devbox
小蓝xlanll
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Spring cloud OAuth2_spring-cloud-starter-oauth2

作者：小蓝xlanll | 2024-03-03 18:20:05

赞

踩

spring-cloud-starter-oauth2

1、OAuth2.0简介

OAuth（开发授权）是一个开放标准，允许用户授权第三方应用访问他们存储在另外的服务提供者上的信息，而不需要将用户名和密码提供给第三方应用或分享他们数据的所有内容。

OAuth2.0是OAuth的延续，但他并不兼容OAuth1.0，即它完全废除OAuth1.0。很多大公司如Google，Yahoo，Microsoft等都提供了OAuth认证服 务，这些都足以说明OAUTH标准逐渐成为开放资源授权的标准。

微信小程序授权登录同样也是提供OAuth认证服务

2、业务场景

第三方认证

当需要访问第三方系统的资源时需要首先通过第三方系统的认证（例如：微信认证），由第三方系统对用户认证通过，并授权资源的访问权限。

你恰好之前在我们的B网站上注册过账号，那么现在就可以使用B网站上的账号登录在CSDN上。那么我们在B网站上做这样的一个功能就是使用OAuth2做的。

OAuth2.0包含一下几种角色

1，客户端：本身不存储资源，需要通过资源拥有者的授权去请求资源服务器的资源。

2，资源拥有者：通常为用户，也可以是应用程序，即该资源的拥有者。

3，授权服务器（认证服务器）：用于服务提供商对资源拥有者的身份认证，对访问资源进行授权，认证成功后会给客户端发放令牌（access_token），作为客户端访问资源服务器的凭据。

4，资源服务器：存储资源的服务器

5，客户端标识：client_id

6，客户端密钥：client_secret

为什么要有client_id和client_secret呢？

因为服务提供商不能允许随便一个客户端就接入到它的授权服务器，服务提供商会 给准入的接入方一个身份，用于接入时的凭据。

3，环境搭建

  1. 项目工程

shop-oauth-service 认证服务（颁发Token）

shop-gateway-service 网关（认证用户的请求 也即认证Token）

shop-service 服务（资源服务）

  1. 项目依赖pom.xml文件

1.父模块pom.xml文件

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0"
  3.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.     <modelVersion>4.0.0</modelVersion>
  6.     <parent>
  7.         <groupId>org.springframework.boot</groupId>
  8.         <artifactId>spring-boot-starter-parent</artifactId>
  9.         <version>2.1.8.RELEASE</version>
  10.     </parent>
  11.     <groupId>com.lpz</groupId>
  12.     <artifactId>shop-parent</artifactId>
  13.     <packaging>pom</packaging>
  14.     <version>1.0-SNAPSHOT</version>
  15.     <modules>
  16.         <module>shop-server</module>
  17.         <module>shop-api</module>
  18.         <module>shop-gateway-server</module>
  19.         <module>shop-oauth-server</module>
  20.  
  21.     </modules>
  22.  
  23.     <properties>
  24.         <maven.compiler.source>8</maven.compiler.source>
  25.         <maven.compiler.target>8</maven.compiler.target>
  26.         <spring-cloud.version>Greenwich.SR3</spring-cloud.version>
  27.     </properties>
  28.     <dependencyManagement>
  29.         <dependencies>
  30.             <dependency>
  31.                 <groupId>org.springframework.cloud</groupId>
  32.                 <artifactId>spring-cloud-dependencies</artifactId>
  33.                 <version>${spring-cloud.version}</version>
  34.                 <type>pom</type>
  35.                 <scope>import</scope>
  36.             </dependency>
  37.             <dependency>
  38.                 <groupId>com.alibaba.cloud</groupId>
  39.                 <artifactId>spring-cloud-alibaba-dependencies</artifactId>
  40.                 <version>2.1.0.RELEASE</version>
  41.                 <type>pom</type>
  42.                 <scope>import</scope>
  43.             </dependency>
  44.         </dependencies>
  45.     </dependencyManagement>
  46. </project>

2.网关模块pom.xml文件

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0"
  3.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.     <parent>
  6.         <artifactId>shop-parent</artifactId>
  7.         <groupId>com.lpz</groupId>
  8.         <version>1.0-SNAPSHOT</version>
  9.     </parent>
  10.     <modelVersion>4.0.0</modelVersion>
  11.  
  12.     <artifactId>shop-gateway-server</artifactId>
  13.  
  14.     <properties>
  15.         <maven.compiler.source>8</maven.compiler.source>
  16.         <maven.compiler.target>8</maven.compiler.target>
  17.     </properties>
  18.     <dependencies>
  19.         <dependency>
  20.             <groupId>org.springframework.cloud</groupId>
  21.             <artifactId>spring-cloud-starter-gateway</artifactId>
  22.         </dependency>
  23.         <dependency>
  24.             <groupId>com.alibaba.cloud</groupId>
  25.             <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
  26.         </dependency>
  27.     </dependencies>
  28. </project>

3.shop-server模块pom.xml文件

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0"
  3.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.     <parent>
  6.         <artifactId>shop-parent</artifactId>
  7.         <groupId>com.lpz</groupId>
  8.         <version>1.0-SNAPSHOT</version>
  9.     </parent>
  10.     <modelVersion>4.0.0</modelVersion>
  11.  
  12.     <artifactId>shop-server</artifactId>
  13.     <packaging>pom</packaging>
  14.     <modules>
  15.         <module>shop-user-server</module>
  16.         <module>shop-goods-server</module>
  17.     </modules>
  18.  
  19.     <properties>
  20.         <maven.compiler.source>8</maven.compiler.source>
  21.         <maven.compiler.target>8</maven.compiler.target>
  22.     </properties>
  23.     <dependencies>
  24.         <dependency>
  25.             <groupId>mysql</groupId>
  26.             <artifactId>mysql-connector-java</artifactId>
  27.         </dependency>
  28.         <!--        服务注册/发现-->
  29.         <dependency>
  30.             <groupId>com.alibaba.cloud</groupId>
  31.             <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
  32.         </dependency>
  33.  
  34.         <dependency>
  35.             <groupId>com.baomidou</groupId>
  36.             <artifactId>mybatis-plus-boot-starter</artifactId>
  37.             <version>3.3.1.tmp</version>
  38.         </dependency>
  39.         <dependency>
  40.             <groupId>org.springframework.boot</groupId>
  41.             <artifactId>spring-boot-starter-test</artifactId>
  42.             <scope>test</scope>
  43.         </dependency>
  44.  
  45.         <dependency>
  46.             <groupId>org.springframework.boot</groupId>
  47.             <artifactId>spring-boot-starter-web</artifactId>
  48.         </dependency>
  49.  
  50.         <dependency>
  51.             <groupId>org.springframework.cloud</groupId>
  52.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  53.         </dependency>
  54.     </dependencies>
  55. </project>

4.shop-oauth-server模块pom.xml文件

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0"
  3.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.     <parent>
  6.         <artifactId>shop-parent</artifactId>
  7.         <groupId>com.lpz</groupId>
  8.         <version>1.0-SNAPSHOT</version>
  9.     </parent>
  10.     <modelVersion>4.0.0</modelVersion>
  11.  
  12.     <artifactId>shop-oauth-server</artifactId>
  13.  
  14.     <dependencies>
  15.         <!--        服务注册/发现-->
  16.         <dependency>
  17.             <groupId>com.alibaba.cloud</groupId>
  18.             <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
  19.         </dependency>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-web</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>mysql</groupId>
  26.             <artifactId>mysql-connector-java</artifactId>
  27.             <scope>runtime</scope>
  28.         </dependency>
  29.         <dependency>
  30.             <groupId>org.mybatis.spring.boot</groupId>
  31.             <artifactId>mybatis-spring-boot-starter</artifactId>
  32.             <version>1.1.1</version>
  33.         </dependency>
  34.  
  35.         <dependency>
  36.             <groupId>io.jsonwebtoken</groupId>
  37.             <artifactId>jjwt</artifactId>
  38.             <version>0.9.0</version>
  39.         </dependency>
  40.         <dependency>
  41.             <groupId>org.springframework.security</groupId>
  42.             <artifactId>spring-security-data</artifactId>
  43.         </dependency>
  44.         <dependency>
  45.             <groupId>org.springframework.cloud</groupId>
  46.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  47.             <exclusions>
  48.                 <exclusion>
  49.                     <groupId>org.springframework.security.oauth.boot</groupId>
  50.                     <artifactId>spring-security-oauth2-autoconfigure</artifactId>
  51.                 </exclusion>
  52.             </exclusions>
  53.         </dependency>
  54.  
  55.         <dependency>
  56.             <groupId>org.springframework.security.oauth.boot</groupId>
  57.             <artifactId>spring-security-oauth2-autoconfigure</artifactId>
  58.             <version>2.1.3.RELEASE</version>
  59.         </dependency>
  60.  
  61.  
  62.         <dependency>
  63.             <groupId>org.springframework.cloud</groupId>
  64.             <artifactId>spring-cloud-starter-security</artifactId>
  65.         </dependency>
  66.  
  67.         <dependency>
  68.             <groupId>org.springframework.boot</groupId>
  69.             <artifactId>spring-boot-starter-actuator</artifactId>
  70.         </dependency>
  71.  
  72.         <dependency>
  73.             <groupId>com.lpz</groupId>
  74.             <artifactId>shop-user-api</artifactId>
  75.             <version>1.0-SNAPSHOT</version>
  76.         </dependency>
  77.  
  78.     </dependencies>
  79.  
  80. </project>

shop-oauth-server yml配置文件

  1. server:
  2.   port: 1100
  3. spring:
  4.   application:
  5.     name: user-auth
  6.   datasource:
  7.     driver-class-name: com.mysql.jdbc.Driver
  8.     url: jdbc:mysql://127.0.0.1:3306/shop_oauth?useUnicode=true&characterEncoding=utf-8&useSSL=false&allowMultiQueries=true&serverTimezone=UTC
  9.     username: root
  10.     password: abc123
  11.   main:
  12.     allow-bean-definition-overriding: true
  13.   cloud:
  14.     nacos:
  15.       discovery:
  16.         server-addr: 192.168.56.1:8848
  17. auth:
  18.   ttl: 3600  #token存储到redis的过期时间
  19.   clientId: accp
  20.   clientSecret: accp
  21.   cookieDomain: localhost
  22.   cookieMaxAge: -1
  23. encrypt:
  24.   key-store:
  25.     location: classpath:/wfshop.jks
  26.     secret: wfshop
  27.     alias: wfshop
  28.     password: wfshop

AuthorizationServerConfig配置类

  1. package com.lpz.oauth.config;
  2.  
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.cloud.bootstrap.encrypt.KeyProperties;
  5. import org.springframework.context.annotation.Bean;
  6. import org.springframework.context.annotation.Configuration;
  7. import org.springframework.security.authentication.AuthenticationManager;
  8. import org.springframework.security.core.userdetails.UserDetailsService;
  9. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  10. import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
  11. import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
  12. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
  13. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
  14. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
  15. import org.springframework.security.oauth2.provider.ClientDetailsService;
  16. import org.springframework.security.oauth2.provider.client.JdbcClientDetailsService;
  17. import org.springframework.security.oauth2.provider.token.DefaultAccessTokenConverter;
  18. import org.springframework.security.oauth2.provider.token.TokenStore;
  19. import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
  20. import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
  21. import org.springframework.security.oauth2.provider.token.store.KeyStoreKeyFactory;
  22.  
  23. import javax.annotation.Resource;
  24. import javax.sql.DataSource;
  25. import java.security.KeyPair;
  26.  
  27.  
  28. @Configuration
  29. @EnableAuthorizationServer
  30. class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
  31.     //数据源，用于从数据库获取数据进行认证操作，测试可以从内存中获取
  32.     @Autowired
  33.     private DataSource dataSource;
  34.     //jwt令牌转换器
  35.     @Autowired
  36.     private JwtAccessTokenConverter jwtAccessTokenConverter;
  37.     //SpringSecurity 用户自定义授权认证类
  38.     @Autowired
  39.     UserDetailsService userDetailsService;
  40.     //授权认证管理器
  41.     @Autowired
  42.     AuthenticationManager authenticationManager;
  43.     //令牌持久化存储接口
  44.     @Autowired
  45.     TokenStore tokenStore;
  46.     @Autowired
  47.     private CustomUserAuthenticationConverter customUserAuthenticationConverter;
  48.  
  49.     /***
  50.      * 客户端信息配置
  51.      * @param clients
  52.      * @throws Exception
  53.      */
  54.     @Override
  55.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  56.         clients.jdbc(dataSource).clients(clientDetails());
  57. //        clients.inMemory()
  58. //                .withClient("changgou")          //客户端id
  59. //                .secret("changgou")                      //秘钥
  60. //                .redirectUris("http://localhost")       //重定向地址
  61. //                .accessTokenValiditySeconds(3600)          //访问令牌有效期
  62. //                .refreshTokenValiditySeconds(3600)         //刷新令牌有效期
  63. //                .authorizedGrantTypes(
  64. //                        "authorization_code",          //根据授权码生成令牌
  65. //                        "client_credentials",          //客户端认证
  66. //                        "refresh_token",                //刷新令牌
  67. //                        "password")                     //密码方式认证
  68. //                .scopes("app");                         //客户端范围，名称自定义，必填
  69.     }
  70.  
  71.     /***
  72.      * 授权服务器端点配置
  73.      * @param endpoints
  74.      * @throws Exception
  75.      */
  76.     @Override
  77.     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  78.         endpoints.accessTokenConverter(jwtAccessTokenConverter)
  79.                 .authenticationManager(authenticationManager)//认证管理器
  80.                 .tokenStore(tokenStore)                       //令牌存储
  81.                 .userDetailsService(userDetailsService);     //用户信息service
  82.     }
  83.  
  84.     /***
  85.      * 授权服务器的安全配置
  86.      * @param oauthServer
  87.      * @throws Exception
  88.      */
  89.     @Override
  90.     public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
  91.         oauthServer.allowFormAuthenticationForClients()
  92.                 .passwordEncoder(new BCryptPasswordEncoder())
  93.                 .tokenKeyAccess("permitAll()")
  94.                 .checkTokenAccess("isAuthenticated()");
  95.     }
  96.  
  97.  
  98.     //读取密钥的配置
  99.     @Bean("keyProp")
  100.     public KeyProperties keyProperties(){
  101.         return new KeyProperties();
  102.     }
  103.  
  104.     @Resource(name = "keyProp")
  105.     private KeyProperties keyProperties;
  106.  
  107.     //客户端配置
  108.     @Bean
  109.     public ClientDetailsService clientDetails() {
  110.         return new JdbcClientDetailsService(dataSource);
  111.     }
  112.  
  113.     @Bean
  114.     @Autowired
  115.     public TokenStore tokenStore(JwtAccessTokenConverter jwtAccessTokenConverter) {
  116.         return new JwtTokenStore(jwtAccessTokenConverter);
  117.     }
  118.  
  119.     /****
  120.      * JWT令牌转换器
  121.      * @param customUserAuthenticationConverter
  122.      * @return
  123.      */
  124.     @Bean
  125.     public JwtAccessTokenConverter jwtAccessTokenConverter(CustomUserAuthenticationConverter customUserAuthenticationConverter) {
  126.         JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  127.         KeyPair keyPair = new KeyStoreKeyFactory(
  128.                 keyProperties.getKeyStore().getLocation(),                          //证书路径 changgou.jks
  129.                 keyProperties.getKeyStore().getSecret().toCharArray())              //证书秘钥 changgouapp
  130.                 .getKeyPair(
  131.                         keyProperties.getKeyStore().getAlias(),                     //证书别名 changgou
  132.                         keyProperties.getKeyStore().getPassword().toCharArray());   //证书密码 changgou
  133.         converter.setKeyPair(keyPair);
  134.         //配置自定义的CustomUserAuthenticationConverter
  135.         DefaultAccessTokenConverter accessTokenConverter = (DefaultAccessTokenConverter) converter.getAccessTokenConverter();
  136.         accessTokenConverter.setUserTokenConverter(customUserAuthenticationConverter);
  137.         return converter;
  138.     }
  139. }
  140.

CustomUserAuthenticationConverter类

  1. package com.lpz.oauth.config;
  2.  
  3. import com.lpz.oauth.util.UserJwt;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.security.core.Authentication;
  6. import org.springframework.security.core.authority.AuthorityUtils;
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.security.core.userdetails.UserDetailsService;
  9. import org.springframework.security.oauth2.provider.token.DefaultUserAuthenticationConverter;
  10. import org.springframework.stereotype.Component;
  11.  
  12. import java.util.LinkedHashMap;
  13. import java.util.Map;
  14.  
  15. @Component
  16. public class CustomUserAuthenticationConverter extends DefaultUserAuthenticationConverter {
  17.  
  18.     @Autowired
  19.     UserDetailsService userDetailsService;
  20.  
  21.     @Override
  22.     public Map<String, ?> convertUserAuthentication(Authentication authentication) {
  23.         LinkedHashMap response = new LinkedHashMap();
  24.         String name = authentication.getName();
  25.         response.put("username", name);
  26.  
  27.         Object principal = authentication.getPrincipal();
  28.         UserJwt userJwt = null;
  29.         if(principal instanceof  UserJwt){
  30.             userJwt = (UserJwt) principal;
  31.         }else{
  32.             //refresh_token默认不去调用userdetailService获取用户信息，这里我们手动去调用，得到 UserJwt
  33.             UserDetails userDetails = userDetailsService.loadUserByUsername(name);
  34.             userJwt = (UserJwt) userDetails;
  35.         }
  36.         response.put("name", userJwt.getName());
  37.         response.put("id", userJwt.getId());
  38.         //公司 response.put("compy", "songsi");
  39.         if (authentication.getAuthorities() != null && !authentication.getAuthorities().isEmpty()) {
  40.             response.put("authorities", AuthorityUtils.authorityListToSet(authentication.getAuthorities()));
  41.         }
  42.         return response;
  43.     }
  44.  
  45. }

UserDetailsServiceImpl实现类

  1. package com.lpz.oauth.config;
  2.  
  3. import com.lpz.dto.TbUserDto;
  4. import com.lpz.feign.UserFeignService;
  5. import com.lpz.oauth.util.UserJwt;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.security.core.Authentication;
  8. import org.springframework.security.core.authority.AuthorityUtils;
  9. import org.springframework.security.core.context.SecurityContextHolder;
  10. import org.springframework.security.core.userdetails.User;
  11. import org.springframework.security.core.userdetails.UserDetails;
  12. import org.springframework.security.core.userdetails.UserDetailsService;
  13. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  14. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  15. import org.springframework.security.oauth2.provider.ClientDetails;
  16. import org.springframework.security.oauth2.provider.ClientDetailsService;
  17. import org.springframework.stereotype.Service;
  18. import org.springframework.util.StringUtils;
  19.  
  20. /*****
  21.  * 自定义授权认证类
  22.  */
  23. @Service
  24. public class UserDetailsServiceImpl implements UserDetailsService {
  25.  
  26.     @Autowired
  27.     ClientDetailsService clientDetailsService;
  28.     @Autowired
  29.     UserFeignService userFeignService;
  30.  
  31.     /****
  32.      * 自定义授权认证
  33.      * @param username
  34.      * @return
  35.      * @throws UsernameNotFoundException
  36.      */
  37.     @Override
  38.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  39.         //取出身份，如果身份为空说明没有认证
  40.         Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  41.         //没有认证统一采用httpbasic认证，httpbasic中存储了client_id和client_secret，开始认证client_id和client_secret
  42.         if (authentication == null) {
  43.             ClientDetails clientDetails = clientDetailsService.loadClientByClientId(username);
  44.             if (clientDetails != null) {
  45.                 //秘钥
  46.                 String clientSecret = clientDetails.getClientSecret();
  47.                 //静态方式
  48.                 // return new User(username,new BCryptPasswordEncoder().encode(clientSecret), AuthorityUtils.commaSeparatedStringToAuthorityList(""));
  49.                 //数据库查找方式
  50.                 return new User(username, clientSecret, AuthorityUtils.commaSeparatedStringToAuthorityList(""));
  51.             }
  52.         }
  53.  
  54.         if (StringUtils.isEmpty(username)) {
  55.             return null;
  56.         }
  57.  
  58.         //根据用户名查询用户信息
  59.         TbUserDto info = userFeignService.info(username);
  60.         String pwd = info.getPassword();
  61.         //创建User对象
  62.         String permissions = "goods_list,seckill_list";
  63.  
  64.  
  65.         UserJwt userDetails = new UserJwt(username, pwd, AuthorityUtils.commaSeparatedStringToAuthorityList(permissions));
  66.  
  67.  
  68.         //userDetails.setComy(songsi);
  69.         return userDetails;
  70.     }
  71. }

WebSecurityConfig配置类

  1. package com.lpz.oauth.config;
  2.  
  3. import org.springframework.context.annotation.Bean;
  4. import org.springframework.context.annotation.Configuration;
  5. import org.springframework.core.annotation.Order;
  6. import org.springframework.security.authentication.AuthenticationManager;
  7. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  8. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  9. import org.springframework.security.config.annotation.web.builders.WebSecurity;
  10. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  11. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  12. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  13. import org.springframework.security.crypto.password.PasswordEncoder;
  14.  
  15. @Configuration
  16. @EnableWebSecurity
  17. @Order(-1)
  18. class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  19.  
  20.     /***
  21.      * 忽略安全拦截的URL
  22.      * @param web
  23.      * @throws Exception
  24.      */
  25.     @Override
  26.     public void configure(WebSecurity web) throws Exception {
  27.         web.ignoring().antMatchers(
  28.                 "/oauth/login",
  29.                 "/user/logout");
  30.     }
  31.  
  32.     /***
  33.      * 创建授权管理认证对象
  34.      * @return
  35.      * @throws Exception
  36.      */
  37.     @Bean
  38.     @Override
  39.     public AuthenticationManager authenticationManagerBean() throws Exception {
  40.         AuthenticationManager manager = super.authenticationManagerBean();
  41.         return manager;
  42.     }
  43.  
  44.     @Override
  45.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  46.         super.configure(auth);
  47.     }
  48.  
  49.     /***
  50.      * 采用BCryptPasswordEncoder对密码进行编码
  51.      * @return
  52.      */
  53.     @Bean
  54.     public PasswordEncoder passwordEncoder() {
  55.         return new BCryptPasswordEncoder();
  56.     }
  57.  
  58.     /****
  59.      *
  60.      * @param http
  61.      * @throws Exception
  62.      */
  63.     @Override
  64.     public void configure(HttpSecurity http) throws Exception {
  65.         http.csrf().disable()
  66.                 .httpBasic()        //启用Http基本身份验证
  67.                 .and()
  68.                 .formLogin()       //启用表单身份验证
  69.                 .and()
  70.                 .authorizeRequests()    //限制基于Request请求访问
  71.                 .anyRequest()
  72.                 .authenticated();       //其他请求都需要经过验证
  73.  
  74.     }
  75. }

AuthToken工具类

  1. package com.lpz.oauth.util;
  2.  
  3. import java.io.Serializable;
  4.  
  5.  
  6. public class AuthToken implements Serializable{
  7.  
  8.     //令牌信息
  9.     String accessToken;
  10.     //刷新token(refresh_token)
  11.     String refreshToken;
  12.     //jwt短令牌
  13.     String jti;
  14.  
  15.     public String getAccessToken() {
  16.         return accessToken;
  17.     }
  18.  
  19.     public void setAccessToken(String accessToken) {
  20.         this.accessToken = accessToken;
  21.     }
  22.  
  23.     public String getRefreshToken() {
  24.         return refreshToken;
  25.     }
  26.  
  27.     public void setRefreshToken(String refreshToken) {
  28.         this.refreshToken = refreshToken;
  29.     }
  30.  
  31.     public String getJti() {
  32.         return jti;
  33.     }
  34.  
  35.     public void setJti(String jti) {
  36.         this.jti = jti;
  37.     }
  38. }

UserJwt工具类

  1. package com.lpz.oauth.util;
  2.  
  3.  
  4. import org.springframework.security.core.GrantedAuthority;
  5. import org.springframework.security.core.userdetails.User;
  6.  
  7. import java.util.Collection;
  8.  
  9.  
  10. public class UserJwt extends User {
  11.     private String id;    //用户ID
  12.     private String name;  //用户名字
  13.  
  14.     private String comny;//设置公司
  15.  
  16.     public UserJwt(String username, String password, Collection<? extends GrantedAuthority> authorities) {
  17.         super(username, password, authorities);
  18.     }
  19.  
  20.     public String getId() {
  21.         return id;
  22.     }
  23.  
  24.     public void setId(String id) {
  25.         this.id = id;
  26.     }
  27.  
  28.     public String getName() {
  29.         return name;
  30.     }
  31.  
  32.     public void setName(String name) {
  33.         this.name = name;
  34.     }
  35. }

ResourceServerConfig(资源服务器上的配置类)

  1. package com.lpz.config;
  2.  
  3. import org.springframework.context.annotation.Bean;
  4. import org.springframework.context.annotation.Configuration;
  5. import org.springframework.core.io.ClassPathResource;
  6. import org.springframework.core.io.Resource;
  7. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  8. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  9. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
  10. import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
  11. import org.springframework.security.oauth2.provider.token.TokenStore;
  12. import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
  13. import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
  14.  
  15. import java.io.BufferedReader;
  16. import java.io.IOException;
  17. import java.io.InputStreamReader;
  18. import java.util.stream.Collectors;
  19.  
  20. @Configuration
  21. @EnableResourceServer
  22. @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)//激活方法上的PreAuthorize注解
  23. public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
  24.  
  25.     //公钥
  26.     private static final String PUBLIC_KEY = "public.key";
  27.  
  28.     /***
  29.      * 定义JwtTokenStore
  30.      * @param jwtAccessTokenConverter
  31.      * @return
  32.      */
  33.     @Bean
  34.     public TokenStore tokenStore(JwtAccessTokenConverter jwtAccessTokenConverter) {
  35.         return new JwtTokenStore(jwtAccessTokenConverter);
  36.     }
  37.  
  38.     /***
  39.      * 定义JJwtAccessTokenConverter
  40.      * @return
  41.      */
  42.     @Bean
  43.     public JwtAccessTokenConverter jwtAccessTokenConverter() {
  44.         JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  45.         converter.setVerifierKey(getPubKey());
  46.         return converter;
  47.     }
  48.  
  49.     /**
  50.      * 获取非对称加密公钥 Key
  51.      *
  52.      * @return 公钥 Key
  53.      */
  54.     private String getPubKey() {
  55.         Resource resource = new ClassPathResource(PUBLIC_KEY);
  56.         try {
  57.             InputStreamReader inputStreamReader = new InputStreamReader(resource.getInputStream());
  58.             BufferedReader br = new BufferedReader(inputStreamReader);
  59.             return br.lines().collect(Collectors.joining("\n"));
  60.         } catch (IOException ioe) {
  61.             return null;
  62.         }
  63.     }
  64.  
  65.     /***
  66.      * Http安全配置，对每个到达系统的http请求链接进行校验
  67.      * @param http
  68.      * @throws Exception
  69.      */
  70.     @Override
  71.     public void configure(HttpSecurity http) throws Exception {
  72.         //所有请求必须认证通过
  73.         http.authorizeRequests()
  74.                 //下边的路径放行
  75.                 .antMatchers(
  76.                         "/tbuser/info/**"). //配置地址放行
  77.                 permitAll()
  78.                 .anyRequest().
  79.                 authenticated();    //其他地址需要认证授权
  80.     }
  81. }

gateway-server(全局过滤器代码)

  1. package com.lpz.filters;
  2.  
  3. import org.springframework.cloud.gateway.filter.GatewayFilterChain;
  4. import org.springframework.cloud.gateway.filter.GlobalFilter;
  5. import org.springframework.core.Ordered;
  6. import org.springframework.http.HttpStatus;
  7. import org.springframework.http.server.reactive.ServerHttpRequest;
  8. import org.springframework.http.server.reactive.ServerHttpResponse;
  9. import org.springframework.stereotype.Component;
  10. import org.springframework.util.StringUtils;
  11. import org.springframework.web.server.ServerWebExchange;
  12. import reactor.core.publisher.Mono;
  13.  
  14. @Component
  15. public class PowerFilters implements GlobalFilter, Ordered {
  16.     @Override
  17.     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
  18.         ServerHttpRequest request = exchange.getRequest();
  19.         ServerHttpResponse response = exchange.getResponse();
  20.         String path = request.getURI().getPath();
  21.         if (path.startsWith("/api/oauth/login")) {
  22.             return chain.filter(exchange);
  23.         }
  24.         String token = request.getQueryParams().getFirst("token");
  25.         if (StringUtils.isEmpty(token)) {
  26.             token = request.getHeaders().getFirst("token");
  27.             if (StringUtils.isEmpty(token)) {
  28.                 exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
  29.                 return exchange.getResponse().setComplete();
  30.             }
  31.         }
  32.         request.mutate().header("Authorization", "bearer " + token);
  33.         return chain.filter(exchange);
  34.     }
  35.  
  36.     @Override
  37.     public int getOrder() {
  38.         return 0;
  39.     }
  40. }

shop-oauth-server(AuthServiceImpl代码)

  1. package com.lpz.oauth.service.impl;
  2.  
  3. import com.lpz.oauth.service.AuthService;
  4. import com.lpz.oauth.util.AuthToken;
  5. import org.springframework.beans.factory.annotation.Autowired;
  6. import org.springframework.cloud.client.ServiceInstance;
  7. import org.springframework.cloud.client.discovery.DiscoveryClient;
  8. import org.springframework.http.HttpEntity;
  9. import org.springframework.http.HttpMethod;
  10. import org.springframework.http.ResponseEntity;
  11. import org.springframework.stereotype.Service;
  12. import org.springframework.util.Base64Utils;
  13. import org.springframework.util.LinkedMultiValueMap;
  14. import org.springframework.web.client.RestTemplate;
  15.  
  16. import java.util.Base64;
  17. import java.util.List;
  18. import java.util.Map;
  19. @Service
  20. public class AuthServiceImpl implements AuthService {
  21.     @Autowired
  22.     private RestTemplate restTemplate;
  23.     @Autowired
  24.     private DiscoveryClient discoveryClient;
  25.  
  26.     @Override
  27.     public AuthToken login(String username, String password, String clientId, String clientSecret) {
  28.         List<ServiceInstance> instances = discoveryClient.getInstances("oauth-server");
  29.         ServiceInstance serviceInstance = instances.get(0);
  30.         String url = "http://" + serviceInstance.getHost()+":" + serviceInstance.getPort() + "/oauth/token";
  31.         LinkedMultiValueMap<String, String> body = new LinkedMultiValueMap<>();
  32.         body.add("grant_type", "password");
  33.         body.add("username", username);
  34.         body.add("password", password);
  35.         LinkedMultiValueMap<String, String> head = new LinkedMultiValueMap<>();
  36.         head.add("Authorization", myEncoder(clientId, clientSecret));
  37.         ResponseEntity<Map> response = restTemplate.exchange(url, HttpMethod.POST, new HttpEntity<>(body, head), Map.class);
  38.         Map map = response.getBody();
  39.         System.out.println(map);
  40.         AuthToken authToken = new AuthToken();
  41.         authToken.setAccessToken(map.get("access_token").toString());
  42.         authToken.setJti(map.get("jti").toString());
  43.         authToken.setRefreshToken(map.get("refresh_token").toString());
  44.         return authToken;
  45.     }
  46.  
  47.     private static String myEncoder(String clientId, String clientSecret) {
  48.         String code = clientId + ":" + clientId;
  49.         byte[] encode = Base64Utils.encode(code.getBytes());
  50.         return "Basic " + new String(encode);
  51.  
  52.     }
  53.  
  54.     public static void main(String[] args) {
  55.         String s = myEncoder("changgou", "changgou");
  56.         System.out.println(s);
  57.     }
  58. }

4.资源服务授权流程

  1. 钥私钥授权流程

上图的业务流程如下:

  1. 客户端请求认证服务申请令牌
  2. 认证服务生成令牌认证服务采用非对称加密算法，使用私钥生成令牌。
  3. 客户端携带令牌访问资源服务客户端在Http header 中添加： Authorization：Bearer 令牌。
  4. 资源服务请求认证服务校验令牌的有效性资源服务接收到令牌，使用公钥校验令牌的合法性。
  5. 令牌有效，资源服务向客户端响应资源信息
2.公钥私钥

在对称加密的时代，加密和解密用的是同一个密钥，这个密钥既用于加密，又用于解密。这样做有一个明显的缺点，如果两个人之间传输文件，两个人都要知道密钥，如果是三个人呢，五个人呢？于是就产生了非对称加密，用一个密钥进行加密（公钥），用另一个密钥进行解密（私钥）。

总结：公钥加密、私钥解密、私钥签名、公钥验签。

3. 生成私钥公钥

Spring Security 提供对JWT的支持，本节我们使用Spring Security 提供的JwtHelper来创建JWT令牌，校验JWT令牌 等操作。 这里JWT令牌我们采用非对称算法进行加密，所以我们要先生成公钥和私钥。

(1)生成密钥证书 下边命令生成密钥证书，采用RSA 算法每个证书包含公钥和私钥

创建一个文件夹，在该文件夹下执行如下命令行：

keytool -genkeypair -alias qianggou -keyalg RSA -keypass qianggou -keystore qianggou.jks -storepass qianggou

Keytool 是一个java提供的证书管理工具

  1. -alias：密钥的别名 
  2. -keyalg：使用的hash算法 
  3. -keypass：密钥的访问密码 
  4. -keystore：密钥库文件名，qianggou.keystore保存了生成的证书 
  5. -storepass：密钥库的访问密码

查询证书信息

keytool -list -keystore qianggou.jks

删除别名

keytool -delete -alias qianggou -keystore qianggou.jsk
4.导出公钥

openssl是一个加解密工具包，这里使用openssl来导出公钥信息。

安装 openssl：http://slproweb.com/products/Win32OpenSSL.html

安装资料目录下的Win64OpenSSL-1_1_0g.exe

配置openssl的path环境变量，如下图：

本教程配置在C:\OpenSSL-Win64\bin

cmd进入qianggou.jks文件所在目录执行如下命令(如下命令在windows下执行，会把-变成中文方式，请将它改成英文的-)：

keytool -list -rfc --keystore qianggou.jks | openssl x509 -inform pem -pubkey

下面段内容是公钥

  1. -----BEGIN PUBLIC KEY-----
  2. MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhTN8iyCyQEZPUmLw0GB0
  3. rH0xeT23w4c8X8thfEtphIBTAKOoUKHxhzBHra/WHLpPw/fV/m9KTvbWCdlBziKW
  4. r4P//KtUoa5D3qJupsPDxl9GTXJjG/9y/E+9hHLtl+cM2Qu+RTayFQ4X4ZqLjiOc
  5. lZZjN8g3MUomu45ab7PVJvuNUGcMq8s+pSvIwHQejYVKlPH8amSqyyxEyzH2MFBX
  6. N1c0KoerMfaDV0uzFCsUdOxUlpow9byCPZAspuNbN3DG3xwoHtOErWcchs8TlGMy
  7. So2QAeGADmCkH/iIHbF22ytmybIsbK5Ww9T+a1xK+wzzKBAucL+HuK5hLwQlSyuq
  8. zQIDAQAB
  9. -----END PUBLIC KEY-----

将上边的公钥拷贝到文本public.key文件中，合并为一行,可以将它放到需要实现授权认证的工程中。

5.运行图

在运行之前我们再来梳理一下流程

本文内容由网友自发贡献，转载请注明出处：【wpsshop博客】
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号