操作方法：实现多租户 (How-to: Implement Multitenancy) _ Spring Authorization Server 1.3.2-SNAPSHOT 中文文档(官方文档中文翻译) —

此版本仍在开发中，尚未被视为稳定版本。对于最新的稳定版本，请使用 Spring Authorization Server 1.3.1！Spring中文文档

本指南介绍如何自定义 Spring Authorization Server，以便在多租户托管配置中支持每个主机的多个颁发者。本指南的目的是演示为 Spring 授权服务器构建支持多租户的组件的一般模式，该模式也可以应用于其他组件以满足您的需求。Spring中文文档

定义租户标识符

OpenID Connect 1.0 提供程序配置端点和 OAuth2 授权服务器元数据端点允许在颁发者标识符值中使用路径组件，从而有效地支持每个主机的多个颁发者。Spring中文文档

例如，OpenID 提供程序配置请求“http://localhost:9000/issuer1/.well-known/openid-configuration”或授权服务器元数据请求“http://localhost:9000/.well-known/oauth-authorization-server/issuer1”将返回以下配置元数据：Spring中文文档

{
  "issuer": "http://localhost:9000/issuer1",
  "authorization_endpoint": "http://localhost:9000/issuer1/oauth2/authorize",
  "token_endpoint": "http://localhost:9000/issuer1/oauth2/token",
  "jwks_uri": "http://localhost:9000/issuer1/oauth2/jwks",
  "revocation_endpoint": "http://localhost:9000/issuer1/oauth2/revoke",
  "introspection_endpoint": "http://localhost:9000/issuer1/oauth2/introspect",
  ...
}

协议终结点的基 URL 是颁发者标识符值。

从本质上讲，具有路径组件的颁发者标识符表示“租户标识符”。Spring中文文档

协议终结点的基 URL 是颁发者标识符值。

启用多个颁发者

默认情况下，对每个主机使用多个颁发者的支持处于禁用状态。若要启用，请添加以下配置：Spring中文文档

AuthorizationServerSettingsConfig

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;

@Configuration(proxyBeanMethods = false)
public class AuthorizationServerSettingsConfig {

	@Bean
	public AuthorizationServerSettings authorizationServerSettings() {
		return AuthorizationServerSettings.builder()
				.multipleIssuersAllowed(true)	(1)
				.build();
	}

}

1	设置为允许每个主机使用多个颁发者。`true`

1	设置为允许每个主机使用多个颁发者。`true`

创建组件注册表

我们首先构建一个简单的注册表，用于管理每个租户的具体组件。注册表包含使用颁发者标识符值检索特定类的具体实现的逻辑。Spring中文文档

我们将在下面的每个委托实现中使用以下类：Spring中文文档

TenantPerIssuerComponentRegistry

import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;

import org.springframework.lang.Nullable;
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContext;
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.util.Assert;

@Component
public class TenantPerIssuerComponentRegistry {
	private final ConcurrentMap<String, Map<Class<?>, Object>> registry = new ConcurrentHashMap<>();

	public <T> void register(String tenantId, Class<T> componentClass, T component) {	(1)
		Assert.hasText(tenantId, "tenantId cannot be empty");
		Assert.notNull(componentClass, "componentClass cannot be null");
		Assert.notNull(component, "component cannot be null");
		Map<Class<?>, Object> components = this.registry.computeIfAbsent(tenantId, (key) -> new ConcurrentHashMap<>());
		components.put(componentClass, component);
	}

	@Nullable
	public <T> T get(Class<T> componentClass) {
		AuthorizationServerContext context = AuthorizationServerContextHolder.getContext();
		if (context == null || context.getIssuer() == null) {
			return null;
		}
		for (Map.Entry<String, Map<Class<?>, Object>> entry : this.registry.entrySet()) {
			if (context.getIssuer().endsWith(entry.getKey())) {
				return componentClass.cast(entry.getValue().get(componentClass));
			}
		}
		return null;
	}
}

1	组件注册隐式启用可使用的已批准颁发者的允许列表。

此注册表旨在允许在启动时轻松注册组件以支持静态添加租户，但也支持在运行时动态添加租户。

1	组件注册隐式启用可使用的已批准颁发者的允许列表。

此注册表旨在允许在启动时轻松注册组件以支持静态添加租户，但也支持在运行时动态添加租户。

创建多租户组件

需要多租户功能的组件包括：Spring中文文档

对于这些组件中的每一个，都可以提供一个组合的实现，该实现委托给与“请求的”颁发者标识符关联的具体组件。Spring中文文档

让我们逐步完成如何自定义 Spring Authorization Server 以支持每个支持多租户的组件的 2x 个租户的场景。Spring中文文档

多租户 RegisteredClientRepository

下面的示例显示了由 2 个实例组成的 RegisteredClientRepository 的示例实现，其中每个实例都映射到颁发者标识符：JdbcRegisteredClientRepositorySpring中文文档

RegisteredClientRepositoryConfig

import java.util.UUID;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
import org.springframework.util.Assert;

@Configuration(proxyBeanMethods = false)
public class RegisteredClientRepositoryConfig {

	@Bean
	public RegisteredClientRepository registeredClientRepository(
			@Qualifier("issuer1-data-source") DataSource issuer1DataSource,
			@Qualifier("issuer2-data-source") DataSource issuer2DataSource,
			TenantPerIssuerComponentRegistry componentRegistry) {

		JdbcRegisteredClientRepository issuer1RegisteredClientRepository =
				new JdbcRegisteredClientRepository(new JdbcTemplate(issuer1DataSource));	(1)

		issuer1RegisteredClientRepository.save(
				RegisteredClient.withId(UUID.randomUUID().toString())
						.clientId("client-1")
						.clientSecret("{noop}secret")
						.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
						.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
						.scope("scope-1")
						.build()
		);

		JdbcRegisteredClientRepository issuer2RegisteredClientRepository =
				new JdbcRegisteredClientRepository(new JdbcTemplate(issuer2DataSource));	(2)

		issuer2RegisteredClientRepository.save(
				RegisteredClient.withId(UUID.randomUUID().toString())
						.clientId("client-2")
						.clientSecret("{noop}secret")
						.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
						.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
						.scope("scope-2")
						.build()
		);

		componentRegistry.register("issuer1", RegisteredClientRepository.class, issuer1RegisteredClientRepository);
		componentRegistry.register("issuer2", RegisteredClientRepository.class, issuer2RegisteredClientRepository);

		return new DelegatingRegisteredClientRepository(componentRegistry);
	}

	private static class DelegatingRegisteredClientRepository implements RegisteredClientRepository {	(3)

		private final TenantPerIssuerComponentRegistry componentRegistry;

		private DelegatingRegisteredClientRepository(TenantPerIssuerComponentRegistry componentRegistry) {
			this.componentRegistry = componentRegistry;
		}

		@Override
		public void save(RegisteredClient registeredClient) {
			getRegisteredClientRepository().save(registeredClient);
		}

		@Override
		public RegisteredClient findById(String id) {
			return getRegisteredClientRepository().findById(id);
		}

		@Override
		public RegisteredClient findByClientId(String clientId) {
			return getRegisteredClientRepository().findByClientId(clientId);
		}

		private RegisteredClientRepository getRegisteredClientRepository() {
			RegisteredClientRepository registeredClientRepository =
					this.componentRegistry.get(RegisteredClientRepository.class);	(4)
			Assert.state(registeredClientRepository != null,
					"RegisteredClientRepository not found for \"requested\" issuer identifier.");	(5)
			return registeredClientRepository;
		}

	}

}

单击上面代码示例中的“展开折叠文本”图标以显示完整示例。

1	映射到颁发者标识符并使用专用 .`JdbcRegisteredClientRepositoryissuer1DataSource`
2	映射到颁发者标识符并使用专用 .`JdbcRegisteredClientRepositoryissuer2DataSource`
3	委托给映射到“请求的”颁发者标识符的 a 的复合实现。`RegisteredClientRepositoryJdbcRegisteredClientRepository`
4	获取映射到的 “请求的”颁发者标识符。`JdbcRegisteredClientRepositoryAuthorizationServerContext.getIssuer()`
5	如果找不到，则出错，因为“请求的”颁发者标识符不在已批准的颁发者的允许列表中。`JdbcRegisteredClientRepository`

通过强制显式配置颁发者标识符强制为单租户配置。使用多租户托管配置时，请避免显式配置颁发者标识符。AuthorizationServerSettings.builder().issuer("http://localhost:9000")

在前面的示例中，每个实例都配置了和关联的。这在多租户配置中很重要，因为主要要求是能够将数据与每个租户隔离开来。JdbcRegisteredClientRepositoryJdbcTemplateDataSourceSpring中文文档

通过为每个组件实例配置专用组件，可以灵活地将数据隔离在同一数据库实例中，或者将数据完全隔离在单独的数据库实例中。DataSourceSpring中文文档

以下示例显示了支持多租户的组件使用的 2x（每个租户一个）的示例配置：DataSource@BeanSpring中文文档

数据源配置

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabase;
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder;
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType;

@Configuration(proxyBeanMethods = false)
public class DataSourceConfig {

	@Bean("issuer1-data-source")
	public EmbeddedDatabase issuer1DataSource() {
		return new EmbeddedDatabaseBuilder()
				.setName("issuer1-db")	(1)
				.setType(EmbeddedDatabaseType.H2)
				.setScriptEncoding("UTF-8")
				.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql")
				.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql")
				.addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql")
				.build();
	}

	@Bean("issuer2-data-source")
	public EmbeddedDatabase issuer2DataSource() {
		return new EmbeddedDatabaseBuilder()
				.setName("issuer2-db")	(2)
				.setType(EmbeddedDatabaseType.H2)
				.setScriptEncoding("UTF-8")
				.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql")
				.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql")
				.addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql")
				.build();
	}

}

1	使用单独的 H2 数据库实例作为名称。`issuer1-db`
2	使用单独的 H2 数据库实例作为名称。`issuer2-db`

多租户 OAuth2AuthorizationService

以下示例显示了由 2 个实例组成的 OAuth2AuthorizationService 的示例实现，其中每个实例都映射到颁发者标识符：JdbcOAuth2AuthorizationServiceSpring中文文档

OAuth2AuthorizationServiceConfig

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationService;
import org.springframework.security.oauth2.server.authorization.OAuth2Authorization;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
import org.springframework.security.oauth2.server.authorization.OAuth2TokenType;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
import org.springframework.util.Assert;

@Configuration(proxyBeanMethods = false)
public class OAuth2AuthorizationServiceConfig {

	@Bean
	public OAuth2AuthorizationService authorizationService(
			@Qualifier("issuer1-data-source") DataSource issuer1DataSource,
			@Qualifier("issuer2-data-source") DataSource issuer2DataSource,
			TenantPerIssuerComponentRegistry componentRegistry,
			RegisteredClientRepository registeredClientRepository) {

		componentRegistry.register("issuer1", OAuth2AuthorizationService.class,
				new JdbcOAuth2AuthorizationService(	(1)
						new JdbcTemplate(issuer1DataSource), registeredClientRepository));
		componentRegistry.register("issuer2", OAuth2AuthorizationService.class,
				new JdbcOAuth2AuthorizationService(	(2)
						new JdbcTemplate(issuer2DataSource), registeredClientRepository));

		return new DelegatingOAuth2AuthorizationService(componentRegistry);
	}

	private static class DelegatingOAuth2AuthorizationService implements OAuth2AuthorizationService {	(3)

		private final TenantPerIssuerComponentRegistry componentRegistry;

		private DelegatingOAuth2AuthorizationService(TenantPerIssuerComponentRegistry componentRegistry) {
			this.componentRegistry = componentRegistry;
		}

		@Override
		public void save(OAuth2Authorization authorization) {
			getAuthorizationService().save(authorization);
		}

		@Override
		public void remove(OAuth2Authorization authorization) {
			getAuthorizationService().remove(authorization);
		}

		@Override
		public OAuth2Authorization findById(String id) {
			return getAuthorizationService().findById(id);
		}

		@Override
		public OAuth2Authorization findByToken(String token, OAuth2TokenType tokenType) {
			return getAuthorizationService().findByToken(token, tokenType);
		}

		private OAuth2AuthorizationService getAuthorizationService() {
			OAuth2AuthorizationService authorizationService =
					this.componentRegistry.get(OAuth2AuthorizationService.class);	(4)
			Assert.state(authorizationService != null,
					"OAuth2AuthorizationService not found for \"requested\" issuer identifier.");	(5)
			return authorizationService;
		}

	}

}

1	映射到颁发者标识符并使用专用 .`JdbcOAuth2AuthorizationServiceissuer1DataSource`
2	映射到颁发者标识符并使用专用 .`JdbcOAuth2AuthorizationServiceissuer2DataSource`
3	委托给映射到“请求的”颁发者标识符的复合实现。`OAuth2AuthorizationServiceJdbcOAuth2AuthorizationService`
4	获取映射到的 “请求的”颁发者标识符。`JdbcOAuth2AuthorizationServiceAuthorizationServerContext.getIssuer()`
5	如果找不到，则出错，因为“请求的”颁发者标识符不在已批准的颁发者的允许列表中。`JdbcOAuth2AuthorizationService`

以下示例显示了由 2 个实例组成的 OAuth2AuthorizationConsentService 的示例实现，其中每个实例都映射到颁发者标识符：JdbcOAuth2AuthorizationConsentServiceSpring中文文档

OAuth2AuthorizationConsentServiceConfig

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationConsentService;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsent;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsentService;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
import org.springframework.util.Assert;

@Configuration(proxyBeanMethods = false)
public class OAuth2AuthorizationConsentServiceConfig {

	@Bean
	public OAuth2AuthorizationConsentService authorizationConsentService(
			@Qualifier("issuer1-data-source") DataSource issuer1DataSource,
			@Qualifier("issuer2-data-source") DataSource issuer2DataSource,
			TenantPerIssuerComponentRegistry componentRegistry,
			RegisteredClientRepository registeredClientRepository) {

		componentRegistry.register("issuer1", OAuth2AuthorizationConsentService.class,
				new JdbcOAuth2AuthorizationConsentService(	(1)
						new JdbcTemplate(issuer1DataSource), registeredClientRepository));
		componentRegistry.register("issuer2", OAuth2AuthorizationConsentService.class,
				new JdbcOAuth2AuthorizationConsentService(	(2)
						new JdbcTemplate(issuer2DataSource), registeredClientRepository));

		return new DelegatingOAuth2AuthorizationConsentService(componentRegistry);
	}

	private static class DelegatingOAuth2AuthorizationConsentService implements OAuth2AuthorizationConsentService {	(3)

		private final TenantPerIssuerComponentRegistry componentRegistry;

		private DelegatingOAuth2AuthorizationConsentService(TenantPerIssuerComponentRegistry componentRegistry) {
			this.componentRegistry = componentRegistry;
		}

		@Override
		public void save(OAuth2AuthorizationConsent authorizationConsent) {
			getAuthorizationConsentService().save(authorizationConsent);
		}

		@Override
		public void remove(OAuth2AuthorizationConsent authorizationConsent) {
			getAuthorizationConsentService().remove(authorizationConsent);
		}

		@Override
		public OAuth2AuthorizationConsent findById(String registeredClientId, String principalName) {
			return getAuthorizationConsentService().findById(registeredClientId, principalName);
		}

		private OAuth2AuthorizationConsentService getAuthorizationConsentService() {
			OAuth2AuthorizationConsentService authorizationConsentService =
					this.componentRegistry.get(OAuth2AuthorizationConsentService.class);	(4)
			Assert.state(authorizationConsentService != null,
					"OAuth2AuthorizationConsentService not found for \"requested\" issuer identifier.");	(5)
			return authorizationConsentService;
		}

	}

}

1	映射到颁发者标识符并使用专用 .`JdbcOAuth2AuthorizationConsentServiceissuer1DataSource`
2	映射到颁发者标识符并使用专用 .`JdbcOAuth2AuthorizationConsentServiceissuer2DataSource`
3	委托给映射到“请求的”颁发者标识符的复合实现。`OAuth2AuthorizationConsentServiceJdbcOAuth2AuthorizationConsentService`
4	获取映射到的 “请求的”颁发者标识符。`JdbcOAuth2AuthorizationConsentServiceAuthorizationServerContext.getIssuer()`
5	如果找不到，则出错，因为“请求的”颁发者标识符不在已批准的颁发者的允许列表中。`JdbcOAuth2AuthorizationConsentService`

多租户 JWKSource

最后，以下示例显示了由 2 个实例组成的示例实现，其中每个实例都映射到颁发者标识符：JWKSource<SecurityContext>JWKSetSpring中文文档

JWKSourceConfig

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.util.List;
import java.util.UUID;

import com.nimbusds.jose.KeySourceException;
import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSelector;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.jwk.source.JWKSource;
import com.nimbusds.jose.proc.SecurityContext;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.util.Assert;

@Configuration(proxyBeanMethods = false)
public class JWKSourceConfig {

	@Bean
	public JWKSource<SecurityContext> jwkSource(TenantPerIssuerComponentRegistry componentRegistry) {
		componentRegistry.register("issuer1", JWKSet.class, new JWKSet(generateRSAJwk()));	(1)
		componentRegistry.register("issuer2", JWKSet.class, new JWKSet(generateRSAJwk()));	(2)

		return new DelegatingJWKSource(componentRegistry);
	}

	private static RSAKey generateRSAJwk() {
		KeyPair keyPair;
		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}

		RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
		RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
		return new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();
	}

	private static class DelegatingJWKSource implements JWKSource<SecurityContext> {	(3)

		private final TenantPerIssuerComponentRegistry componentRegistry;

		private DelegatingJWKSource(TenantPerIssuerComponentRegistry componentRegistry) {
			this.componentRegistry = componentRegistry;
		}

		@Override
		public List<JWK> get(JWKSelector jwkSelector, SecurityContext context) throws KeySourceException {
			return jwkSelector.select(getJwkSet());
		}

		private JWKSet getJwkSet() {
			JWKSet jwkSet = this.componentRegistry.get(JWKSet.class);	(4)
			Assert.state(jwkSet != null, "JWKSet not found for \"requested\" issuer identifier.");	(5)
			return jwkSet;
		}

	}

}

1	映射到颁发者标识符的实例。`JWKSetissuer1`
2	映射到颁发者标识符的实例。`JWKSetissuer2`
3	一个复合实现，它使用映射到“请求的”颁发者标识符。`JWKSource<SecurityContext>JWKSet`
4	获取映射到的 “请求的”颁发者标识符。`JWKSetAuthorizationServerContext.getIssuer()`
5	如果找不到，则出错，因为“请求的”颁发者标识符不在已批准的颁发者的允许列表中。`JWKSet`

单击上面代码示例中的“展开折叠文本”图标以显示完整示例。

1	映射到颁发者标识符并使用专用 .`JdbcRegisteredClientRepositoryissuer1DataSource`
2	映射到颁发者标识符并使用专用 .`JdbcRegisteredClientRepositoryissuer2DataSource`
3	委托给映射到“请求的”颁发者标识符的 a 的复合实现。`RegisteredClientRepositoryJdbcRegisteredClientRepository`
4	获取映射到的 “请求的”颁发者标识符。`JdbcRegisteredClientRepositoryAuthorizationServerContext.getIssuer()`
5	如果找不到，则出错，因为“请求的”颁发者标识符不在已批准的颁发者的允许列表中。`JdbcRegisteredClientRepository`

1	使用单独的 H2 数据库实例作为名称。`issuer1-db`
2	使用单独的 H2 数据库实例作为名称。`issuer2-db`

1	映射到颁发者标识符并使用专用 .`JdbcOAuth2AuthorizationServiceissuer1DataSource`
2	映射到颁发者标识符并使用专用 .`JdbcOAuth2AuthorizationServiceissuer2DataSource`
3	委托给映射到“请求的”颁发者标识符的复合实现。`OAuth2AuthorizationServiceJdbcOAuth2AuthorizationService`
4	获取映射到的 “请求的”颁发者标识符。`JdbcOAuth2AuthorizationServiceAuthorizationServerContext.getIssuer()`
5	如果找不到，则出错，因为“请求的”颁发者标识符不在已批准的颁发者的允许列表中。`JdbcOAuth2AuthorizationService`

1	映射到颁发者标识符并使用专用 .`JdbcOAuth2AuthorizationConsentServiceissuer1DataSource`
2	映射到颁发者标识符并使用专用 .`JdbcOAuth2AuthorizationConsentServiceissuer2DataSource`
3	委托给映射到“请求的”颁发者标识符的复合实现。`OAuth2AuthorizationConsentServiceJdbcOAuth2AuthorizationConsentService`
4	获取映射到的 “请求的”颁发者标识符。`JdbcOAuth2AuthorizationConsentServiceAuthorizationServerContext.getIssuer()`
5	如果找不到，则出错，因为“请求的”颁发者标识符不在已批准的颁发者的允许列表中。`JdbcOAuth2AuthorizationConsentService`

1	映射到颁发者标识符的实例。`JWKSetissuer1`
2	映射到颁发者标识符的实例。`JWKSetissuer2`
3	一个复合实现，它使用映射到“请求的”颁发者标识符。`JWKSource<SecurityContext>JWKSet`
4	获取映射到的 “请求的”颁发者标识符。`JWKSetAuthorizationServerContext.getIssuer()`
5	如果找不到，则出错，因为“请求的”颁发者标识符不在已批准的颁发者的允许列表中。`JWKSet`

动态添加租户

如果租户的数量是动态的，并且可以在运行时更改，则将每个租户定义为 a 可能不可行。在这种情况下，可以在应用程序启动和/或运行时通过其他方式注册相应的组件。DataSource@BeanDataSourceSpring中文文档

以下示例显示了能够动态添加租户的 Spring：@ServiceSpring中文文档

租户服务

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.util.UUID;

import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.RSAKey;

import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabase;
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder;
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType;
import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationConsentService;
import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationService;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsentService;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
import org.springframework.stereotype.Service;

@Service
public class TenantService {

	private final TenantPerIssuerComponentRegistry componentRegistry;

	public TenantService(TenantPerIssuerComponentRegistry componentRegistry) {
		this.componentRegistry = componentRegistry;
	}

	public void createTenant(String tenantId) {
		EmbeddedDatabase dataSource = createDataSource(tenantId);
		JdbcTemplate jdbcOperations = new JdbcTemplate(dataSource);

		RegisteredClientRepository registeredClientRepository =
				new JdbcRegisteredClientRepository(jdbcOperations);
		this.componentRegistry.register(tenantId, RegisteredClientRepository.class, registeredClientRepository);

		OAuth2AuthorizationService authorizationService =
				new JdbcOAuth2AuthorizationService(jdbcOperations, registeredClientRepository);
		this.componentRegistry.register(tenantId, OAuth2AuthorizationService.class, authorizationService);

		OAuth2AuthorizationConsentService authorizationConsentService =
				new JdbcOAuth2AuthorizationConsentService(jdbcOperations, registeredClientRepository);
		this.componentRegistry.register(tenantId, OAuth2AuthorizationConsentService.class, authorizationConsentService);

		JWKSet jwkSet = new JWKSet(generateRSAJwk());
		this.componentRegistry.register(tenantId, JWKSet.class, jwkSet);
	}

	private EmbeddedDatabase createDataSource(String tenantId) {
		return new EmbeddedDatabaseBuilder()
				.setName(tenantId)
				.setType(EmbeddedDatabaseType.H2)
				.setScriptEncoding("UTF-8")
				.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql")
				.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql")
				.addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql")
				.build();
	}

	private static RSAKey generateRSAJwk() {
		KeyPair keyPair;
		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}

		RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
		RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
		return new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();
	}

}

定义租户标识符

启用多个颁发者

创建组件注册表

创建多租户组件

多租户 RegisteredClientRepository

多租户 OAuth2AuthorizationService

多租户 OAuth2AuthorizationConsentService

多租户 JWKSource

动态添加租户