAIL_URL_KEY:https://api.github.com/user/emails}"

CustomOAuth2AuthorizationRequestResolver 相对于默认实现 DefaultOAuth2AuthorizationRequestResolver 的主要修改之处在于代expandRedirectUri 方法：

  private String expandRedirectUri(HttpServletRequest request, ClientRegistration clientRegistration, String action) {
        //.....


        String redirectUri = getRedirectUri(request);
        log.trace("Redirect URI - {}.", redirectUri);


        return UriComponentsBuilder.fromUriString(redirectUri)
                .buildAndExpand(uriVariables)
                .toUriString();
    }

DefaultOAuth2AuthorizationRequestResolver 中获取的重定向地址为 ClientRegistration 中的 redirectUri 值（localhost:8080/login/oauth2/code/{registrationId}），而 CustomOAuth2AuthorizationRequestResolver 将其修改为了

localhost:8080/login/oauth2/code/。

通过调试代码，可以发现 OAuth2LoginAuthenticationFilter、CustomOAuth2AuthorizationRequestResolver、HttpCookieOAuth2AuthorizationRequestRepository 调用顺序如下：

OAuth2AuthorizationRequestRedirectFilter
  -> CustomOAuth2AuthorizationRequestResolver
    -> OAuth2LoginAuthenticationFilter
     -> HttpCookieOAuth2AuthorizationRequestRepository

这里涉及到 OAuth2 的过滤器调用顺序，在 ThingsboardSecurityConfiguration 类的 @EnableWebSecurity 注解上添加 (debug = true)打开调试模式，重新启动应用，或者观察日志输出。

Securing GET /oauth2/authorization/c9494410-420f-11f0-951d-e335fb26d32c
Invoking DisableEncodeUrlFilter (1/20)
Invoking WebAsyncManagerIntegrationFilter (2/20)
Invoking SecurityContextHolderFilter (3/20)
Invoking CorsFilter (4/20)
Invoking LogoutFilter (5/20)
Invoking OAuth2AuthorizationRequestRedirectFilter (6/20)
Securing GET /login/oauth2/code?code=dbf3e2bb44683ffd2d2f&state=azMRmzAZY_qd5owaQmxekq_YNcvM80yqsQZrCweAaN4%3D
Invoking DisableEncodeUrlFilter (1/20)
Invoking WebAsyncManagerIntegrationFilter (2/20)
Invoking SecurityContextHolderFilter (3/20)
Invoking CorsFilter (4/20)
Invoking LogoutFilter (5/20)
Invoking OAuth2AuthorizationRequestRedirectFilter (6/20)
Invoking OAuth2LoginAuthenticationFilter (7/20)
Invoking AuthExceptionHandler (8/20)
Invoking RestLoginProcessingFilter (9/20)
Invoking RestPublicLoginProcessingFilter (10/20)
Invoking JwtTokenAuthenticationProcessingFilter (11/20)
Invoking RefreshTokenProcessingFilter (12/20)
Invoking PayloadSizeFilter (13/20)
Invoking RateLimitProcessingFilter (14/20)
Invoking RequestCacheAwareFilter (15/20)
Invoking SecurityContextHolderAwareRequestFilter (16/20)
Invoking AnonymousAuthenticationFilter (17/20)
Invoking SessionManagementFilter (18/20)
Invoking ExceptionTranslationFilter (19/20)
Invoking AuthorizationFilter (20/20)

在登录页面，点击 github 登录按钮，访问的是 /oauth2/authorization/c9494410-420f-11f0-951d-e335fb26d32c 请求，该请求经过一系列的过滤器，其中 OAuth2AuthorizationRequestRedirectFilter 过滤器会对用 authorizationRequestResolver 生成 OAuth2AuthorizationRequest 对象，让后进行重定向。

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
       throws ServletException, IOException {
    try {
       OAuth2AuthorizationRequest authorizationRequest = this.authorizationRequestResolver.resolve(request);
       if (authorizationRequest != null) {
          this.sendRedirectForAuthorization(request, response, authorizationRequest);
          return;
       }
    }
    catch (Exception ex) {
       AuthenticationException wrappedException = new OAuth2AuthorizationRequestException(ex);
       this.authenticationFailureHandler.onAuthenticationFailure(request, response, wrappedException);
       return;
    }


}

CustomOAuth2AuthorizationRequestResolver 解析出来的重定向的地址为 /login/oauth2/code?code=dbf3e2bb44683ffd2d2f&state=azMRmzAZY_qd5owaQmxekq_YNcvM80yqsQZrCweAaN4%3D，然后该请求又经过一系列的过滤器，直到遇到 OAuth2LoginAuthenticationFilter ，OAuth2LoginAuthenticationFilter 拿到拼装后的 github 授权地址 https://github.com/login/oauth/authorize?response_type=code&client_id=Ov23likOi21AwqpT9WUP&scope=read:user%20user:email&state=5wYRD23XSe4xSqV-Qfp3phlhxfMrA4cnF_sTh8IkjTs%3D&redirect_uri=http://localhost:8080/login/oauth2/code/c9494410-420f-11f0-951d-e335fb26d32c ，调用 authenticationManager 进行认证。

 / OAuth2LoginAuthenticationFilter 的 attemptAuthentication 方法代码片段
 String redirectUri = UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
    .replaceQuery(null)
    .build()
    .toUriString();
  / @formatter:on
  OAuth2AuthorizationResponse authorizationResponse = OAuth2AuthorizationResponseUtils.convert(params,
    redirectUri);
  Object authenticationDetails = this.authenticationDetailsSource.buildDetails(request);
  OAuth2LoginAuthenticationToken authenticationRequest = new OAuth2LoginAuthenticationToken(clientRegistration,
    new OAuth2AuthorizationExchange(authorizationRequest, authorizationResponse));
  authenticationRequest.setDetails(authenticationDetails);
  OAuth2LoginAuthenticationToken authenticationResult = (OAuth2LoginAuthenticationToken) this
   .getAuthenticationManager()
   .authenticate(authenticationRequest);

OAuth2AuthorizationRequestRedirectFilter 和 OAuth2LoginAuthenticationFilter 之间的联系就在于 loginProcessingUrl 。不管 loginProcessingUrl 长成什么样，OAuth2LoginAuthenticationFilter 都能通过 requiresAuthenticationRequestMatcher 匹配到地址并进行处理。

因此，将 thingsboard.yml 中的 loginProcessingUrl 修改为 /login/oauth2/code/{registrationId}，应用也能正常启动。

# Security parameters
security:
  oauth2:
    # Redirect URL where access code from external user management system will be processed
    loginProcessingUrl: "${SECURITY_OAUTH2_LOGIN_PROCESSING_URL://login/oauth2/code/{registrationId}}"

OAuth2LoginAuthenticationFilter 通过 AuthorizationRequestRepository 可以取到 OAuth2AuthorizationRequest 对象，通过 authorizationRequest 的参数可以获取到 registrationId，然后，通过 clientRegistrationRepository 可以查询到 ClientRegistration 对象。

@Override
 public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
   throws AuthenticationException {
  MultiValueMap<String, String> params = OAuth2AuthorizationResponseUtils.toMultiMap(request.getParameterMap());
  if (!OAuth2AuthorizationResponseUtils.isAuthorizationResponse(params)) {
   OAuth2Error oauth2Error = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST);
   throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
  }
  OAuth2AuthorizationRequest authorizationRequest = this.authorizationRequestRepository
   .removeAuthorizationRequest(request, response);
  if (authorizationRequest == null) {
   OAuth2Error oauth2Error = new OAuth2Error(AUTHORIZATION_REQUEST_NOT_FOUND_ERROR_CODE);
   throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
  }
  String registrationId = authorizationRequest.getAttribute(OAuth2ParameterNames.REGISTRATION_ID);
  ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId(registrationId);
    /....
}

在 thingsboard 中 clientRegistrationRepository 的实现者是 HybridClientRegistrationRepository，当然，默认实现是 InMemoryClientRegistrationRepository。InMemoryClientRegistrationRepository 是从 spring boot 配置文件中读取，例如：下面的配置定义了三个 ClientRegistration 对象，他们的 registrationId 分别是 google、github、okta，而不是 thingsboard 中自定义的 UUID 字符串。

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: your-app-client-id
            client-secret: your-app-client-secret
            scope:
              - email
              - profile
          github:
            client-id: ${GITHUB_CLIENT_ID:Ov23likOi21AwqpT9WUP}
            client-secret: ${GITHUB_CLIENT_SECRET:2cd0d78fe7a1c34add13c3452fd94c75db70995f}
            scope:
              - user:email
              - read:user
          okta:
            client-id: your-app-client-id
            client-secret: your-app-client-secret
        provider:
          google:
            user-name-attribute: email
          github:
            user-name-attribute: login
          okta:
            authorization-uri: https://your-subdomain.oktapreview.com/oauth2/v1/authorize
            token-uri: https://your-subdomain.oktapreview.com/oauth2/v1/token
            user-info-uri: https://your-subdomain.oktapreview.com/oauth2/v1/userinfo
            jwk-set-uri: https://your-subdomain.oktapreview.com/oauth2/v1/keys

假如修改下 thingsboard 源码，将 registrationId 改为使用认证提供商的名称（小写形式），则和配置文件中一样了。

再来看 HybridClientRegistrationRepository 的实现。

@Component
public class HybridClientRegistrationRepository implements ClientRegistrationRepository {
    private static final String defaultRedirectUriTemplate = "{baseUrl}/login/oauth2/code/{registrationId}";


    @Autowired
    private OAuth2ClientService oAuth2ClientService;


    @Override
    public ClientRegistration findByRegistrationId(String registrationId) {
        OAuth2Client oAuth2Client = oAuth2ClientService.findOAuth2ClientById(TenantId.SYS_TENANT_ID, new OAuth2ClientId(UUID.fromString(registrationId)));
        return oAuth2Client == null ?
                null : toSpringClientRegistration(oAuth2Client);
    }


    private ClientRegistration toSpringClientRegistration(OAuth2Client oAuth2Client){
     //...
    }
}

HybridClientRegistrationRepository 内部使用 OAuth2ClientService 来获取 OAuth2Client 再转换为 ClientRegistration。因此，可以使用编程的方式来动态维护 ClientRegistration 了。

在 thingsboard 中，OAuth2Client 主要字段如下：

@Data
public class OAuth2Client {
    private UUID tenantId;
    private String title;
    private String clientId;
    private String clientSecret;
    private OAuth2MapperConfig mapperConfig;
    private String authorizationUri;
    private String tokenUri;
    private String scope;
    private String platforms;
    private String userInfoUri;
    private String userNameAttributeName;
    private String jwkSetUri;
    private String clientAuthenticationMethod;
    private String loginButtonLabel;
    private String loginButtonIcon;
    private Boolean activateUser;
    private MapperType type;
    private String emailAttributeKey;
    private String firstNameAttributeKey;
    private String lastNameAttributeKey;
    private TenantNameStrategyType tenantNameStrategy;
    private String tenantNamePattern;
    private String customerNamePattern;
    private String url;
    private String username;
    private String password;
    private Boolean sendToken;
    private JsonNode additionalInfo;
}

OAuth2MapperConfig 是映射配置：

@Data
public class OAuth2MapperConfig {
    private boolean allowUserCreation;
    private boolean activateUser;
    private MapperType type;
    private OAuth2BasicMapperConfig basic;
    private OAuth2CustomMapperConfig custom;
}


public enum MapperType {
    BASIC, CUSTOM, GITHUB, APPLE;
}

映射类型有四种： BASIC, CUSTOM, GITHUB, APPLE，在创建 OAuth2Client 对象时，thingsboard 针对这四种类型做了一个模版 OAuth2ClientRegistrationTemplate，用于简化和统一创建流程。

OAuth2ClientRegistrationTemplate 类主要字段：

@Data
public class OAuth2ClientRegistrationTemplate {
    private String providerId;
    private String authorizationUri;
    private String tokenUri;
    private String scope;
    private String userInfoUri;
    private String userNameAttributeName;
    private String jwkSetUri;
    private String clientAuthenticationMethod;
    private MapperType type;
    private String emailAttributeKey;
    private String firstNameAttributeKey;
    private String lastNameAttributeKey;
    private TenantNameStrategyType tenantNameStrategy;
    private String tenantNamePattern;
    private String customerNamePattern;
    private String comment;
    private String loginButtonIcon;
    private String loginButtonLabel;
    private String helpLink;


    private JsonNode additionalInfo;
}

另外，thingsboar 在安装部署时进行了初始化，提前创建了一些模版。模版在 application/src/main/data/json/system/ oauth2_config_templates 目录下面，主要有 apple、facebook、google、github。

apple_config.json

{
  "providerId": "Apple",
  "additionalInfo": null,
  "accessTokenUri": "https://appleid.apple.com/auth/token",
  "authorizationUri": "https://appleid.apple.com/auth/authorize?response_mode=form_post",
  "scope": ["email","openid","name"],
  "jwkSetUri": "https://appleid.apple.com/auth/keys",
  "userInfoUri": null,
  "clientAuthenticationMethod": "POST",
  "userNameAttributeName": "email",
  "mapperConfig": {
    "type": "APPLE",
    "basic": {
      "emailAttributeKey": "email",
      "firstNameAttributeKey": "firstName",
      "lastNameAttributeKey": "lastName",
      "tenantNameStrategy": "DOMAIN"
    }
  },
  "comment": null,
  "loginButtonIcon": "apple-logo",
  "loginButtonLabel": "Apple",
  "helpLink": "https://developer.apple.com/sign-in-with-apple/get-started/"
}

facebook_config.json：

{
  "providerId": "Facebook",
  "accessTokenUri": "https://graph.facebook.com/v2.8/oauth/access_token",
  "authorizationUri": "https://www.facebook.com/v2.8/dialog/oauth",
  "scope": ["email","public_profile"],
  "jwkSetUri": null,
  "userInfoUri": "https://graph.facebook.com/me?fields=id,name,first_name,last_name,email",
  "clientAuthenticationMethod": "BASIC",
  "userNameAttributeName": "email",
  "mapperConfig": {
    "type": "BASIC",
    "basic": {
      "emailAttributeKey": "email",
      "firstNameAttributeKey": "first_name",
      "lastNameAttributeKey": "last_name",
      "tenantNameStrategy": "DOMAIN"
    }
  },
  "comment": null,
  "loginButtonIcon": "facebook-logo",
  "loginButtonLabel": "Facebook",
  "helpLink": "https://developers.facebook.com/docs/facebook-login/web#logindialog"
}

github_config.json：

{
  "providerId": "Github",
  "accessTokenUri": "https://github.com/login/oauth/access_token",
  "authorizationUri": "https://github.com/login/oauth/authorize",
  "scope": ["read:user","user:email"],
  "jwkSetUri": null,
  "userInfoUri": "https://api.github.com/user",
  "clientAuthenticationMethod": "BASIC",
  "userNameAttributeName": "login",
  "mapperConfig": {
    "type": "GITHUB",
    "basic": {
      "firstNameAttributeKey": "name",
      "tenantNameStrategy": "DOMAIN"
    }
  },
  "comment": "In order to log into ThingsBoard you need to have user's email. You may configure and use Custom OAuth2 Mapper to get email information. Please refer to <a href=\"https://docs.github.com/en/rest/reference/users#list-email-addresses-for-the-authenticated-user\">Github Documentation</a>",
  "loginButtonIcon": "github-logo",
  "loginButtonLabel": "Github",
  "helpLink": "https://docs.github.com/en/developers/apps/creating-an-oauth-app"
}

google_config.json：

{
  "providerId": "Google",
  "additionalInfo": null,
  "accessTokenUri": "https://oauth2.googleapis.com/token",
  "authorizationUri": "https://accounts.google.com/o/oauth2/v2/auth",
  "scope": ["email","openid","profile"],
  "jwkSetUri": "https://www.googleapis.com/oauth2/v3/certs",
  "userInfoUri": "https://openidconnect.googleapis.com/v1/userinfo",
  "clientAuthenticationMethod": "BASIC",
  "userNameAttributeName": "email",
  "mapperConfig": {
    "type": "BASIC",
    "basic": {
      "emailAttributeKey": "email",
      "firstNameAttributeKey": "given_name",
      "lastNameAttributeKey": "family_name",
      "tenantNameStrategy": "DOMAIN"
    }
  },
  "comment": null,
  "loginButtonIcon": "google-logo",
  "loginButtonLabel": "Google",
  "helpLink": "https://developers.google.com/adwords/api/docs/guides/authentication"
}

登录成功之后，由 oauth2AuthenticationSuccessHandler 进行处理，对应的实现类是 Oauth2AuthenticationSuccessHandler，该类的逻辑：

  • 通过 httpCookieOAuth2AuthorizationRequestRepository 获取 OAuth2AuthorizationRequest
  • 通过 OAuth2ClientService 获取 OAuth2Client
  • 通过 oAuth2AuthorizedClientService 加载 OAuth2AuthorizedClient
  • 通过 oauth2ClientMapperProvider 获取 OAuth2ClientMapper ，每个 MapperType 都有一个 OAuth2ClientMapper
  • 通过 tokenFactory 创建 JwtPair
  • 重定向到登录成功地址

OAuth2ClientMapper 定义如下，作用是将 OAuth2 返回的用户信息转换为 SecurityUser 对象。

public interface OAuth2ClientMapper {
    SecurityUser getOrCreateUserByClientPrincipal(HttpServletRequest request, OAuth2AuthenticationToken token, String providerAccessToken, OAuth2Client oAuth2Client);
}

SecurityUser 集成 User 对象：

OAuth2ClientMapperProvider 类主要方法：

  public OAuth2ClientMapper getOAuth2ClientMapperByType(MapperType oauth2MapperType) {
        switch (oauth2MapperType) {
            case CUSTOM:
                return customOAuth2ClientMapper;
            case BASIC:
                return basicOAuth2ClientMapper;
            case GITHUB:
                return githubOAuth2ClientMapper;
            case APPLE:
                return appleOAuth2ClientMapper;
            default:
                throw new RuntimeException("OAuth2ClientRegistrationMapper with type " + oauth2MapperType + " is not supported!");
        }
    }

User 对象主要定义了 email、firstName、lastName、phone，其他用户信息在 additionalInfo 对象中：

@Data
public class User {
    private String email;
    /    private String authority;
    private String firstName;
    private String lastName;
    private String phone;
    private transient JsonNode additionalInfo;
}

对应 github ，OAuth2Configuration 单独定义了 email 的获取地址：

public class GithubOAuth2ClientMapper extends AbstractOAuth2ClientMapper implements OAuth2ClientMapper {
    private static final String EMAIL_URL_KEY = "emailUrl";
    private static final String AUTHORIZATION = "Authorization";
    private RestTemplateBuilder restTemplateBuilder = new RestTemplateBuilder();
    @Autowired
    private OAuth2Configuration oAuth2Configuration;


    @Override
    public SecurityUser getOrCreateUserByClientPrincipal(HttpServletRequest request, OAuth2AuthenticationToken token, String providerAccessToken, OAuth2Client oAuth2Client) {
        OAuth2MapperConfig config = oAuth2Client.getMapperConfig();
        Map<String, String> githubMapperConfig = oAuth2Configuration.getGithubMapper();
        String email = getEmail(githubMapperConfig.get(EMAIL_URL_KEY), providerAccessToken);
        Map<String, Object> attributes = token.getPrincipal().getAttributes();
        OAuth2User oAuth2User = BasicMapperUtils.getOAuth2User(email, attributes, config);
        return getOrCreateSecurityUserFromOAuth2User(oAuth2User, oAuth2Client);
    }


    private synchronized String getEmail(String emailUrl, String oauth2Token) {
        restTemplateBuilder = restTemplateBuilder.defaultHeader(AUTHORIZATION, "token " + oauth2Token);


        RestTemplate restTemplate = restTemplateBuilder.build();
        GithubEmailsResponse githubEmailsResponse;
        try {
            githubEmailsResponse = restTemplate.getForEntity(emailUrl, GithubEmailsResponse.class).getBody();
            if (githubEmailsResponse == null){
                throw new RuntimeException("Empty Github response!");
            }
        } catch (Exception e) {
            log.error("There was an error during connection to Github API", e);
            throw new RuntimeException("Unable to login. Please contact your Administrator!");
        }
        Optional<String> emailOpt = githubEmailsResponse.stream()
                .filter(GithubEmailResponse::isPrimary)
                .map(GithubEmailResponse::getEmail)
                .findAny();
        if (emailOpt.isPresent()){
            return emailOpt.get();
        } else {
            log.error("Could not find primary email from {}.", githubEmailsResponse);
            throw new RuntimeException("Unable to login. Please contact your Administrator!");
        }
    }
    private static class GithubEmailsResponse extends ArrayList<GithubEmailResponse> {}


    @Data
    @ToString
    private static class GithubEmailResponse {
        private String email;
        private boolean verified;
        private boolean primary;
        private String visibility;
    }
}

另外，对应登录失败，Oauth2AuthenticationFailureHandler 也有相应的处理。Oauth2AuthenticationFailureHandler 依赖 HttpCookieOAuth2AuthorizationRequestRepository，会删除 OAuth2AuthorizationRequest ，然后进行重定向到登录页面。

订阅文章

订阅更新，不错过后续文章

直接通过 RSS 和 Telegram 订阅本站更新。

订阅 RSS关注 Telegram

分享文章

如果这篇有帮助，可以顺手转发

直接分享给同事、朋友，或者发到你的社交平台。

分享到 X 分享到 Telegram 邮件分享

相关文章

技术

ThingsBoard 接口设计整理

系统整理 ThingsBoard 平台的 REST、MQTT、HTTP 等协议接口设计，适合作为 IoT 平台开发与对接时的参考资料。

技术

ThingsBoard HTTP Transport 实现方式

系统梳理 ThingsBoard 平台 HTTP 设备接入的实现方式，重点分析 HTTP 自动注册机制、调用链与消息流转过程。

技术

ThingsBoard 源码中的代码片段整理

记录 ThingsBoard 源码阅读过程中遇到的一些关键代码片段与实现细节，作为后续分析和查阅的笔记整理。

技术

ThingsBoard 源码中的安全配置与 Security 模块

结合 ThingsBoard 源码与后台界面，整理平台中的安全相关配置、菜单项和核心 Security 模块，帮助理解其安全设计。

技术

ThingsBoard 源码中的 GitHub Actions

梳理 ThingsBoard 仓库中 GitHub Actions 的工作流文件，了解其配置校验、许可证处理等自动化流程。

技术

ThingsBoard 源码编译与 IDEA 运行

记录 ThingsBoard 源码的编译过程，以及如何在 IDEA 中导入、启动和调试项目，适合作为本地源码环境搭建参考。