与 Servlet X.509 身份验证类似，反应式 x509 身份验证过滤器允许从客户端提供的证书中提取身份验证令牌。
以下示例显示了反应式 x509 安全配置：
-
Java
-
Kotlin
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http
.x509(withDefaults())
.authorizeExchange(exchanges -> exchanges
.anyExchange().permitAll()
);
return http.build();
}@Bean
fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
return http {
x509 { }
authorizeExchange {
authorize(anyExchange, authenticated)
}
}
}在上述配置中，如果既未提供也不提供，则使用默认值。默认主体提取器是 ，它从客户端提供的证书中提取 CN（公用名）字段。缺省身份验证管理器是 ，它执行用户帐户验证，检查具有提取者名称的用户帐户是否存在，并且该帐户未被锁定、禁用或过期。principalExtractorauthenticationManagerSubjectDnX509PrincipalExtractorReactivePreAuthenticatedAuthenticationManagerprincipalExtractor
以下示例演示了如何重写这些默认值：
-
Java
-
Kotlin
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
SubjectDnX509PrincipalExtractor principalExtractor =
new SubjectDnX509PrincipalExtractor();
principalExtractor.setSubjectDnRegex("OU=(.*?)(?:,|$)");
ReactiveAuthenticationManager authenticationManager = authentication -> {
authentication.setAuthenticated("Trusted Org Unit".equals(authentication.getName()));
return Mono.just(authentication);
};
http
.x509(x509 -> x509
.principalExtractor(principalExtractor)
.authenticationManager(authenticationManager)
)
.authorizeExchange(exchanges -> exchanges
.anyExchange().authenticated()
);
return http.build();
}@Bean
fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain? {
val customPrincipalExtractor = SubjectDnX509PrincipalExtractor()
customPrincipalExtractor.setSubjectDnRegex("OU=(.*?)(?:,|$)")
val customAuthenticationManager = ReactiveAuthenticationManager { authentication: Authentication ->
authentication.isAuthenticated = "Trusted Org Unit" == authentication.name
Mono.just(authentication)
}
return http {
x509 {
principalExtractor = customPrincipalExtractor
authenticationManager = customAuthenticationManager
}
authorizeExchange {
authorize(anyExchange, authenticated)
}
}
}在前面的示例中，从客户端证书的 OU 字段（而不是 CN）中提取用户名，并且根本不执行帐户查找。相反，如果提供的证书颁发给名为“受信任的组织单位”的 OU，则会对请求进行身份验证。ReactiveUserDetailsService
有关将 Netty 和/或命令行工具配置为使用双向 TLS 并启用 X.509 身份验证的示例，请参阅 github.com/spring-projects/spring-security-samples/tree/main/servlet/java-configuration/authentication/x509。WebClientcurl