Grails REST安全性-将用户id添加到令牌

我想将用户id字段添加到从/api/login返回的令牌中

目前是：

{
    "username": "user",
    "roles": [
        "ROLE_USER"
    ],
    "token_type": "Bearer",
    "access_token": "eyJhbGciOiJIUzI1NiJ9.2uk2YoHsyd7bqUdtUYN19ef..",
    "expires_in": 3600,
    "refresh_token": "eyJhbGciOiJIUzI1NiJ9.eyJwcmluY2lwYWwiOiJINH.."
}

我需要：

{
    "id": "1",
    "username": "user",
    "roles": [
        "ROLE_USER"
    ],
    "token_type": "Bearer",
    "access_token": "eyJhbGciOiJIUzI1NiJ9.2uk2YoHsyd7bqUdtUYN19ef..",
    "expires_in": 3600,
    "refresh_token": "eyJhbGciOiJIUzI1NiJ9.eyJwcmluY2lwYWwiOiJINH.."
}

目标-使用用户id进行查询，如POST/api/something 还有其他方法吗？

---

提前感谢

您没有提到Grails版本，因此我发布了我为Grails 2.4.4实现的答案

在src/groovy下创建的自定义类中实现AccessTokenJsonRenderer接口需要做的第一件事如下

import grails.plugin.springsecurity.SpringSecurityUtils
import grails.plugin.springsecurity.rest.token.AccessToken
import grails.plugin.springsecurity.rest.token.rendering.AccessTokenJsonRenderer
import groovy.json.JsonBuilder
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.security.core.GrantedAuthority

/**
 * Created by Prakash Thete on 17/04/2018
 */
class CustomAppRestAuthTokenJsonRenderer implements AccessTokenJsonRenderer  {

    @Override
    String generateJson(AccessToken accessToken){

        // Add extra custom parameters if you want in this map to be rendered in login response
        Map response = [
                id           : accessToken.principal.id,
                username     : accessToken.principal.username,
                access_token : accessToken.accessToken,
                token_type   : "Bearer",
                refresh_token: accessToken.refreshToken,
                roles        : accessToken.authorities.collect { GrantedAuthority role -> role.authority }
        ]

        return new JsonBuilder( response ).toPrettyString()
    }
}

在resources.groovy中创建自定义类bean需要做的第二件事，如下所示

// For overriding the token json renderer
accessTokenJsonRenderer(CustomAppRestAuthTokenJsonRenderer)

现在，点击api/登录后，您将收到用户id以及其他详细信息

---

希望这有帮助

您没有提到Grails版本，因此我发布了我为Grails 2.4.4实现的答案

在src/groovy下创建的自定义类中实现AccessTokenJsonRenderer接口需要做的第一件事如下

import grails.plugin.springsecurity.SpringSecurityUtils
import grails.plugin.springsecurity.rest.token.AccessToken
import grails.plugin.springsecurity.rest.token.rendering.AccessTokenJsonRenderer
import groovy.json.JsonBuilder
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.security.core.GrantedAuthority

/**
 * Created by Prakash Thete on 17/04/2018
 */
class CustomAppRestAuthTokenJsonRenderer implements AccessTokenJsonRenderer  {

    @Override
    String generateJson(AccessToken accessToken){

        // Add extra custom parameters if you want in this map to be rendered in login response
        Map response = [
                id           : accessToken.principal.id,
                username     : accessToken.principal.username,
                access_token : accessToken.accessToken,
                token_type   : "Bearer",
                refresh_token: accessToken.refreshToken,
                roles        : accessToken.authorities.collect { GrantedAuthority role -> role.authority }
        ]

        return new JsonBuilder( response ).toPrettyString()
    }
}

在resources.groovy中创建自定义类bean需要做的第二件事，如下所示

// For overriding the token json renderer
accessTokenJsonRenderer(CustomAppRestAuthTokenJsonRenderer)

现在，点击api/登录后，您将收到用户id以及其他详细信息

---

希望这有帮助

如果您想在Auth-JSON响应中添加关于用户的更多详细信息，您可以使用主体ID和用户查询，如下所示

注意添加了@Transactional注释

import grails.gorm.transactions.Transactional
import grails.plugin.springsecurity.rest.token.AccessToken
import grails.plugin.springsecurity.rest.token.rendering.AccessTokenJsonRenderer
import groovy.json.JsonBuilder
import org.springframework.security.core.GrantedAuthority


@Transactional
class CustomAuthTokenRenderer implements AccessTokenJsonRenderer {


    @Override
    String generateJson(AccessToken accessToken) {

        // User the principal ID to get an instance of the user from the database
        User user = User.get accessToken.principal.id as Long

        // Add extra custom parameters if you want in this map to be rendered in login response

        Map res = [
                id               : user.id,
                username         : user.username,
                firstName        : user.firstName,
                lastName         : user.lastName,
                profilePicture   : user.profilePicture,
                dateOfBirth      : user.dob,
                expiration       : accessToken.expiration,
                access_token     : accessToken.accessToken,
                token_type       : "Bearer",
                refresh_token    : accessToken.refreshToken,
                roles            : accessToken.authorities.collect { GrantedAuthority role -> role.authority },
                friends: user.friends.collect { Friend friend ->
                    [
                            id          : friend.id,
                            firstName   : friend.firstName,
                            dateCreated : friend.dateCreated,
                            lastUpdated : friend.lastUpdated,
                    ]
                }
        ]

        return new JsonBuilder(res).toPrettyString()
    }
}

---

您想向响应中添加什么并不重要，通过用户对象，您几乎可以添加任何内容。只是不要尝试进行太多的查询，因为这将导致非常缓慢的登录过程。

如果您想在Auth JSON响应中添加关于用户的更多详细信息，您可以使用主体ID和用户查询，如下所示

注意添加了@Transactional注释

import grails.gorm.transactions.Transactional
import grails.plugin.springsecurity.rest.token.AccessToken
import grails.plugin.springsecurity.rest.token.rendering.AccessTokenJsonRenderer
import groovy.json.JsonBuilder
import org.springframework.security.core.GrantedAuthority


@Transactional
class CustomAuthTokenRenderer implements AccessTokenJsonRenderer {


    @Override
    String generateJson(AccessToken accessToken) {

        // User the principal ID to get an instance of the user from the database
        User user = User.get accessToken.principal.id as Long

        // Add extra custom parameters if you want in this map to be rendered in login response

        Map res = [
                id               : user.id,
                username         : user.username,
                firstName        : user.firstName,
                lastName         : user.lastName,
                profilePicture   : user.profilePicture,
                dateOfBirth      : user.dob,
                expiration       : accessToken.expiration,
                access_token     : accessToken.accessToken,
                token_type       : "Bearer",
                refresh_token    : accessToken.refreshToken,
                roles            : accessToken.authorities.collect { GrantedAuthority role -> role.authority },
                friends: user.friends.collect { Friend friend ->
                    [
                            id          : friend.id,
                            firstName   : friend.firstName,
                            dateCreated : friend.dateCreated,
                            lastUpdated : friend.lastUpdated,
                    ]
                }
        ]

        return new JsonBuilder(res).toPrettyString()
    }
}

您想向响应中添加什么并不重要，通过用户对象，您几乎可以添加任何内容。只是不要尝试进行太多的查询，因为这将导致非常缓慢的登录过程