devbox
编程领航者
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringCloud+SpringBoot+OAuth2+Spring Security+Redis实现的微服务统一认证授权

作者：编程领航者 | 2024-02-03 19:02:19

赞

踩

security+oauth2+redis+springcloud

因为目前做了一个基于 Spring Cloud 的微服务项目，所以了解到了 OAuth2，打算整合一下 OAuth2 来实现统一授权。关于 OAuth 是一个关于授权的开放网络标准，目前的版本是 2.0，这里我就不多做介绍了。

开发环境：Windows10，  Intellij Idea2018.2，   jdk1.8，  redis3.2.9， Spring Boot 2.0.2 Release， Spring Cloud Finchley.RC2 Spring 5.0.6

项目目录

55317c4424c5176eb2064c6aa826a852.png

eshop                                      —— 父级工程，管理 jar 包版本

eshop-server                 —— Eureka 服务注册中心

eshop-gateway              —— Zuul 网关

eshop-auth                    —— 授权服务

eshop-member              —— 会员服务

eshop-email                   —— 邮件服务（暂未使用）

eshop-common              —— 通用类

关于如何构建一个基本的 Spring Cloud 微服务这里就不赘述了，不会的可以看一下我的关于 Spring Cloud 系列的博客。这里给个入口地址：https://blog.csdn.net/wya1993/article/category/7701476

授权服务

首先构建 eshop-auth 服务，引入相关依赖

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0"
  3.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.     <parent>
  6.         <artifactId>eshop-parent</artifactId>
  7.         <groupId>com.curise.eshop</groupId>
  8.         <version>1.0-SNAPSHOT</version>
  9.     </parent>
  10.     <modelVersion>4.0.0</modelVersion>
  11.     <artifactId>eshop-auth</artifactId>
  12.     <packaging>war</packaging>
  13.     <description>授权模块</description>
  14.  
  15.     <dependencies>
  16.         <dependency>
  17.             <groupId>com.curise.eshop</groupId>
  18.             <artifactId>eshop-common</artifactId>
  19.             <version>1.0-SNAPSHOT</version>
  20.         </dependency>
  21.         <dependency>
  22.             <groupId>org.springframework.boot</groupId>
  23.             <artifactId>spring-boot-starter-web</artifactId>
  24.         </dependency>
  25.         <dependency>
  26.             <groupId>org.springframework.cloud</groupId>
  27.             <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
  28.         </dependency>
  29.         <dependency>
  30.             <groupId>org.springframework.cloud</groupId>
  31.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  32.         </dependency>
  33.         <dependency>
  34.             <groupId>org.springframework.cloud</groupId>
  35.             <artifactId>spring-cloud-starter-security</artifactId>
  36.         </dependency>
  37.         <dependency>
  38.             <groupId>org.springframework.boot</groupId>
  39.             <artifactId>spring-boot-starter-data-redis</artifactId>
  40.         </dependency>
  41.         <dependency>
  42.             <groupId>org.mybatis.spring.boot</groupId>
  43.             <artifactId>mybatis-spring-boot-starter</artifactId>
  44.         </dependency>
  45.         <dependency>
  46.             <groupId>org.springframework.boot</groupId>
  47.             <artifactId>spring-boot-starter-actuator</artifactId>
  48.         </dependency>
  49.         <dependency>
  50.             <groupId>mysql</groupId>
  51.             <artifactId>mysql-connector-java</artifactId>
  52.         </dependency>
  53.         <dependency>
  54.             <groupId>com.alibaba</groupId>
  55.             <artifactId>druid</artifactId>
  56.         </dependency>
  57.         <dependency>
  58.             <groupId>log4j</groupId>
  59.             <artifactId>log4j</artifactId>
  60.         </dependency>
  61.     </dependencies>
  62.  
  63.     <build>
  64.         <plugins>
  65.             <plugin>
  66.                 <groupId>org.springframework.boot</groupId>
  67.                 <artifactId>spring-boot-maven-plugin</artifactId>
  68.             </plugin>
  69.         </plugins>
  70.     </build>
  71. </project>

接下来，配置 Mybatis、redis、eureka，贴一下配置文件

  1. server:
  2.   port: 1203
  3.  
  4. spring:
  5.   application:
  6.     name: eshop-auth
  7.   redis:
  8.     database: 0
  9.     host: 192.168.0.117
  10.     port: 6379
  11.     password:
  12.     jedis:
  13.       pool:
  14.         max-active: 8
  15.         max-idle: 8
  16.         min-idle: 0
  17.   datasource:
  18.     driver-class-name: com.mysql.jdbc.Driver
  19.     url: jdbc:mysql://localhost:3306/eshop_member?useUnicode=true&characterEncoding=utf-8&useSSL=false&allowMultiQueries=true
  20.     username: root
  21.     password: root
  22.   druid:
  23.     initialSize: 5 #初始化连接大小
  24.     minIdle: 5     #最小连接池数量
  25.     maxActive: 20  #最大连接池数量
  26.     maxWait: 60000 #获取连接时最大等待时间，单位毫秒
  27.     timeBetweenEvictionRunsMillis: 60000 #配置间隔多久才进行一次检测，检测需要关闭的空闲连接，单位是毫秒
  28.     minEvictableIdleTimeMillis: 300000   #配置一个连接在池中最小生存的时间，单位是毫秒
  29.     validationQuery: SELECT 1 from DUAL  #测试连接
  30.     testWhileIdle: true                  #申请连接的时候检测，建议配置为true，不影响性能，并且保证安全性
  31.     testOnBorrow: false                  #获取连接时执行检测，建议关闭，影响性能
  32.     testOnReturn: false                  #归还连接时执行检测，建议关闭，影响性能
  33.     poolPreparedStatements: false        #是否开启PSCache，PSCache对支持游标的数据库性能提升巨大，oracle建议开启，mysql下建议关闭
  34.     maxPoolPreparedStatementPerConnectionSize: 20 #开启poolPreparedStatements后生效
  35.     filters: stat,wall,log4j #配置扩展插件，常用的插件有=>stat:监控统计  log4j:日志  wall:防御sql注入
  36.     connectionProperties: 'druid.stat.mergeSql=true;druid.stat.slowSqlMillis=5000' #通过connectProperties属性来打开mergeSql功能;慢SQL记录
  37.  
  38.  
  39. eureka:
  40.   instance:
  41.     prefer-ip-address: true
  42.     instance-id: ${spring.cloud.client.ip-address}:${server.port}
  43.   client:
  44.     service-url:
  45.       defaultZone: http://localhost:1111/eureka/
  46.  
  47. mybatis:
  48.   type-aliases-package: com.curise.eshop.common.entity
  49.   configuration:
  50.     map-underscore-to-camel-case: true  #开启驼峰命名,l_name -> lName
  51.     jdbc-type-for-null: NULL
  52.     lazy-loading-enabled: true
  53.     aggressive-lazy-loading: true
  54.     cache-enabled: true #开启二级缓存
  55.     call-setters-on-nulls: true #map空列不显示问题
  56.   mapper-locations:
  57.     - classpath:mybatis/*.xml

AuthApplication 添加 @EnableDiscoveryClient 和 @MapperScan 注解。

搜索公纵号：MarkerHub，关注回复[ vue ]获取前后端入门教程！

接下来配置认证服务器 AuthorizationServerConfig ，并添加 @Configuration 和 @EnableAuthorizationServer 注解，其中 ClientDetailsServiceConfigurer 配置在内存中，当然也可以从数据库读取，以后慢慢完善。

  1. @Configuration
  2. @EnableAuthorizationServer
  3. public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
  4.  
  5.     @Autowired
  6.     private AuthenticationManager authenticationManager;
  7.  
  8.     @Autowired
  9.     private DataSource dataSource;
  10.  
  11.     @Autowired
  12.     private RedisConnectionFactory redisConnectionFactory;
  13.  
  14.     @Autowired
  15.     private MyUserDetailService userDetailService;
  16.  
  17.     @Bean
  18.     public TokenStore tokenStore() {
  19.         return new RedisTokenStore(redisConnectionFactory);
  20.     }
  21.  
  22.     @Override
  23.     public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
  24.         security
  25.                 .allowFormAuthenticationForClients()
  26.                 .tokenKeyAccess("permitAll()")
  27.                 .checkTokenAccess("isAuthenticated()");
  28.     }
  29.  
  30.     @Override
  31.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  32.        // clients.withClientDetails(clientDetails());
  33.         clients.inMemory()
  34.                 .withClient("android")
  35.                 .scopes("read")
  36.                 .secret("android")
  37.                 .authorizedGrantTypes("password", "authorization_code", "refresh_token")
  38.                 .and()
  39.                 .withClient("webapp")
  40.                 .scopes("read")
  41.                 .authorizedGrantTypes("implicit")
  42.                 .and()
  43.                 .withClient("browser")
  44.                 .authorizedGrantTypes("refresh_token", "password")
  45.                 .scopes("read");
  46.     }
  47.     @Bean
  48.     public ClientDetailsService clientDetails() {
  49.         return new JdbcClientDetailsService(dataSource);
  50.     }
  51.  
  52.     @Bean
  53.     public WebResponseExceptionTranslator webResponseExceptionTranslator(){
  54.         return new MssWebResponseExceptionTranslator();
  55.     }
  56.  
  57.     @Override
  58.     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  59.         endpoints.tokenStore(tokenStore())
  60.                 .userDetailsService(userDetailService)
  61.                 .authenticationManager(authenticationManager);
  62.         endpoints.tokenServices(defaultTokenServices());
  63.         //认证异常翻译
  64.        // endpoints.exceptionTranslator(webResponseExceptionTranslator());
  65.     }
  66.  
  67.     /**
  68.      * <p>注意，自定义TokenServices的时候，需要设置@Primary，否则报错，</p>
  69.      * @return
  70.      */
  71.     @Primary
  72.     @Bean
  73.     public DefaultTokenServices defaultTokenServices(){
  74.         DefaultTokenServices tokenServices = new DefaultTokenServices();
  75.         tokenServices.setTokenStore(tokenStore());
  76.         tokenServices.setSupportRefreshToken(true);
  77.         //tokenServices.setClientDetailsService(clientDetails());
  78.         // token有效期自定义设置，默认12小时
  79.         tokenServices.setAccessTokenValiditySeconds(60*60*12);
  80.         // refresh_token默认30天
  81.         tokenServices.setRefreshTokenValiditySeconds(60 * 60 * 24 * 7);
  82.         return tokenServices;
  83.     }
  84. }

在上述配置中，认证的 token 是存到 redis 里的，如果你这里使用了 Spring5.0 以上的版本的话，使用默认的 RedisTokenStore 认证时会报如下异常：

nested exception is java.lang.NoSuchMethodError: org.springframework.data.redis.connection.RedisConnection.set([B[B)V

原因是 spring-data-redis 2.0 版本中 set(String,String) 被弃用了，要使用 RedisConnection.stringCommands().set(…)，所有我自定义一个 RedisTokenStore，代码和 RedisTokenStore 一样，只是把所有 conn.set(…) 都换成 conn..stringCommands().set(…)，测试后方法可行。

  1. public class RedisTokenStore implements TokenStore {
  2.  
  3.     private static final String ACCESS = "access:";
  4.     private static final String AUTH_TO_ACCESS = "auth_to_access:";
  5.     private static final String AUTH = "auth:";
  6.     private static final String REFRESH_AUTH = "refresh_auth:";
  7.     private static final String ACCESS_TO_REFRESH = "access_to_refresh:";
  8.     private static final String REFRESH = "refresh:";
  9.     private static final String REFRESH_TO_ACCESS = "refresh_to_access:";
  10.     private static final String CLIENT_ID_TO_ACCESS = "client_id_to_access:";
  11.     private static final String UNAME_TO_ACCESS = "uname_to_access:";
  12.     private final RedisConnectionFactory connectionFactory;
  13.     private AuthenticationKeyGenerator authenticationKeyGenerator = new DefaultAuthenticationKeyGenerator();
  14.     private RedisTokenStoreSerializationStrategy serializationStrategy = new JdkSerializationStrategy();
  15.     private String prefix = "";
  16.  
  17.     public RedisTokenStore(RedisConnectionFactory connectionFactory) {
  18.         this.connectionFactory = connectionFactory;
  19.     }
  20.  
  21.     public void setAuthenticationKeyGenerator(AuthenticationKeyGenerator authenticationKeyGenerator) {
  22.         this.authenticationKeyGenerator = authenticationKeyGenerator;
  23.     }
  24.  
  25.     public void setSerializationStrategy(RedisTokenStoreSerializationStrategy serializationStrategy) {
  26.         this.serializationStrategy = serializationStrategy;
  27.     }
  28.  
  29.     public void setPrefix(String prefix) {
  30.         this.prefix = prefix;
  31.     }
  32.  
  33.     private RedisConnection getConnection() {
  34.         return this.connectionFactory.getConnection();
  35.     }
  36.  
  37.     private byte[] serialize(Object object) {
  38.         return this.serializationStrategy.serialize(object);
  39.     }
  40.  
  41.     private byte[] serializeKey(String object) {
  42.         return this.serialize(this.prefix + object);
  43.     }
  44.  
  45.     private OAuth2AccessToken deserializeAccessToken(byte[] bytes) {
  46.         return (OAuth2AccessToken)this.serializationStrategy.deserialize(bytes, OAuth2AccessToken.class);
  47.     }
  48.  
  49.     private OAuth2Authentication deserializeAuthentication(byte[] bytes) {
  50.         return (OAuth2Authentication)this.serializationStrategy.deserialize(bytes, OAuth2Authentication.class);
  51.     }
  52.  
  53.     private OAuth2RefreshToken deserializeRefreshToken(byte[] bytes) {
  54.         return (OAuth2RefreshToken)this.serializationStrategy.deserialize(bytes, OAuth2RefreshToken.class);
  55.     }
  56.  
  57.     private byte[] serialize(String string) {
  58.         return this.serializationStrategy.serialize(string);
  59.     }
  60.  
  61.     private String deserializeString(byte[] bytes) {
  62.         return this.serializationStrategy.deserializeString(bytes);
  63.     }
  64.  
  65.     @Override
  66.     public OAuth2AccessToken getAccessToken(OAuth2Authentication authentication) {
  67.         String key = this.authenticationKeyGenerator.extractKey(authentication);
  68.         byte[] serializedKey = this.serializeKey(AUTH_TO_ACCESS + key);
  69.         byte[] bytes = null;
  70.         RedisConnection conn = this.getConnection();
  71.         try {
  72.             bytes = conn.get(serializedKey);
  73.         } finally {
  74.             conn.close();
  75.         }
  76.         OAuth2AccessToken accessToken = this.deserializeAccessToken(bytes);
  77.         if (accessToken != null) {
  78.             OAuth2Authentication storedAuthentication = this.readAuthentication(accessToken.getValue());
  79.             if (storedAuthentication == null || !key.equals(this.authenticationKeyGenerator.extractKey(storedAuthentication))) {
  80.                 this.storeAccessToken(accessToken, authentication);
  81.             }
  82.         }
  83.         return accessToken;
  84.     }
  85.  
  86.     @Override
  87.     public OAuth2Authentication readAuthentication(OAuth2AccessToken token) {
  88.         return this.readAuthentication(token.getValue());
  89.     }
  90.  
  91.     @Override
  92.     public OAuth2Authentication readAuthentication(String token) {
  93.         byte[] bytes = null;
  94.         RedisConnection conn = this.getConnection();
  95.         try {
  96.             bytes = conn.get(this.serializeKey("auth:" + token));
  97.         } finally {
  98.             conn.close();
  99.         }
  100.         OAuth2Authentication auth = this.deserializeAuthentication(bytes);
  101.         return auth;
  102.     }
  103.  
  104.     @Override
  105.     public OAuth2Authentication readAuthenticationForRefreshToken(OAuth2RefreshToken token) {
  106.         return this.readAuthenticationForRefreshToken(token.getValue());
  107.     }
  108.  
  109.     public OAuth2Authentication readAuthenticationForRefreshToken(String token) {
  110.         RedisConnection conn = getConnection();
  111.         try {
  112.             byte[] bytes = conn.get(serializeKey(REFRESH_AUTH + token));
  113.             OAuth2Authentication auth = deserializeAuthentication(bytes);
  114.             return auth;
  115.         } finally {
  116.             conn.close();
  117.         }
  118.     }
  119.  
  120.     @Override
  121.     public void storeAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
  122.         byte[] serializedAccessToken = serialize(token);
  123.         byte[] serializedAuth = serialize(authentication);
  124.         byte[] accessKey = serializeKey(ACCESS + token.getValue());
  125.         byte[] authKey = serializeKey(AUTH + token.getValue());
  126.         byte[] authToAccessKey = serializeKey(AUTH_TO_ACCESS + authenticationKeyGenerator.extractKey(authentication));
  127.         byte[] approvalKey = serializeKey(UNAME_TO_ACCESS + getApprovalKey(authentication));
  128.         byte[] clientId = serializeKey(CLIENT_ID_TO_ACCESS + authentication.getOAuth2Request().getClientId());
  129.  
  130.         RedisConnection conn = getConnection();
  131.         try {
  132.             conn.openPipeline();
  133.             conn.stringCommands().set(accessKey, serializedAccessToken);
  134.             conn.stringCommands().set(authKey, serializedAuth);
  135.             conn.stringCommands().set(authToAccessKey, serializedAccessToken);
  136.             if (!authentication.isClientOnly()) {
  137.                 conn.rPush(approvalKey, serializedAccessToken);
  138.             }
  139.             conn.rPush(clientId, serializedAccessToken);
  140.             if (token.getExpiration() != null) {
  141.                 int seconds = token.getExpiresIn();
  142.                 conn.expire(accessKey, seconds);
  143.                 conn.expire(authKey, seconds);
  144.                 conn.expire(authToAccessKey, seconds);
  145.                 conn.expire(clientId, seconds);
  146.                 conn.expire(approvalKey, seconds);
  147.             }
  148.             OAuth2RefreshToken refreshToken = token.getRefreshToken();
  149.             if (refreshToken != null && refreshToken.getValue() != null) {
  150.                 byte[] refresh = serialize(token.getRefreshToken().getValue());
  151.                 byte[] auth = serialize(token.getValue());
  152.                 byte[] refreshToAccessKey = serializeKey(REFRESH_TO_ACCESS + token.getRefreshToken().getValue());
  153.                 conn.stringCommands().set(refreshToAccessKey, auth);
  154.                 byte[] accessToRefreshKey = serializeKey(ACCESS_TO_REFRESH + token.getValue());
  155.                 conn.stringCommands().set(accessToRefreshKey, refresh);
  156.                 if (refreshToken instanceof ExpiringOAuth2RefreshToken) {
  157.                     ExpiringOAuth2RefreshToken expiringRefreshToken = (ExpiringOAuth2RefreshToken) refreshToken;
  158.                     Date expiration = expiringRefreshToken.getExpiration();
  159.                     if (expiration != null) {
  160.                         int seconds = Long.valueOf((expiration.getTime() - System.currentTimeMillis()) / 1000L)
  161.                                 .intValue();
  162.                         conn.expire(refreshToAccessKey, seconds);
  163.                         conn.expire(accessToRefreshKey, seconds);
  164.                     }
  165.                 }
  166.             }
  167.             conn.closePipeline();
  168.         } finally {
  169.             conn.close();
  170.         }
  171.     }
  172.  
  173.     private static String getApprovalKey(OAuth2Authentication authentication) {
  174.         String userName = authentication.getUserAuthentication() == null ? "": authentication.getUserAuthentication().getName();
  175.         return getApprovalKey(authentication.getOAuth2Request().getClientId(), userName);
  176.     }
  177.  
  178.     private static String getApprovalKey(String clientId, String userName) {
  179.         return clientId + (userName == null ? "" : ":" + userName);
  180.     }
  181.  
  182.     @Override
  183.     public void removeAccessToken(OAuth2AccessToken accessToken) {
  184.         this.removeAccessToken(accessToken.getValue());
  185.     }
  186.  
  187.     @Override
  188.     public OAuth2AccessToken readAccessToken(String tokenValue) {
  189.         byte[] key = serializeKey(ACCESS + tokenValue);
  190.         byte[] bytes = null;
  191.         RedisConnection conn = getConnection();
  192.         try {
  193.             bytes = conn.get(key);
  194.         } finally {
  195.             conn.close();
  196.         }
  197.         OAuth2AccessToken accessToken = deserializeAccessToken(bytes);
  198.         return accessToken;
  199.     }
  200.  
  201.     public void removeAccessToken(String tokenValue) {
  202.         byte[] accessKey = serializeKey(ACCESS + tokenValue);
  203.         byte[] authKey = serializeKey(AUTH + tokenValue);
  204.         byte[] accessToRefreshKey = serializeKey(ACCESS_TO_REFRESH + tokenValue);
  205.         RedisConnection conn = getConnection();
  206.         try {
  207.             conn.openPipeline();
  208.             conn.get(accessKey);
  209.             conn.get(authKey);
  210.             conn.del(accessKey);
  211.             conn.del(accessToRefreshKey);
  212.             // Don't remove the refresh token - it's up to the caller to do that
  213.             conn.del(authKey);
  214.             List<Object> results = conn.closePipeline();
  215.             byte[] access = (byte[]) results.get(0);
  216.             byte[] auth = (byte[]) results.get(1);
  217.  
  218.             OAuth2Authentication authentication = deserializeAuthentication(auth);
  219.             if (authentication != null) {
  220.                 String key = authenticationKeyGenerator.extractKey(authentication);
  221.                 byte[] authToAccessKey = serializeKey(AUTH_TO_ACCESS + key);
  222.                 byte[] unameKey = serializeKey(UNAME_TO_ACCESS + getApprovalKey(authentication));
  223.                 byte[] clientId = serializeKey(CLIENT_ID_TO_ACCESS + authentication.getOAuth2Request().getClientId());
  224.                 conn.openPipeline();
  225.                 conn.del(authToAccessKey);
  226.                 conn.lRem(unameKey, 1, access);
  227.                 conn.lRem(clientId, 1, access);
  228.                 conn.del(serialize(ACCESS + key));
  229.                 conn.closePipeline();
  230.             }
  231.         } finally {
  232.             conn.close();
  233.         }
  234.     }
  235.  
  236.     @Override
  237.     public void storeRefreshToken(OAuth2RefreshToken refreshToken, OAuth2Authentication authentication) {
  238.         byte[] refreshKey = serializeKey(REFRESH + refreshToken.getValue());
  239.         byte[] refreshAuthKey = serializeKey(REFRESH_AUTH + refreshToken.getValue());
  240.         byte[] serializedRefreshToken = serialize(refreshToken);
  241.         RedisConnection conn = getConnection();
  242.         try {
  243.             conn.openPipeline();
  244.             conn.stringCommands().set(refreshKey, serializedRefreshToken);
  245.             conn.stringCommands().set(refreshAuthKey, serialize(authentication));
  246.             if (refreshToken instanceof ExpiringOAuth2RefreshToken) {
  247.                 ExpiringOAuth2RefreshToken expiringRefreshToken = (ExpiringOAuth2RefreshToken) refreshToken;
  248.                 Date expiration = expiringRefreshToken.getExpiration();
  249.                 if (expiration != null) {
  250.                     int seconds = Long.valueOf((expiration.getTime() - System.currentTimeMillis()) / 1000L)
  251.                             .intValue();
  252.                     conn.expire(refreshKey, seconds);
  253.                     conn.expire(refreshAuthKey, seconds);
  254.                 }
  255.             }
  256.             conn.closePipeline();
  257.         } finally {
  258.             conn.close();
  259.         }
  260.     }
  261.  
  262.     @Override
  263.     public OAuth2RefreshToken readRefreshToken(String tokenValue) {
  264.         byte[] key = serializeKey(REFRESH + tokenValue);
  265.         byte[] bytes = null;
  266.         RedisConnection conn = getConnection();
  267.         try {
  268.             bytes = conn.get(key);
  269.         } finally {
  270.             conn.close();
  271.         }
  272.         OAuth2RefreshToken refreshToken = deserializeRefreshToken(bytes);
  273.         return refreshToken;
  274.     }
  275.  
  276.     @Override
  277.     public void removeRefreshToken(OAuth2RefreshToken refreshToken) {
  278.         this.removeRefreshToken(refreshToken.getValue());
  279.     }
  280.  
  281.     public void removeRefreshToken(String tokenValue) {
  282.         byte[] refreshKey = serializeKey(REFRESH + tokenValue);
  283.         byte[] refreshAuthKey = serializeKey(REFRESH_AUTH + tokenValue);
  284.         byte[] refresh2AccessKey = serializeKey(REFRESH_TO_ACCESS + tokenValue);
  285.         byte[] access2RefreshKey = serializeKey(ACCESS_TO_REFRESH + tokenValue);
  286.         RedisConnection conn = getConnection();
  287.         try {
  288.             conn.openPipeline();
  289.             conn.del(refreshKey);
  290.             conn.del(refreshAuthKey);
  291.             conn.del(refresh2AccessKey);
  292.             conn.del(access2RefreshKey);
  293.             conn.closePipeline();
  294.         } finally {
  295.             conn.close();
  296.         }
  297.     }
  298.  
  299.     @Override
  300.     public void removeAccessTokenUsingRefreshToken(OAuth2RefreshToken refreshToken) {
  301.         this.removeAccessTokenUsingRefreshToken(refreshToken.getValue());
  302.     }
  303.  
  304.     private void removeAccessTokenUsingRefreshToken(String refreshToken) {
  305.         byte[] key = serializeKey(REFRESH_TO_ACCESS + refreshToken);
  306.         List<Object> results = null;
  307.         RedisConnection conn = getConnection();
  308.         try {
  309.             conn.openPipeline();
  310.             conn.get(key);
  311.             conn.del(key);
  312.             results = conn.closePipeline();
  313.         } finally {
  314.             conn.close();
  315.         }
  316.         if (results == null) {
  317.             return;
  318.         }
  319.         byte[] bytes = (byte[]) results.get(0);
  320.         String accessToken = deserializeString(bytes);
  321.         if (accessToken != null) {
  322.             removeAccessToken(accessToken);
  323.         }
  324.     }
  325.  
  326.     @Override
  327.     public Collection<OAuth2AccessToken> findTokensByClientIdAndUserName(String clientId, String userName) {
  328.         byte[] approvalKey = serializeKey(UNAME_TO_ACCESS + getApprovalKey(clientId, userName));
  329.         List<byte[]> byteList = null;
  330.         RedisConnection conn = getConnection();
  331.         try {
  332.             byteList = conn.lRange(approvalKey, 0, -1);
  333.         } finally {
  334.             conn.close();
  335.         }
  336.         if (byteList == null || byteList.size() == 0) {
  337.             return Collections.<OAuth2AccessToken> emptySet();
  338.         }
  339.         List<OAuth2AccessToken> accessTokens = new ArrayList<OAuth2AccessToken>(byteList.size());
  340.         for (byte[] bytes : byteList) {
  341.             OAuth2AccessToken accessToken = deserializeAccessToken(bytes);
  342.             accessTokens.add(accessToken);
  343.         }
  344.         return Collections.<OAuth2AccessToken> unmodifiableCollection(accessTokens);
  345.     }
  346.  
  347.     @Override
  348.     public Collection<OAuth2AccessToken> findTokensByClientId(String clientId) {
  349.         byte[] key = serializeKey(CLIENT_ID_TO_ACCESS + clientId);
  350.         List<byte[]> byteList = null;
  351.         RedisConnection conn = getConnection();
  352.         try {
  353.             byteList = conn.lRange(key, 0, -1);
  354.         } finally {
  355.             conn.close();
  356.         }
  357.         if (byteList == null || byteList.size() == 0) {
  358.             return Collections.<OAuth2AccessToken> emptySet();
  359.         }
  360.         List<OAuth2AccessToken> accessTokens = new ArrayList<OAuth2AccessToken>(byteList.size());
  361.         for (byte[] bytes : byteList) {
  362.             OAuth2AccessToken accessToken = deserializeAccessToken(bytes);
  363.             accessTokens.add(accessToken);
  364.         }
  365.         return Collections.<OAuth2AccessToken> unmodifiableCollection(accessTokens);
  366.     }
  367. }

配置资源服务器

  1. @Configuration
  2. @EnableResourceServer
  3. @Order(3)
  4. public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
  5.     @Override
  6.     public void configure(HttpSecurity http) throws Exception {
  7.         http
  8.                 .csrf().disable()
  9.                 .exceptionHandling()
  10.                 .authenticationEntryPoint((request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
  11.                 .and()
  12.                 .requestMatchers().antMatchers("/api/**")
  13.                 .and()
  14.                 .authorizeRequests()
  15.                 .antMatchers("/api/**").authenticated()
  16.                 .and()
  17.                 .httpBasic();
  18.     }
  19. }

配置 Spring Security

  1. @Configuration
  2. @EnableWebSecurity
  3. @Order(2)
  4. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  5.     @Autowired
  6.     private MyUserDetailService userDetailService;
  7.  
  8.     @Bean
  9.     public PasswordEncoder passwordEncoder() {
  10.         //return new BCryptPasswordEncoder();
  11.         return new NoEncryptPasswordEncoder();
  12.     }
  13.  
  14.     @Override
  15.     protected void configure(HttpSecurity http) throws Exception {
  16.         http.requestMatchers().antMatchers("/oauth/**")
  17.                 .and()
  18.                 .authorizeRequests()
  19.                 .antMatchers("/oauth/**").authenticated()
  20.                 .and()
  21.                 .csrf().disable();
  22.     }
  23.  
  24.     @Override
  25.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  26.         auth.userDetailsService(userDetailService).passwordEncoder(passwordEncoder());
  27.     }
  28.  
  29.     /**
  30.      * 不定义没有password grant_type
  31.      *
  32.      * @return
  33.      * @throws Exception
  34.      */
  35.     @Override
  36.     @Bean
  37.     public AuthenticationManager authenticationManagerBean() throws Exception {
  38.         return super.authenticationManagerBean();
  39.     }
  40. }

可以看到 ResourceServerConfig 是比 SecurityConfig 的优先级低的。

二者的关系：

  • ResourceServerConfig 用于保护 oauth 相关的 endpoints，同时主要作用于用户的登录 (form login,Basic auth)

  • SecurityConfig 用于保护 oauth 要开放的资源，同时主要作用于 client 端以及 token 的认证 (Bearer auth)

所以我们让 SecurityConfig 优先于 ResourceServerConfig，且在 SecurityConfig 不拦截 oauth 要开放的资源，在 ResourceServerConfig 中配置需要 token 验证的资源，也就是我们对外提供的接口。所以这里对于所有微服务的接口定义有一个要求，就是全部以 /api 开头。

如果这里不这样配置的话，在你拿到 access_token 去请求各个接口时会报 invalid_token 的提示。

另外，由于我们自定义认证逻辑，所以需要重写 UserDetailService

  1. @Service("userDetailService")
  2. public class MyUserDetailService implements UserDetailsService {
  3.  
  4.     @Autowired
  5.     private MemberDao memberDao;
  6.  
  7.     @Override
  8.     public UserDetails loadUserByUsername(String memberName) throws UsernameNotFoundException {
  9.         Member member = memberDao.findByMemberName(memberName);
  10.         if (member == null) {
  11.             throw new UsernameNotFoundException(memberName);
  12.         }
  13.         Set<GrantedAuthority> grantedAuthorities = new HashSet<>();
  14.         // 可用性 :true:可用 false:不可用
  15.         boolean enabled = true;
  16.         // 过期性 :true:没过期 false:过期
  17.         boolean accountNonExpired = true;
  18.         // 有效性 :true:凭证有效 false:凭证无效
  19.         boolean credentialsNonExpired = true;
  20.         // 锁定性 :true:未锁定 false:已锁定
  21.         boolean accountNonLocked = true;
  22.         for (Role role : member.getRoles()) {
  23.             //角色必须是ROLE_开头，可以在数据库中设置
  24.             GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role.getRoleName());
  25.             grantedAuthorities.add(grantedAuthority);
  26.             //获取权限
  27.             for (Permission permission : role.getPermissions()) {
  28.                 GrantedAuthority authority = new SimpleGrantedAuthority(permission.getUri());
  29.                 grantedAuthorities.add(authority);
  30.             }
  31.         }
  32.         User user = new User(member.getMemberName(), member.getPassword(),
  33.                 enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, grantedAuthorities);
  34.         return user;
  35.     }
  36.  
  37. }

密码验证为了方便我使用了不加密的方式，重写了 PasswordEncoder，实际开发还是建议使用 BCryptPasswordEncoder。

  1. public class NoEncryptPasswordEncoder implements PasswordEncoder {
  2.  
  3.     @Override
  4.     public String encode(CharSequence charSequence) {
  5.         return (String) charSequence;
  6.     }
  7.  
  8.     @Override
  9.     public boolean matches(CharSequence charSequence, String s) {
  10.         return s.equals((String) charSequence);
  11.     }
  12. }

另外，OAuth 的密码模式需要 AuthenticationManager 支持

  1. @Override
  2. @Bean
  3. public AuthenticationManager authenticationManagerBean() throws Exception {
  4.     return super.authenticationManagerBean();
  5. }

定义一个 Controller，提供两个接口，/api/member 用来获取当前用户信息，/api/exit 用来注销当前用户

  1. @RestController
  2. @RequestMapping("/api")
  3. public class MemberController {
  4.  
  5.     @Autowired
  6.     private MyUserDetailService userDetailService;
  7.  
  8.     @Autowired
  9.     private ConsumerTokenServices consumerTokenServices;
  10.  
  11.     @GetMapping("/member")
  12.     public Principal user(Principal member) {
  13.         return member;
  14.     }
  15.  
  16.     @DeleteMapping(value = "/exit")
  17.     public Result revokeToken(String access_token) {
  18.         Result result = new Result();
  19.         if (consumerTokenServices.revokeToken(access_token)) {
  20.             result.setCode(ResultCode.SUCCESS.getCode());
  21.             result.setMessage("注销成功");
  22.         } else {
  23.             result.setCode(ResultCode.FAILED.getCode());
  24.             result.setMessage("注销失败");
  25.         }
  26.         return result;
  27.     }
  28. }

会员服务配置

引入依赖

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0"
  3.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.     <parent>
  6.         <artifactId>eshop-parent</artifactId>
  7.         <groupId>com.curise.eshop</groupId>
  8.         <version>1.0-SNAPSHOT</version>
  9.     </parent>
  10.     <modelVersion>4.0.0</modelVersion>
  11.     <artifactId>eshop-member</artifactId>
  12.     <packaging>war</packaging>
  13.     <description>会员模块</description>
  14.  
  15.     <dependencies>
  16.         <dependency>
  17.             <groupId>org.springframework.boot</groupId>
  18.             <artifactId>spring-boot-starter-web</artifactId>
  19.         </dependency>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-test</artifactId>
  23.             <scope>test</scope>
  24.         </dependency>
  25.         <dependency>
  26.             <groupId>org.springframework.cloud</groupId>
  27.             <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
  28.         </dependency>
  29.         <dependency>
  30.             <groupId>org.springframework.cloud</groupId>
  31.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  32.         </dependency>
  33.         <dependency>
  34.             <groupId>org.springframework.cloud</groupId>
  35.             <artifactId>spring-cloud-starter-security</artifactId>
  36.         </dependency>
  37.         <dependency>
  38.             <groupId>com.alibaba</groupId>
  39.             <artifactId>fastjson</artifactId>
  40.         </dependency>
  41.     </dependencies>
  42.  
  43.     <build>
  44.         <plugins>
  45.             <plugin>
  46.                 <groupId>org.springframework.boot</groupId>
  47.                 <artifactId>spring-boot-maven-plugin</artifactId>
  48.             </plugin>
  49.         </plugins>
  50.     </build>
  51. </project>

配置资源服务器

  1. @Configuration
  2. @EnableResourceServer
  3. public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
  4.  
  5.     @Override
  6.     public void configure(HttpSecurity http) throws Exception {
  7.         http
  8.                 .csrf().disable()
  9.                 .exceptionHandling()
  10.                 .authenticationEntryPoint((request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
  11.                 .and()
  12.                 .requestMatchers().antMatchers("/api/**")
  13.                 .and()
  14.                 .authorizeRequests()
  15.                 .antMatchers("/api/**").authenticated()
  16.                 .and()
  17.                 .httpBasic();
  18.     }
  19. }

配置文件配置

  1. spring:
  2.   application:
  3.     name: eshop-member
  4.  
  5. server:
  6.   port: 1201
  7.  
  8. eureka:
  9.   instance:
  10.     prefer-ip-address: true
  11.     instance-id: ${spring.cloud.client.ip-address}:${server.port}
  12.   client:
  13.     service-url:
  14.       defaultZone: http://localhost:1111/eureka/
  15.  
  16. security:
  17.   oauth2:
  18.     resource:
  19.       id: eshop-member
  20.       user-info-uri: http://localhost:1202/auth/api/member
  21.       prefer-token-info: false

MemberApplication 主类配置

搜索公纵号：MarkerHub，关注回复[ vue ]获取前后端入门教程！

  1. @SpringBootApplication
  2. @EnableDiscoveryClient
  3. @EnableGlobalMethodSecurity(prePostEnabled = true)
  4. public class MemberApplication {
  5.  
  6.     public static void main(String[] args) {
  7.         SpringApplication.run(MemberApplication.class,args);
  8.     }
  9. }

提供对外接口

  1. @RestController
  2. @RequestMapping("/api")
  3. public class MemberController {
  4.  
  5.     @GetMapping("hello")
  6.     @PreAuthorize("hasAnyAuthority('hello')")
  7.     public String hello(){
  8.         return "hello";
  9.     }
  10.  
  11.     @GetMapping("current")
  12.     public Principal user(Principal principal) {
  13.         return principal;
  14.     }
  15.  
  16.     @GetMapping("query")
  17.     @PreAuthorize("hasAnyAuthority('query')")
  18.     public String query() {
  19.         return "具有query权限";
  20.     }
  21. }

配置网关

引入依赖

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0"
  3.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.     <parent>
  6.         <artifactId>eshop-parent</artifactId>
  7.         <groupId>com.curise.eshop</groupId>
  8.         <version>1.0-SNAPSHOT</version>
  9.     </parent>
  10.     <modelVersion>4.0.0</modelVersion>
  11.     <packaging>jar</packaging>
  12.     <artifactId>eshop-gateway</artifactId>
  13.     <description>网关</description>
  14.  
  15.     <dependencies>
  16.         <dependency>
  17.             <groupId>org.springframework.boot</groupId>
  18.             <artifactId>spring-boot-starter-web</artifactId>
  19.         </dependency>
  20.         <dependency>
  21.             <groupId>org.springframework.cloud</groupId>
  22.             <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>org.springframework.cloud</groupId>
  26.             <artifactId>spring-cloud-starter-netflix-zuul</artifactId>
  27.         </dependency>
  28.         <dependency>
  29.             <groupId>org.springframework.cloud</groupId>
  30.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  31.         </dependency>
  32.         <dependency>
  33.             <groupId>org.springframework.cloud</groupId>
  34.             <artifactId>spring-cloud-starter-security</artifactId>
  35.         </dependency>
  36.         <dependency>
  37.             <groupId>org.springframework.boot</groupId>
  38.             <artifactId>spring-boot-starter-actuator</artifactId>
  39.         </dependency>
  40.     </dependencies>
  41.  
  42.     <build>
  43.         <plugins>
  44.             <plugin>
  45.                 <groupId>org.springframework.boot</groupId>
  46.                 <artifactId>spring-boot-maven-plugin</artifactId>
  47.             </plugin>
  48.         </plugins>
  49.     </build>
  50. </project>

配置文件

  1. server:
  2.   port: 1202
  3.  
  4. spring:
  5.   application:
  6.     name: eshop-gateway
  7.  
  8. #--------------------eureka---------------------
  9. eureka:
  10.   instance:
  11.     prefer-ip-address: true
  12.     instance-id: ${spring.cloud.client.ip-address}:${server.port}
  13.   client:
  14.     service-url:
  15.       defaultZone: http://localhost:1111/eureka/
  16.  
  17. #--------------------Zuul-----------------------
  18. zuul:
  19.   routes:
  20.     member:
  21.       path: /member/**
  22.       serviceId: eshop-member
  23.       sensitiveHeaders: "*"
  24.     auth:
  25.       path: /auth/**
  26.       serviceId: eshop-auth
  27.       sensitiveHeaders: "*"
  28.   retryable: false
  29.   ignored-services: "*"
  30.   ribbon:
  31.     eager-load:
  32.       enabled: true
  33.   host:
  34.     connect-timeout-millis: 3000
  35.     socket-timeout-millis: 3000
  36.   add-proxy-headers: true
  37. #---------------------OAuth2---------------------
  38. security:
  39.   oauth2:
  40.     client:
  41.       access-token-uri: http://localhost:${server.port}/auth/oauth/token
  42.       user-authorization-uri: http://localhost:${server.port}/auth/oauth/authorize
  43.       client-id: web
  44.     resource:
  45.       user-info-uri:  http://localhost:${server.port}/auth/api/member
  46.       prefer-token-info: false
  47. #----------------------超时配置-------------------
  48. ribbon:
  49.   ReadTimeout: 3000
  50.   ConnectTimeout: 3000
  51.   MaxAutoRetries: 1
  52.   MaxAutoRetriesNextServer: 2
  53.   eureka:
  54.     enabled: true
  55. hystrix:
  56.   command:
  57.     default:
  58.       execution:
  59.         timeout:
  60.           enabled: true
  61.         isolation:
  62.           thread:
  63.             timeoutInMilliseconds: 3500

ZuulApplication 主类

  1. @SpringBootApplication
  2. @EnableDiscoveryClient
  3. @EnableZuulProxy
  4. @EnableOAuth2Sso
  5. public class ZuulApplication {
  6.     public static void main(String[] args) {
  7.         SpringApplication.run(ZuulApplication.class, args);
  8.     }
  9. }

Spring Security 配置

  1. @Configuration
  2. @EnableWebSecurity
  3. @Order(99)
  4. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  5.     @Override
  6.     protected void configure(HttpSecurity http) throws Exception {
  7.         http.csrf().disable();
  8.     }
  9. }

接下来分别启动 eshop-server、eshop-member、eshop-auth、eshop-gateway。

先发送一个请求测试一下未认证的效果

b1ad4ed79a45b13d02e526a569289b54.png

获取认证

d643a511f39500fef0ca89faeb4ee771.png

使用 access_token 请求 auth 服务下的用户信息接口

33f818d1885a9abbfb29d018481662e0.png

使用 access_token 请求 member 服务下的用户信息接口

30dd6834a772203213487d39e7935074.png

请求 member 服务的 query 接口

4d0c9fc8b0b8d906272c197390ac4024.png

请求 member 服务的 hello 接口，数据库里并没有给用户 hello 权限

b09531740c27e0d80e3a32a1a7b0707d.png

刷新 token

220dfa77d6d761d31c912bd121b50e21.png

注销

a0159d8a640915aae1dac915f7f03572.png

后续还会慢慢完善，敬请期待！！

关于代码和数据表 sql 已经上传到 GitHub。地址：https://github.com/WYA1993/springcloud_oauth2.0。

注意把数据库和 redis 替换成自己的地址

统一回复一下，有很多人反映获取认证时返回 401，如下：

{
    "timestamp": "2019-08-13T03:25:27.161+0000",
    "status": 401,
    "error": "Unauthorized",
    "message": "Unauthorized",
    "path": "/oauth/token"
}

原因是在发起请求的时候没有添加 Basic Auth 认证，如下图：

68372d242e7d1854d2aabbd6c8fd906f.png

，添加 Basic Auth 认证后会在 headers 添加一个认证消息头

2764852449cd443f3f6cd878109de57a.png

添加 Basic Auth 认证的信息在代码中有体现：

799d434927cf484b94112585e0d3b4e5.png

客户端信息和token信息从MySQL数据库中获取

现在客户端信息都是存在内存中的，生产环境肯定不可以这么做，要支持客户端的动态添加或删除，所以我选择把客户端信息存到MySQL中。

首先，创建数据表，数据表的结构官方已经给出，地址在

https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/test/resources/schema.sql

其次，需要修改一下sql脚本，把主键的长度改为128，LONGVARBINARY类型改为blob，调整后的sql脚本：

  1. create table oauth_client_details (
  2.   client_id VARCHAR(128) PRIMARY KEY,
  3.   resource_ids VARCHAR(256),
  4.   client_secret VARCHAR(256),
  5.   scope VARCHAR(256),
  6.   authorized_grant_types VARCHAR(256),
  7.   web_server_redirect_uri VARCHAR(256),
  8.   authorities VARCHAR(256),
  9.   access_token_validity INTEGER,
  10.   refresh_token_validity INTEGER,
  11.   additional_information VARCHAR(4096),
  12.   autoapprove VARCHAR(256)
  13. );
  14.  
  15. create table oauth_client_token (
  16.   token_id VARCHAR(256),
  17.   token BLOB,
  18.   authentication_id VARCHAR(128) PRIMARY KEY,
  19.   user_name VARCHAR(256),
  20.   client_id VARCHAR(256)
  21. );
  22.  
  23. create table oauth_access_token (
  24.   token_id VARCHAR(256),
  25.   token BLOB,
  26.   authentication_id VARCHAR(128) PRIMARY KEY,
  27.   user_name VARCHAR(256),
  28.   client_id VARCHAR(256),
  29.   authentication BLOB,
  30.   refresh_token VARCHAR(256)
  31. );
  32.  
  33. create table oauth_refresh_token (
  34.   token_id VARCHAR(256),
  35.   token BLOB,
  36.   authentication BLOB
  37. );
  38.  
  39. create table oauth_code (
  40.   code VARCHAR(256), authentication BLOB
  41. );
  42.  
  43. create table oauth_approvals (
  44.  userId VARCHAR(256),
  45.  clientId VARCHAR(256),
  46.  scope VARCHAR(256),
  47.  status VARCHAR(10),
  48.  expiresAt TIMESTAMP,
  49.  lastModifiedAt TIMESTAMP
  50. );
  51.  
  52.  
  53. -- customized oauth_client_details table
  54. create table ClientDetails (
  55.   appId VARCHAR(128) PRIMARY KEY,
  56.   resourceIds VARCHAR(256),
  57.   appSecret VARCHAR(256),
  58.   scope VARCHAR(256),
  59.   grantTypes VARCHAR(256),
  60.   redirectUrl VARCHAR(256),
  61.   authorities VARCHAR(256),
  62.   access_token_validity INTEGER,
  63.   refresh_token_validity INTEGER,
  64.   additionalInformation VARCHAR(4096),
  65.   autoApproveScopes VARCHAR(256)
  66. );

调整后的sql脚步也放到了GitHub中，需要的可以自行下载

215022702f859213f5b107b5bcae43b1.png

然后在eshop_member数据库创建数据表，将客户端信息添加到oauth_client_details表中

3c38ff1e1cd7803a4eefdb13230c5a95.png

如果你的密码不是明文，记得client_secret需要加密后存储。

然后修改代码，配置从数据库读取客户端信息

2644dc2c047cb3194fa15cb2b15161ff.png

接下来启动服务测试即可。

获取授权

216d04c2fb8d5ef6f9f5780661ab2214.png

获取用户信息

e1b2e889bf6ff4cda47b3ef2711b1e1a.png

刷新token

a56b16d4e391b830d9e11bb9c5dcba5e.png

打开数据表发现token这些信息并没有存到表中，因为tokenStore使用的是redis方式，我们可以替换为从数据库读取。修改配置

3a9995de76a492cf145da7f72f25e410.png

e673e9a7a6cf092e5f4b075d8236fddc.png

重启服务再次测试

3f8fec2c4affc83a237abc1ce2145f6c.png

7ebe1910c86afc27b06dacb528ffc12c.png

查看数据表，发现token数据已经存到表里了。

8d1e3d9275b921cb2965fc9ff6cb2c75.png

2d844e1f42b7f87da633e1c6bc5f3178.png

源码地址：https://github.com/WYA1993/springcloud_oauth2.0。

来自：CSDN，作者：myCat

链接：https://blog.csdn.net/WYA1993/article/details/85050120

（完）

  1. 【推荐阅读】
  2. 如何画出一张优秀的架构图（老鸟必备）
  3.  
  4. 被问 Linux 命令 su 和 sudo 的区别？当场蒙了！

好文章！点个在看！

本文内容由网友自发贡献，转载请注明出处：【wpsshop博客】
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号