Azure AD 访问令牌刷新机制详解

final TokenCredential tokenCredential = request -> {     // account.getTokenExpiry() 和 account.getAccessToken() 应该动态更新     final OffsetDateTime offset = OffsetDateTime.ofInstant(account.getTokenExpiry().toInstant(), ZoneId.systemDefault());     final AccessToken token = new AccessToken(account.getAccessToken(), offset);     return Mono.create(sink -> sink.success(token)); };  final TokenCredentialAuthProvider tokenCredentialAuthProvider =    new TokenCredentialAuthProvider(tokenCredential);  this.graphServiceClient =     GraphServiceClient         .builder()         .authenticationProvider(tokenCredentialAuthProvider)         .buildClient();

Kira

ai创意图像生成与编辑平台

58

查看详情

import org.springframework.http.HttpEntity; import org.springframework.http.HttpHeaders; import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; import org.springframework.util.LinkedMultiValueMap; import org.springframework.util.MultiValueMap; import org.springframework.web.client.RestTemplate;  import com.fasterxml.jackson.databind.JSonnode; import com.fasterxml.jackson.databind.ObjectMapper;  import java.io.IOException; import java.time.OffsetDateTime; import java.time.ZoneId;  public class AzureAdTokenRefresher {      private final RestTemplate restTemplate;     private final ObjectMapper objectMapper;      public AzureAdTokenRefresher() {         this.restTemplate = new RestTemplate();         this.objectMapper = new ObjectMapper();     }      /**      * 使用刷新令牌获取新的访问令牌。      * @param refreshToken 用户的刷新令牌      * @return 包含新访问令牌、刷新令牌（如果返回）和过期时间等信息的json字符串      * @throws IOException 如果JSON解析失败      */     public TokenResponse refreshAccessToken(String refreshToken) throws IOException {         String url = "https://login.microsoftonline.com/common/oauth2/v2.0/token";          HttpHeaders headers = new HttpHeaders();         headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);          // TODO: 这些值应从配置文件或环境变量中安全读取         MultiValueMap<String, String> map= new LinkedMultiValueMap<>();         map.add("client_id", "your_client_id"); // 替换为您的应用客户端ID         map.add("grant_type", "refresh_token");         map.add("redirect_uri", "http://localhost:5000/login/oauth2/code/microsoft"); // 替换为您的重定向URI         map.add("scope", "openid profile offline_access User.Read Mail.Read"); // 替换为您的权限范围         map.add("refresh_token", refreshToken);         map.add("client_secret", "your_client_secret"); // 替换为您的应用客户端密钥          HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(map, headers);          ResponseEntity<String> response = restTemplate.postForEntity(url, request, String.class);          if (response.getStatusCode().is2xxSuccessful()) {             String responseBody = response.getBody();             JsonNode rootNode = objectMapper.readTree(responseBody);              String newAccessToken = rootNode.get("access_token").asText();             String newRefreshToken = rootNode.has("refresh_token") ? rootNode.get("refresh_token").asText() : refreshToken;             long expiresInSeconds = rootNode.get("expires_in").asLong();              // 计算新的过期时间             OffsetDateTime expiryTime = OffsetDateTime.now(ZoneId.systemDefault()).plusSeconds(expiresInSeconds);              return new TokenResponse(newAccessToken, newRefreshToken, expiryTime);         } else {             // 处理错误响应             throw new RuntimeException("Failed to refresh token: " + response.getStatusCode() + " - " + response.getBody());         }     }      // 辅助类用于封装令牌响应     public static class TokenResponse {         private final String accessToken;         private final String refreshToken;         private final OffsetDateTime expiryTime;          public TokenResponse(String accessToken, String refreshToken, OffsetDateTime expiryTime) {             this.accessToken = accessToken;             this.refreshToken = refreshToken;             this.expiryTime = expiryTime;         }          public String getAccessToken() { return accessToken; }         public String getRefreshToken() { return refreshToken; }         public OffsetDateTime getExpiryTime() { return expiryTime; }     } }

// 假设您的 Account 类有以下方法 public class UserAccount {     private String accessToken;     private String refreshToken;     private OffsetDateTime tokenExpiry;      // ... 构造函数，getter和setter ...      public void updateTokens(String newAccessToken, String newRefreshToken, OffsetDateTime newExpiry) {         this.accessToken = newAccessToken;         this.refreshToken = newRefreshToken;         this.tokenExpiry = newExpiry;     } }

// 假设 currentAccount 是当前用户的 UserAccount 实例 UserAccount currentAccount = // ... 从存储中加载 ...  // 检查令牌是否即将过期或已过期 if (currentAccount.getTokenExpiry().isBefore(OffsetDateTime.now(ZoneId.systemDefault()).plusMinutes(5))) { // 提前5分钟刷新     try {         AzureAdTokenRefresher refresher = new AzureAdTokenRefresher();         AzureAdTokenRefresher.TokenResponse tokenResponse = refresher.refreshAccessToken(currentAccount.getRefreshToken());          // 更新 account 对象中的令牌信息         currentAccount.updateTokens(             tokenResponse.getAccessToken(),             tokenResponse.getRefreshToken(), // 使用新的刷新令牌，如果返回了的话             tokenResponse.getExpiryTime()         );         // ... 将更新后的 currentAccount 保存回存储 ...          // GraphServiceClient 的 TokenCredential 会在下次请求时自动获取更新后的令牌         // 因为它的实现是每次请求时从 account 对象中获取最新令牌。         // 如果 GraphServiceClient 需要重新构建，则在此处重新构建。         // 对于上述 lambda 表达式实现的 TokenCredential，通常不需要重新构建 GraphServiceClient。      } catch (IOException | RuntimeException e) {         // 处理令牌刷新失败的情况，可能需要用户重新登录         System.err.println("Failed to refresh access token: " + e.getMessage());         // 标记用户需要重新认证     } }

大家都在看：