devbox
小舞很执着
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Spring Boot2 使用 Spring Security + OAuth2 实现单点登录SSO_springboot oauth2.0单点登录

作者：小舞很执着 | 2024-06-29 06:32:43

赞

踩

springboot oauth2.0单点登录

前言

目前系统都是比较流行的微服务架构，在企业发展初期，企业使用的系统很少，通常一个或者两个，每个系统都有自己的登录模块，使用人员每天用自己的账号登录，很方便。但随着企业的发展，用到的微服务系统随之增多，使用人员在操作不同的系统时，需要多次登录，而且每个系统的账号都不一样，都要记录，这对于使用人员来说，很不方便还不友好。于是，就想到是不是可以在一个统一登录门户平台登录，其他系统就不用登录了呢？这就是单点登录要解决的问题。
单点登录英文全称Single sign On，简称就是SSO。它的解释是：在多个应用系统中，只需要登录一次，就可以访问其他相互信任的应用系统。

技术简述

使用当下最流行的SpringBoot2技术，持久层使用MyBatis，权限控制Spring Security，数据库MySql，基于OAuth2认证授权协议，构建一个易理解、高可用、高扩展性的分布式单点登录应用基层。

OAuth2授权方式

OAuth2为我们提供了四种授权方式：

  • 授权码模式（authorization code）
  • 简化模式（implicit）
  • 密码模式（resource owner password credentials）
  • 客户端模式（client credentials）

授权码模式：授权码相对其他三种来说是功能比较完整、流程最安全严谨的授权方式，通过客户端的后台服务器与服务提供商的认证服务器交互来完成。

简化模式：这种模式不通过服务器端程序来完成，直接由浏览器发送请求获取令牌，令牌是完全暴露在浏览器中的，这种模式不太安全。

密码模式：密码模式也是比较常用到的一种，客户端向授权服务器提供用户名、密码然后得到授权令牌。这种模式不过有种弊端，我们的客户端需要存储用户输入的密码，但是对于用户来说信任度不高的平台是不可能让他们输入密码的。

客户端模式：客户端模式是客户端以自己的名义去授权服务器申请授权令牌，并不是完全意义上的授权。

上述简单的介绍了OAuth2内部的四种授权方式，我们下面使用授权码模式进行微服务单点登录实现，并且我们使用数据库存储用户登录信息、客户端授权信息。

一 授权服务

创建Spring Boot2项目，版本：2.3.0，项目名称：cloud-sso-serve

1.1 pom.xml

  1.         <!-- oauth2 -->
  2. 		<dependency>
  3. 			<groupId>org.springframework.security.oauth.boot</groupId>
  4. 			<artifactId>spring-security-oauth2-autoconfigure</artifactId>
  5. 		</dependency>
  6.  
  7. 		<!-- thymeleaf 模板引擎 -->
  8. 		<dependency>
  9. 			<groupId>org.springframework.boot</groupId>
  10. 			<artifactId>spring-boot-starter-thymeleaf</artifactId>
  11. 		</dependency>
  12.  
  13. 		<!-- spring security -->
  14. 		<dependency>
  15. 			<groupId>org.springframework.boot</groupId>
  16. 			<artifactId>spring-boot-starter-security</artifactId>
  17. 		</dependency>

1.2 application.properties

  1. server.port=8087
  2. server.servlet.context-path=/sso
  3.  
  4. #启用优雅关机
  5. server.shutdown=graceful
  6. #缓冲10秒
  7. spring.lifecycle.timeout-per-shutdown-phase=10s
  8.  
  9. # mysql连接
  10. spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
  11. spring.datasource.url=jdbc:mysql://localhost:3306/sso?useUnicode=true&characterEncoding=UTF-8&userSSL=false&serverTimezone=GMT%2B8
  12. spring.datasource.username=root
  13. spring.datasource.password=root
  14. # druid web页面
  15. druid.login.enabled=false
  16. druid.login.username=druid
  17. druid.login.password=druid
  18. #druid连接池
  19. spring.datasource.type=com.alibaba.druid.pool.DruidDataSource
  20. spring.datasource.initialSize=20
  21. spring.datasource.minIdle=30
  22. spring.datasource.maxActive=50
  23. spring.datasource.maxWait=60000
  24. spring.datasource.timeBetweenEvictionRunsMillis=60000
  25. spring.datasource.minEvictableIdleTimeMillis=300000
  26. spring.datasource.validationQuery=SELECT 'x'
  27. spring.datasource.testWhileIdle=true
  28. spring.datasource.testOnBorrow=true
  29. spring.datasource.testOnReturn=true
  30. spring.datasource.poolPreparedStatements=true
  31. spring.datasource.maxPoolPreparedStatementPerConnectionSize=20
  32. spring.datasource.filters=stat
  33. spring.datasource.connectionProperties:druid.stat.slowSqlMillis=5000
  34.  
  35. # MyBatis 配置
  36. mybatis.mapper-locations=classpath*:mapper/**/*Mapper.xml
  37. # mybatis-plus 配置
  38. mybatis-plus.mapper-locations=classpath*:mapper/**/*Mapper.xml
  39. mybatis.configuration.jdbc-type-for-null=null
  40.  
  41. # thymeleaf 模板引擎配置
  42. spring.thymeleaf.mode=HTML5
  43. spring.thymeleaf.encoding=UTF-8
  44. spring.thymeleaf.servlet.content-type=text/html
  45. #开发时关闭缓存,不然没法看到实时页面
  46. spring.thymeleaf.cache=false
  47. #页面的存放路径就使用默认配置了
  48. spring.thymeleaf.prefix=classpath:/templates/
  49. spring.thymeleaf.check-template-location=true
  50. spring.thymeleaf.suffix=.html

1.3 数据库表

  1. CREATE TABLE `oauth_client_details` (
  2.   `client_id` VARCHAR(256) CHARACTER SET utf8 NOT NULL COMMENT '客户端唯一标识ID',
  3.   `resource_ids` VARCHAR(256) CHARACTER SET utf8 DEFAULT NULL COMMENT '客户端所能访问的资源id集合',
  4.   `client_secret` VARCHAR(256) CHARACTER SET utf8 DEFAULT NULL COMMENT '客户端访问密匙',
  5.   `scope` VARCHAR(256) CHARACTER SET utf8 DEFAULT NULL COMMENT '客户端申请的权限范围',
  6.   `authorized_grant_types` VARCHAR(256) CHARACTER SET utf8 DEFAULT NULL COMMENT '客户端授权类型',
  7.   `web_server_redirect_uri` VARCHAR(256) CHARACTER SET utf8 DEFAULT NULL COMMENT '客户端的重定向URI',
  8.   `authorities` VARCHAR(256) CHARACTER SET utf8 DEFAULT NULL COMMENT '客户端所拥有的权限值',
  9.   `access_token_validity` INT(11) DEFAULT NULL COMMENT '客户端access_token的有效时间(单位:秒)',
  10.   `refresh_token_validity` INT(11) DEFAULT NULL,
  11.   `additional_information` VARCHAR(4096) CHARACTER SET utf8 DEFAULT NULL COMMENT '预留的字段',
  12.   `autoapprove` VARCHAR(256) CHARACTER SET utf8 DEFAULT NULL COMMENT '是否跳过授权(true是，false否)',
  13.   PRIMARY KEY (`client_id`)
  14. ) ENGINE=INNODB DEFAULT CHARSET=utf8mb4 COMMENT='客户端授权表'
  15.  
  16. insert  into `oauth_client_details`
  17. (`client_id`,`resource_ids`,`client_secret`,`scope`,`authorized_grant_types`,`web_server_redirect_uri`,`authorities`,`access_token_validity`,`refresh_token_validity`,`additional_information`,`autoapprove`) values 
  18. ('client1',NULL,'$2a$10$zLD4yC3sL.n58Fh52EN3C.CKloW6GN3QeJrNPfGaqotaH04M2Ssm6','all','authorization_code,refresh_token','http://localhost:8086/client1/login',NULL,7200,NULL,NULL,'true'),
  19. ('client2',NULL,'$2a$10$zLD4yC3sL.n58Fh52EN3C.CKloW6GN3QeJrNPfGaqotaH04M2Ssm6','all','authorization_code,refresh_token','http://localhost:8085/client2/login',NULL,7200,NULL,NULL,'true');
  20.  
  21. CREATE TABLE `sys_menu` (
  22.   `menu_id` BIGINT(20) NOT NULL AUTO_INCREMENT COMMENT '菜单ID',
  23.   `menu_name` VARCHAR(50) NOT NULL COMMENT '菜单名称',
  24.   `menu_vice_name` VARCHAR(50) NOT NULL COMMENT '菜单副名称',
  25.   `parent_id` BIGINT(20) DEFAULT '0' COMMENT '父菜单ID',
  26.   `order_num` INT(4) DEFAULT '0' COMMENT '显示顺序',
  27.   `url` VARCHAR(200) DEFAULT '#' COMMENT '请求地址',
  28.   `menu_type` CHAR(1) DEFAULT '' COMMENT '菜单类型（M目录 C菜单 F按钮）',
  29.   `visible` CHAR(1) DEFAULT '0' COMMENT '菜单状态（0正常 1停用）',
  30.   `perms` VARCHAR(100) DEFAULT NULL COMMENT '权限标识',
  31.   `icon` VARCHAR(100) DEFAULT '#' COMMENT '菜单图标',
  32.   `create_by` VARCHAR(64) DEFAULT '' COMMENT '创建者',
  33.   `create_time` DATETIME DEFAULT NULL COMMENT '创建时间',
  34.   `update_by` VARCHAR(64) DEFAULT '' COMMENT '更新者',
  35.   `update_time` DATETIME DEFAULT NULL COMMENT '更新时间',
  36.   `remark` VARCHAR(500) DEFAULT '' COMMENT '备注',
  37.   PRIMARY KEY (`menu_id`)
  38. ) ENGINE=INNODB AUTO_INCREMENT=1091 DEFAULT CHARSET=utf8 COMMENT='菜单权限表'
  39.  
  40. CREATE TABLE `sys_role` (
  41.   `role_id` BIGINT(20) NOT NULL AUTO_INCREMENT COMMENT '角色ID',
  42.   `role_name` VARCHAR(30) NOT NULL COMMENT '角色名称',
  43.   `role_key` VARCHAR(100) NOT NULL COMMENT '角色权限字符串',
  44.   `role_sort` INT(4) NOT NULL COMMENT '显示顺序',
  45.   `status` CHAR(1) NOT NULL COMMENT '角色状态（0正常 1停用 2删除）',
  46.   `create_by` VARCHAR(64) DEFAULT '' COMMENT '创建者',
  47.   `create_time` DATETIME DEFAULT NULL COMMENT '创建时间',
  48.   `update_by` VARCHAR(64) DEFAULT '' COMMENT '更新者',
  49.   `update_time` DATETIME DEFAULT NULL COMMENT '更新时间',
  50.   `remark` VARCHAR(500) DEFAULT NULL COMMENT '备注',
  51.   PRIMARY KEY (`role_id`)
  52. ) ENGINE=INNODB AUTO_INCREMENT=26 DEFAULT CHARSET=utf8 COMMENT='角色信息表'
  53.  
  54. CREATE TABLE `sys_role_menu` (
  55.   `role_id` BIGINT(20) NOT NULL COMMENT '角色ID',
  56.   `menu_id` BIGINT(20) NOT NULL COMMENT '菜单ID',
  57.   PRIMARY KEY (`role_id`,`menu_id`)
  58. ) ENGINE=INNODB DEFAULT CHARSET=utf8 COMMENT='角色和菜单关联表'
  59.  
  60. CREATE TABLE `sys_user` (
  61.   `user_id` BIGINT(20) NOT NULL AUTO_INCREMENT COMMENT '用户ID',
  62.   `dept_id` BIGINT(20) DEFAULT NULL COMMENT '部门ID',
  63.   `login_name` VARCHAR(30) NOT NULL COMMENT '登录名称',
  64.   `user_name` VARCHAR(30) DEFAULT NULL COMMENT '用户名称',
  65.   `email` VARCHAR(50) DEFAULT '' COMMENT '用户邮箱',
  66.   `phone` VARCHAR(11) DEFAULT '' COMMENT '手机号码',
  67.   `telephone` VARCHAR(12) DEFAULT '' COMMENT '座机号码',
  68.   `duty` VARCHAR(30) DEFAULT '' COMMENT '职务',
  69.   `sex` CHAR(1) DEFAULT '0' COMMENT '用户性别（0男 1女 2未知）',
  70.   `avatar` VARCHAR(100) DEFAULT '' COMMENT '头像路径',
  71.   `password` VARCHAR(100) DEFAULT '' COMMENT '密码',
  72.   `salt` VARCHAR(20) DEFAULT '' COMMENT '盐加密',
  73.   `status` CHAR(1) DEFAULT '0' COMMENT '状态（0正常 1停用 2删除）',
  74.   `login_ip` VARCHAR(50) DEFAULT '' COMMENT '最后登陆IP',
  75.   `login_date` DATETIME DEFAULT NULL COMMENT '最后登陆时间',
  76.   `create_by` VARCHAR(64) DEFAULT '' COMMENT '创建者',
  77.   `create_time` DATETIME DEFAULT NULL COMMENT '创建时间',
  78.   `update_by` VARCHAR(64) DEFAULT '' COMMENT '更新者',
  79.   `update_time` DATETIME DEFAULT NULL COMMENT '更新时间',
  80.   `remark` VARCHAR(500) DEFAULT NULL COMMENT '备注',
  81.   PRIMARY KEY (`user_id`)
  82. ) ENGINE=INNODB AUTO_INCREMENT=61 DEFAULT CHARSET=utf8 COMMENT='用户信息表'
  83.  
  84. insert  into `sys_user`
  85. (`user_id`,`dept_id`,`login_name`,`user_name`,`email`,`phone`,`telephone`,`duty`,`sex`,`avatar`,`password`,`salt`,`status`,`login_ip`,`login_date`,`create_by`,`create_time`,`update_by`,`update_time`,`remark`) values 
  86. (1,1,'admin','admin','admin@sina.cn','','','','0','','123','111','0','10.96.217.201','2021-02-25 11:15:51','',NULL,'',NULL,NULL);
  87.  
  88. CREATE TABLE `sys_user_role` (
  89.   `user_id` BIGINT(20) NOT NULL COMMENT '用户ID',
  90.   `role_id` BIGINT(20) NOT NULL COMMENT '角色ID',
  91.   PRIMARY KEY (`user_id`,`role_id`)
  92. ) ENGINE=INNODB DEFAULT CHARSET=utf8 COMMENT='用户和角色关联表'
  93.

1.4 代码实现

1.4.1 AuthorizationServerConfig客户端授权配置

  1. package com.modules.common.config;
  2.  
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.context.annotation.Bean;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
  7. import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
  8. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
  9. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
  10. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
  11. import org.springframework.security.oauth2.provider.token.TokenStore;
  12. import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
  13. import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
  14.  
  15. import javax.sql.DataSource;
  16.  
  17. /**
  18.  *  客户端授权配置
  19.  */
  20. @Configuration
  21. @EnableAuthorizationServer  //  开启授权服务器
  22. public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
  23.  
  24.     @Autowired
  25.     private DataSource dataSource;
  26.  
  27.     /**
  28.      * 配置第三方应用，可以放在内存（inMemory），数据库
  29.      * 四种授权模式（"authorization_code", "password", "client_credentials", "implicit", "refresh_token"）
  30.      * 1、授权码模式（authorization code）(正宗方式)(支持refresh token)
  31.      * 2、密码模式（password）(为遗留系统设计)(支持refresh token)
  32.      * 3、客户端模式（client_credentials）(为后台api服务消费者设计)(不支持refresh token)
  33.      * 4、简化模式（implicit）(为web浏览器应用设计)(不支持refresh token)
  34.      *
  35.      * @param clients
  36.      * @throws Exception
  37.      */
  38.     @Override
  39.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  40.         clients.jdbc(dataSource);
  41.     }
  42.  
  43.     /**
  44.      * 需要暴露授权服务器端点
  45.      *
  46.      * @param endpoints
  47.      * @throws Exception
  48.      */
  49.     @Override
  50.     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  51.         endpoints.accessTokenConverter(jwtAccessTokenConverter());
  52.         endpoints.tokenStore(jwtTokenStore());
  53. //        endpoints.tokenServices(defaultTokenServices());
  54.     }
  55.  
  56.     @Override
  57.     public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
  58.         security.allowFormAuthenticationForClients();
  59.         security.tokenKeyAccess("isAuthenticated()");
  60.     }
  61.  
  62.  
  63.     /**
  64.      * 配置TokenStore，有多种实现方式，redis，jwt，jdbc
  65.      * @return
  66.      */
  67.     @Bean
  68.     public TokenStore jwtTokenStore() {
  69.         return new JwtTokenStore(jwtAccessTokenConverter());
  70.     }
  71.  
  72.     @Bean
  73.     public JwtAccessTokenConverter jwtAccessTokenConverter(){
  74.         JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  75.         converter.setSigningKey("testKey");
  76.         return converter;
  77.     }
  78. }

1.4.2 SpringSecurityConfig权限配置

  1. package com.modules.common.config;
  2.  
  3. import com.modules.system.service.SysLoginService;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.context.annotation.Bean;
  6. import org.springframework.context.annotation.Configuration;
  7. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  8. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  9. import org.springframework.security.config.annotation.web.builders.WebSecurity;
  10. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  11. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  12. import org.springframework.security.core.userdetails.UserDetailsService;
  13. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  14. import org.springframework.security.crypto.password.PasswordEncoder;
  15.  
  16. /**
  17.  *  spring security配置
  18.  * @author li'chao
  19.  */
  20. @Configuration
  21. @EnableWebSecurity
  22. public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
  23.  
  24.  
  25.     /**
  26.      * 自定义用户认证逻辑
  27.      */
  28.     @Autowired
  29.     private SysLoginService sysLoginService;
  30.  
  31.  
  32.     @Override
  33.     protected void configure(HttpSecurity http) throws Exception {
  34.         http.formLogin()
  35.                 .loginPage("/login")
  36.                 .and()
  37.                 .authorizeRequests()
  38.                 .antMatchers("/login").permitAll()
  39.                 .anyRequest()
  40.                 .authenticated()
  41.                 .and().csrf().disable().cors();
  42. /*        http
  43.                 .requestMatchers().antMatchers("/oauth/**","/login/**","/logout/**")
  44.                 .and()
  45.                 .authorizeRequests()
  46.                 .antMatchers("/oauth/**").authenticated()
  47.                 .and()
  48.                 .formLogin().permitAll();*/
  49.     }
  50.  
  51.     @Override
  52.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  53.         auth.userDetailsService(sysLoginService).passwordEncoder(passwordEncoder());
  54.     }
  55.  
  56.     /**
  57.      * 强散列哈希加密实现
  58.      */
  59.     @Bean
  60.     public PasswordEncoder passwordEncoder() {
  61.         return new BCryptPasswordEncoder();
  62.     }
  63.  
  64.     @Override
  65.     public void configure(WebSecurity web) throws Exception {
  66.         web.ignoring().antMatchers("/assets/**", "/css/**", "/images/**");
  67.     }
  68.  
  69. }
  70.

1.4.3 SysLoginService登录处理业务

  1. package com.modules.system.service;
  2.  
  3. import com.baomidou.mybatisplus.toolkit.CollectionUtils;
  4. import com.modules.system.entity.SysUser;
  5. import lombok.extern.slf4j.Slf4j;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  8. import org.springframework.security.core.userdetails.User;
  9. import org.springframework.security.core.userdetails.UserDetails;
  10. import org.springframework.security.core.userdetails.UserDetailsService;
  11. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  12. import org.springframework.security.crypto.password.PasswordEncoder;
  13. import org.springframework.stereotype.Component;
  14.  
  15. import java.util.ArrayList;
  16. import java.util.List;
  17.  
  18. /**
  19.  * 用户登录 业务层
  20.  * @author li'chao
  21.  *
  22.  */
  23. @Slf4j
  24. @Component
  25. public class SysLoginService implements UserDetailsService {
  26.  
  27.     @Autowired
  28.     private PasswordEncoder passwordEncoder;
  29.  
  30.     @Autowired
  31.     private SysUserService sysUserService;
  32.  
  33.     @Autowired
  34.     private SysMenuService sysMenuService;
  35.  
  36.     @Override
  37.     public UserDetails loadUserByUsername(String name) throws UsernameNotFoundException {
  38.         // 根据登录名称查询用户信息
  39.         SysUser sysUser = sysUserService.selectUserByLoginName(name);
  40.         if (null == sysUser) {
  41.             log.warn("用户{}不存在", name);
  42.             throw new UsernameNotFoundException(name);
  43.         }
  44.         // 根据用户ID查询权限配置的菜单，获取菜单标识字段perms
  45.         List<String> permsList = sysMenuService.selectPermsListByUserId(sysUser.getUserId());
  46.         permsList.remove(null);
  47.         List<SimpleGrantedAuthority> authorityList = new ArrayList<>();
  48.         if(!CollectionUtils.isEmpty(permsList)){
  49.             for(String str : permsList){
  50.                 authorityList.add(new SimpleGrantedAuthority(str));
  51.             }
  52.         }
  53.  
  54.         return new User(sysUser.getLoginName(), passwordEncoder.encode(sysUser.getPassword()), authorityList);
  55.     }
  56. }

1.4.4 LoginController登录处理

  1. package com.modules.system.controller;
  2.  
  3. import com.modules.common.web.BaseController;
  4. import com.modules.system.service.SysUserService;
  5. import io.swagger.annotations.Api;
  6. import lombok.extern.slf4j.Slf4j;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
  9. import org.springframework.stereotype.Controller;
  10. import org.springframework.web.bind.annotation.CrossOrigin;
  11. import org.springframework.web.bind.annotation.GetMapping;
  12. import org.springframework.web.bind.annotation.RequestMapping;
  13.  
  14. import javax.servlet.http.HttpServletRequest;
  15. import javax.servlet.http.HttpServletResponse;
  16. import java.io.IOException;
  17.  
  18. /**
  19.  * 登录管理
  20.  * @author lc
  21.  */
  22. @Api(tags = "登录管理")
  23. @Slf4j
  24. @CrossOrigin
  25. @Controller
  26. public class LoginController extends BaseController
  27. {
  28.  
  29.     @Autowired
  30.     private SysUserService userService;
  31.  
  32.     /**
  33.      * 自定义登录页面
  34.      * @return
  35.      */
  36.     @GetMapping("/login")
  37.     public String login() {
  38.         return "login";
  39.     }
  40.  
  41.     /**
  42.      * 登录成功后显示的首页
  43.      * @return
  44.      */
  45.     @GetMapping("/")
  46.     public String index() {
  47.         return "index";
  48.     }
  49.  
  50.     @RequestMapping("oauth/exit")
  51.     public void exit(HttpServletRequest request, HttpServletResponse response) {
  52.         new SecurityContextLogoutHandler().logout(request, null, null);
  53.         try {
  54.             System.out.println(request.getHeader("referer"));
  55.             response.sendRedirect(request.getHeader("referer"));
  56.         } catch (IOException e) {
  57.             e.printStackTrace();
  58.         }
  59.     }
  60. }

1.4.5 自定义登录页面

  1. <!DOCTYPE html>
  2. <html xmlns:th="http://www.thymeleaf.org">
  3. <head>
  4.     <meta charset="utf-8">
  5.     <meta http-equiv="X-UA-Compatible" content="IE=edge">
  6.     <title>Ela Admin - HTML5 Admin Template</title>
  7.     <meta name="description" content="Ela Admin - HTML5 Admin Template">
  8.     <meta name="viewport" content="width=device-width, initial-scale=1">
  9.  
  10.     <link type="text/css" rel="stylesheet" th:href="@{/assets/css/normalize.css}">
  11.     <link type="text/css" rel="stylesheet" th:href="@{/assets/bootstrap-4.3.1-dist/css/bootstrap.min.css}">
  12.     <link type="text/css" rel="stylesheet" th:href="@{/assets/css/font-awesome.min.css}">
  13.     <link type="text/css" rel="stylesheet" th:href="@{/assets/css/style.css}">
  14.  
  15. </head>
  16. <body class="bg-dark">
  17. <script type="text/javascript" th:src="@{/assets/js/jquery-2.1.4.min.js}"></script>
  18. <script type="text/javascript" th:src="@{/assets/bootstrap-4.3.1-dist/js/bootstrap.min.js}"></script>
  19. <script type="text/javascript" th:src="@{/assets/js/main.js}"></script>
  20. <div class="sufee-login d-flex align-content-center flex-wrap">
  21.     <div class="container">
  22.         <div class="login-content">
  23.             <div class="login-logo">
  24.                 <h1 style="color: #57bf95;">统一登录综合管理平台</h1>
  25.             </div>
  26.             <div class="login-form">
  27.                 <form th:action="@{/login}" method="post">
  28.                     <div class="form-group">
  29.                         <label>登录名称</label>
  30.                         <input type="text" class="form-control" name="username" placeholder="请输入登录名称">
  31.                     </div>
  32.                     <div class="form-group">
  33.                         <label>密码</label>
  34.                         <input type="password" class="form-control" name="password" placeholder="请输入登录密码">
  35.                         <span style="color: red" ></span>
  36.                     </div>
  37.                     <div class="checkbox">
  38.                         <label>
  39.                             <input type="checkbox"> 记住我
  40.                         </label>
  41.                         <label class="pull-right">
  42.                             <a href="#">忘记密码</a>
  43.                         </label>
  44.                     </div>
  45.                     <button type="submit" class="btn btn-success btn-flat m-b-30 m-t-30" style="font-size: 18px;">登录</button>
  46.                     <p style="color: red" th:if="${param.error}" th:text="${session?.SPRING_SECURITY_LAST_EXCEPTION?.message}" ></p>
  47.                 </form>
  48.             </div>
  49.         </div>
  50.     </div>
  51. </div>
  52. </body>
  53. </html>

1.4.6 登录成功后首页

  1. <!DOCTYPE html>
  2. <html lang="en" >
  3. <head>
  4.   <meta charset="utf-8">
  5.   <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
  6.   <title>综合管理平台</title>
  7.   <link rel="stylesheet" href="css/style.css">
  8. </head>
  9. <body>
  10.   <div class="container-scroller">
  11.     <!-- partial -->
  12.     <div class="container-fluid page-body-wrapper">
  13.       <div class="main-panel">
  14.         <div class="content-wrapper">
  15.           <div class="page-header">
  16.             <h3 class="page-title">
  17.               <span class="page-title-icon bg-gradient-primary text-white mr-2">
  18.                 <i class="mdi mdi-home"></i>                 
  19.               </span>
  20.               欢迎来到综合管理平台
  21.             </h3>
  22.           </div>
  23.           <div class="row">
  24.             <div class="col-md-4 stretch-card grid-margin">
  25.                 <div class="card bg-gradient-danger card-img-holder text-white">
  26.                   <div class="card-body">
  27.                     <img src="images/dashboard/circle.svg" class="card-img-absolute" alt="circle-image"/>
  28.                     <h2 class="mb-5"><a href="http://localhost:8086/client1/list" style="color: white">商品管理系统</a></h2>
  29.                   </div>
  30.                 </div>
  31.             </div>
  32.             <div class="col-md-4 stretch-card grid-margin">
  33.               <div class="card bg-gradient-info card-img-holder text-white">
  34.                 <div class="card-body">
  35.                   <img src="images/dashboard/circle.svg" class="card-img-absolute" alt="circle-image"/>
  36.                   <h2 class="mb-5"><a href="http://localhost:8083/orderSystem/order/list" style="color: white">订单管理系统</a></h2>
  37.                 </div>
  38.               </div>
  39.             </div>
  40.             <div class="col-md-4 stretch-card grid-margin">
  41.               <div class="card bg-gradient-success card-img-holder text-white">
  42.                 <div class="card-body">
  43.                   <img src="images/dashboard/circle.svg" class="card-img-absolute" alt="circle-image"/>
  44.                   <h2 class="mb-5">营销管理系统</h2>
  45.                 </div>
  46.               </div>
  47.             </div>
  48.           </div>
  49.  
  50.           <div class="row">
  51.             <div class="col-md-4 stretch-card grid-margin">
  52.               <div class="card bg-gradient-danger card-img-holder text-white">
  53.                 <div class="card-body">
  54.                   <img src="images/dashboard/circle.svg" class="card-img-absolute" alt="circle-image"/>    
  55.                   <h2 class="mb-5">运营管理系统</h2>
  56.                 </div>
  57.               </div>
  58.             </div>
  59.             <div class="col-md-4 stretch-card grid-margin">
  60.               <div class="card bg-gradient-info card-img-holder text-white">
  61.                 <div class="card-body">
  62.                   <img src="images/dashboard/circle.svg" class="card-img-absolute" alt="circle-image"/>
  63.                   <h2 class="mb-5">商户管理系统</h2>
  64.                 </div>
  65.               </div>
  66.             </div>
  67.             <div class="col-md-4 stretch-card grid-margin">
  68.               <div class="card bg-gradient-success card-img-holder text-white">
  69.                 <div class="card-body">
  70.                   <img src="images/dashboard/circle.svg" class="card-img-absolute" alt="circle-image"/>
  71.                   <h2 class="mb-5">财务管理系统</h2>
  72.                 </div>
  73.               </div>
  74.             </div>
  75.           </div>
  76.         </div>
  77.         <!-- content-wrapper ends -->
  78.         <!-- partial -->
  79.       </div>
  80.       <!-- main-panel ends -->
  81.     </div>
  82.     <!-- page-body-wrapper ends -->
  83.   </div>
  84.   <!-- container-scroller -->
  85. </body>
  86. </html>

1.4.7 测试

登录页面：admin/123

登录成功

至此，授权服务实现完成，此间使用授权码模式实现，客户端信息存入数据库，登录页面进行自定义。

二 客户端服务

创建Spring Boot2项目，版本：2.3.0，项目名称：cloud-goods-client

2.1 pom.xml

  1.         <!-- oauth2 -->
  2. 		<dependency>
  3. 			<groupId>org.springframework.security.oauth.boot</groupId>
  4. 			<artifactId>spring-security-oauth2-autoconfigure</artifactId>
  5. 		</dependency>
  6.  
  7. 		<!-- thymeleaf 模板引擎 -->
  8. 		<dependency>
  9. 			<groupId>org.springframework.boot</groupId>
  10. 			<artifactId>spring-boot-starter-thymeleaf</artifactId>
  11. 		</dependency>
  12.  
  13. 		<!-- spring security -->
  14. 		<dependency>
  15. 			<groupId>org.springframework.boot</groupId>
  16. 			<artifactId>spring-boot-starter-security</artifactId>
  17. 		</dependency>

2.2 application.yml

  1. server:
  2.   port: 8086
  3.   servlet:
  4.     context-path: /client1
  5.  
  6. auth-server: http://localhost:8087/sso
  7.  
  8. security:
  9.   oauth2:
  10.     client:
  11.       client-id: client1
  12.       client-secret: 123456
  13.       user-authorization-uri: ${auth-server}/oauth/authorize
  14.       access-token-uri: ${auth-server}/oauth/token
  15.     resource:
  16.       jwt:
  17.         key-uri: ${auth-server}/oauth/token_key
  18.  
  19. # thymeleaf 模板引擎配置
  20. spring:
  21.   thymeleaf:
  22.     mode: HTML5
  23.     encoding: utf-8
  24.     servlet:
  25.       content-type: text/html
  26.     # 开发时关闭缓存,不然没法看到实时页面
  27.     cache: true
  28.     # 页面的存放路径就使用默认配置了
  29.     prefix: classpath:/templates/
  30.     check-template-location: true
  31.     suffix: .html

2.3 代码实现

2.3.1 WebSecurityConfigurer配置

  1. package com.modules.config;
  2.  
  3.  
  4. import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  7. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  8. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  9. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  10.  
  11. @Configuration
  12. @EnableWebSecurity
  13. @EnableGlobalMethodSecurity(prePostEnabled = true)
  14. @EnableOAuth2Sso
  15. public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
  16.  
  17.     @Override
  18.     public void configure(HttpSecurity http) throws Exception {
  19.         http.antMatcher("/**").authorizeRequests()
  20.                 .anyRequest().authenticated();
  21.     }
  22. }

2.3.2 TestController 测试

  1. package com.modules.controller;
  2.  
  3. import org.springframework.security.access.prepost.PreAuthorize;
  4. import org.springframework.stereotype.Controller;
  5. import org.springframework.web.bind.annotation.GetMapping;
  6.  
  7. @Controller
  8. public class TestController {
  9.  
  10.     @GetMapping("/list")
  11.     @PreAuthorize("hasAuthority('ROLE_NORMAL')")
  12.     public String list( ) {
  13.         return "list";
  14.     }
  15. }

2.3.3 自定义模拟列表显示

  1. <!DOCTYPE html>
  2. <html lang="zh" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>商品管理系统</title>
  6. </head>
  7. <body>
  8. <h3><span>商品管理系统</span> | <a th:href="@{/logout}">退出</a> </h3>
  9. <h2>这是一个商品管理列表页面</h2>
  10. </body>
  11. </html>

2.3.4 测试

访问客户端 http://localhost:8086/client1/list 自动跳转授权服务器登录页面 http://localhost:8087/upms/login

输入登录名称和密码，自动跳转到客户端 http://localhost:8086/client1/list

访问服务器 http://localhost:8087/upms/

因为我在商品管理系统添加了超链接 http://localhost:8086/client1/list，点击商品管理系统，自动跳转到客户端

至此，客户端微服务集成单点登录完成，多个客户端服务如此集成即可。

源码地址：https://gitee.com/lichao12/spring-boot2-security-oauth2-jwt

参考：OAuth2实现单点登录SSO - 废物大师兄 - 博客园

本文内容由网友自发贡献，转载请注明出处：【wpsshop博客】
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号