devbox
我家小花儿
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Spring cloud oauth2搭建OAuth2.0授权服务_springcloud ouath2 allowformauthenticationforclien

作者：我家小花儿 | 2024-04-29 03:12:23

赞

踩

springcloud ouath2 allowformauthenticationforclients

我理解的OAuth2.0

首先这是一种授权协议，个人理解这个协议最大的好处是可以使用第三方client进行登录，比如我们在登录csdn博客的时候，可以不必使用用户名密码，直接微信或者qq扫码登录即可。相比与普通的用户名密码登录授权，OAuth2.0多了一个client的概念，client即是你开发的网站，比如要接入微信的登录，你需要在微信网站应用开发创建审核相应的材料，然后获取APPId，此APPID即是client id，通过此client id，即可以使用微信的授权服务，获取token，进行网站的访问。

此处完全是我自己对于OAuth2的理解，如果不对之处，欢迎大佬批评指正。

OAuth2.0的四种授权模式

1. 授权码许可类型（Authorization Code）

2.隐式许可类型（Implicit）

3.客户端凭据许可（Client Credentials）

4.资源拥有者凭据许可（Resource Owner Password Credentials）

在这里我只说一下最复杂的授权码许可类型，其他的三种请参考OAuth 2.0 的四种方式。

授权码许可类型是最复杂的授权模式，其流程如下所示。登录客户端需要先获得授权码（authorization_code），然后利用code换取access_token。

代码讲解

总体概述

代码讲解分为两个部分，一个是授权服务，一个是资源服务，资源服务代码主要为了验证生成的access_token能访问相应的资源。

 整个项目的pom文件如下。

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xmlns="http://maven.apache.org/POM/4.0.0"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.     <modelVersion>4.0.0</modelVersion>
  6.  
  7.     <groupId>com.hz.oauth</groupId>
  8.     <artifactId>authority-management-sys-2.0</artifactId>
  9.     <version>1.0</version>
  10.  
  11.     <parent>
  12.         <groupId>org.springframework.boot</groupId>
  13.         <artifactId>spring-boot-starter-parent</artifactId>
  14.         <version>2.2.1.RELEASE</version>
  15.     </parent>
  16.  
  17.     <modules>
  18.         <module>oauth2-resource</module>
  19.         <module>oauth2-server</module>
  20.     </modules>
  21.  
  22.     <packaging>pom</packaging>
  23.  
  24.     <properties>
  25.         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
  26.         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
  27.         <java.version>1.8</java.version>
  28.         <org.apache.common.lang3.version>3.12.0</org.apache.common.lang3.version>
  29.         <spring-framework.cloud.version>Greenwich.SR4</spring-framework.cloud.version>
  30.         <org.apache.common.beanutils.version>1.9.4</org.apache.common.beanutils.version>
  31.         <com.baomidou.mybatis-plus.version>3.4.3</com.baomidou.mybatis-plus.version>
  32.         <mysql.connector.java.version>8.0.12</mysql.connector.java.version>
  33.         <com.alibaba.fastjson.version>1.2.76</com.alibaba.fastjson.version>
  34.  
  35.         <!--Lombok-->
  36.         <lombok.version>1.18.10</lombok.version>
  37.         <commons-io.version>2.6</commons-io.version>
  38.         <javadoc.version>3.0.0</javadoc.version>
  39.         <maven-release-plugin.version>2.5.3</maven-release-plugin.version>
  40.     </properties>
  41.  
  42.     <dependencyManagement>
  43.         <dependencies>
  44.             <dependency>
  45.                 <groupId>org.springframework.cloud</groupId>
  46.                 <artifactId>spring-cloud-dependencies</artifactId>
  47.                 <version>${spring-framework.cloud.version}</version>
  48.                 <type>pom</type>
  49.                 <scope>import</scope>
  50.             </dependency>
  51.             <dependency>
  52.                 <groupId>org.projectlombok</groupId>
  53.                 <artifactId>lombok</artifactId>
  54.                 <version>${lombok.version}</version>
  55.             </dependency>
  56.             <dependency>
  57.                 <groupId>org.apache.commons</groupId>
  58.                 <artifactId>commons-lang3</artifactId>
  59.                 <version>${org.apache.common.lang3.version}</version>
  60.             </dependency>
  61.  
  62.             <dependency>
  63.                 <groupId>commons-beanutils</groupId>
  64.                 <artifactId>commons-beanutils</artifactId>
  65.                 <version>${org.apache.common.beanutils.version}</version>
  66.             </dependency>
  67.             <dependency>
  68.                 <groupId>com.baomidou</groupId>
  69.                 <artifactId>mybatis-plus-boot-starter</artifactId>
  70.                 <version>${com.baomidou.mybatis-plus.version}</version>
  71.             </dependency>
  72.  
  73.             <!-- https://mvnrepository.com/artifact/mysql/mysql-connector-java -->
  74.             <dependency>
  75.                 <groupId>mysql</groupId>
  76.                 <artifactId>mysql-connector-java</artifactId>
  77.                 <version>${mysql.connector.java.version}</version>
  78.             </dependency>
  79.             <dependency>
  80.                 <groupId>com.alibaba</groupId>
  81.                 <artifactId>fastjson</artifactId>
  82.                 <version>${com.alibaba.fastjson.version}</version>
  83.             </dependency>
  84.  
  85.         </dependencies>
  86.  
  87.     </dependencyManagement>
  88.  
  89.  
  90.     <build>
  91.         <plugins>
  92.             <!-- for create custom archetype template -->
  93.             <plugin>
  94.                 <groupId>org.apache.maven.plugins</groupId>
  95.                 <artifactId>maven-archetype-plugin</artifactId>
  96.                 <version>3.0.1</version>
  97.             </plugin>
  98.  
  99.             <plugin>
  100.                 <groupId>org.apache.maven.plugins</groupId>
  101.                 <artifactId>maven-release-plugin</artifactId>
  102.                 <version>${maven-release-plugin.version}</version>
  103.             </plugin>
  104.         </plugins>
  105.  
  106.  
  107.     </build>
  108.  
  109. </project>

oauth2-server

最为重要的是两个配置文件类，一个是授权服务的配置，一个是security的安全服务配置，security的安全服务配置重要的是把授权服务相应的地址配置允许匿名访问。

pom.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xmlns="http://maven.apache.org/POM/4.0.0"
  4.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  5.  
  6.     <parent>
  7.         <groupId>com.hz.oauth</groupId>
  8.         <artifactId>authority-management-sys-2.0</artifactId>
  9.         <version>1.0</version>
  10.     </parent>
  11.  
  12.     <artifactId>oauth2-server</artifactId>
  13.     <modelVersion>4.0.0</modelVersion>
  14.  
  15.     <dependencies>
  16.         <dependency>
  17.             <groupId>org.springframework.boot</groupId>
  18.             <artifactId>spring-boot-starter-web</artifactId>
  19.         </dependency>
  20.  
  21.         <dependency>
  22.             <groupId>org.springframework.cloud</groupId>
  23.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  24.         </dependency>
  25.         <dependency>
  26.             <groupId>org.projectlombok</groupId>
  27.             <artifactId>lombok</artifactId>
  28.         </dependency>
  29.         <dependency>
  30.             <groupId>org.apache.commons</groupId>
  31.             <artifactId>commons-lang3</artifactId>
  32.         </dependency>
  33.         <dependency>
  34.             <groupId>commons-beanutils</groupId>
  35.             <artifactId>commons-beanutils</artifactId>
  36.         </dependency>
  37.         <dependency>
  38.             <groupId>mysql</groupId>
  39.             <artifactId>mysql-connector-java</artifactId>
  40.         </dependency>
  41.         <dependency>
  42.             <groupId>com.baomidou</groupId>
  43.             <artifactId>mybatis-plus-boot-starter</artifactId>
  44.         </dependency>
  45.         <dependency>
  46.             <groupId>com.alibaba</groupId>
  47.             <artifactId>fastjson</artifactId>
  48.         </dependency>
  49.         <dependency>
  50.             <groupId>org.springframework.boot</groupId>
  51.             <artifactId>spring-boot-starter-thymeleaf</artifactId>
  52.         </dependency>
  53.     </dependencies>
  54.  
  55.     <build>
  56.         <plugins>
  57.             <!-- for create custom archetype template -->
  58.             <plugin>
  59.                 <groupId>org.apache.maven.plugins</groupId>
  60.                 <artifactId>maven-archetype-plugin</artifactId>
  61.                 <version>3.0.1</version>
  62.             </plugin>
  63.  
  64.             <plugin>
  65.                 <groupId>org.apache.maven.plugins</groupId>
  66.                 <artifactId>maven-release-plugin</artifactId>
  67.                 <version>${maven-release-plugin.version}</version>
  68.             </plugin>
  69.             <plugin>
  70.                 <groupId>org.sonarsource.scanner.maven</groupId>
  71.                 <artifactId>sonar-maven-plugin</artifactId>
  72.                 <version>3.0.2</version>
  73.             </plugin>
  74.             <plugin>
  75.                 <groupId>org.apache.maven.plugins</groupId>
  76.                 <artifactId>maven-compiler-plugin</artifactId>
  77.                 <configuration>
  78.                     <source>1.8</source>
  79.                     <target>1.8</target>
  80.                 </configuration>
  81.             </plugin>
  82.         </plugins>
  83.         <resources>
  84.             <resource>
  85.                 <directory>src/main/java</directory>
  86.                 <includes>
  87.                     <include>**/*.xml</include>
  88.                 </includes>
  89.             </resource>
  90.             <resource>
  91.                 <directory>src/main/webapp</directory>
  92.                 <targetPath>META-INF/resources</targetPath>
  93.                 <includes>
  94.                     <include>**/**</include>
  95.                 </includes>
  96.             </resource>
  97.             <resource>
  98.                 <directory>src/main/resources</directory>
  99.                 <includes>
  100.                     <include>**/**</include>
  101.                 </includes>
  102.             </resource>
  103.             <resource>
  104.                 <directory>src/main/resources</directory>
  105.                 <filtering>true</filtering>
  106.                 <excludes>
  107.                     <exclude>**/*.jks</exclude>
  108.                 </excludes>
  109.             </resource>
  110.             <resource>
  111.                 <directory>src/main/resources</directory>
  112.                 <filtering>false</filtering>
  113.                 <includes>
  114.                     <include>**/*.jks</include>
  115.                 </includes>
  116.             </resource>
  117.         </resources>
  118.  
  119.  
  120.     </build>
  121.  
  122. </project>

SysAuthorizationConfig

在该类配置中，授权码的保存，用户的授权记录保存在数据库中，其生成数据库代码为

  1. DROP TABLE IF EXISTS `oauth_approvals`;
  2. CREATE TABLE `oauth_approvals` (
  3.   `userId` varchar(256) DEFAULT NULL,
  4.   `clientId` varchar(256) DEFAULT NULL,
  5.   `partnerKey` varchar(32) DEFAULT NULL,
  6.   `scope` varchar(256) DEFAULT NULL,
  7.   `status` varchar(10) DEFAULT NULL,
  8.   `expiresAt` datetime DEFAULT NULL,
  9.   `lastModifiedAt` datetime DEFAULT NULL
  10. ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3;
  11.  
  1. DROP TABLE IF EXISTS `oauth_code`;
  2. CREATE TABLE `oauth_code` (
  3.   `code` varchar(255) DEFAULT NULL,
  4.   `authentication` blob
  5. ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;

SysAuthorizationConfig类配置代码

  1. /**
  2.  * @program: OAuth-2.0
  3.  * @author: zgr
  4.  * @create: 2021-07-20 11:42
  5.  **/
  6. @Configuration
  7. @EnableAuthorizationServer
  8. public class SysAuthorizationConfig extends AuthorizationServerConfigurerAdapter {
  9.  
  10.  
  11.     private final DataSource dataSource;
  12.  
  13.     private final SysClientService sysClientService;
  14.  
  15.     private final AuthenticationManager authenticationManager;
  16.  
  17.     public SysAuthorizationConfig(DataSource dataSource, SysClientService sysClientService, AuthenticationManager authenticationManager) {
  18.         this.dataSource = dataSource;
  19.         this.sysClientService = sysClientService;
  20.         this.authenticationManager = authenticationManager;
  21.     }
  22.  
  23.  
  24.     /**
  25.      * 维护一套客户端的信息 即第三方应用软件申请时记录的一些基本信息
  26.      *
  27.      * @param clients
  28.      * @throws Exception
  29.      */
  30.     @Override
  31.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  32.         clients.withClientDetails(sysClientService);
  33.     }
  34.  
  35.     /**
  36.      * 打开验证token的访问权限
  37.      *
  38.      * @param security
  39.      */
  40.     @Override
  41.     public void configure(AuthorizationServerSecurityConfigurer security) {
  42.         security
  43.                 .allowFormAuthenticationForClients()
  44.                 .tokenKeyAccess("isAuthenticated()")
  45.                 .checkTokenAccess("permitAll()")
  46.                 .passwordEncoder(new BCryptPasswordEncoder());
  47.     }
  48.  
  49.  
  50.     /**
  51.      * 配置了令牌存储方式为jwt
  52.      * 配置JWT Token的非对称加密来进行签名
  53.      * 配置一个自定义的Token增强器，把更多信息放入Token中
  54.      * 配置使用JDBC数据库方式来保存用户的授权批准记录
  55.      *
  56.      * @param endpoints
  57.      */
  58.     @Override
  59.     public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
  60.         TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
  61.         tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(), jwtTokenEnhancer()));
  62.  
  63.         endpoints.approvalStore(approvalStore())
  64.                 .authorizationCodeServices(authorizationCodeServices())
  65.                 .tokenEnhancer(tokenEnhancerChain)
  66.                 .tokenStore(tokenStore())
  67.                 .authenticationManager(authenticationManager);
  68.     }
  69.  
  70.     /**
  71.      * 使用数据库方式来保存授权码
  72.      *
  73.      * @return
  74.      */
  75.     @Bean
  76.     public AuthorizationCodeServices authorizationCodeServices() {
  77.         return new JdbcAuthorizationCodeServices(dataSource);
  78.     }
  79.  
  80.     /**
  81.      * 采用jwt方式存储token
  82.      *
  83.      * @return
  84.      */
  85.     @Bean
  86.     public TokenStore tokenStore() {
  87.         return new JwtTokenStore(jwtTokenEnhancer());
  88.     }
  89.  
  90.     /**
  91.      * 使用数据库方式存储用户的批准授权记录
  92.      *
  93.      * @return
  94.      */
  95.     @Bean
  96.     public JdbcApprovalStore approvalStore() {
  97.         return new JdbcApprovalStore(dataSource);
  98.     }
  99.  
  100.     /**
  101.      * 自定义token增强器
  102.      *
  103.      * @return
  104.      */
  105.     @Bean
  106.     public TokenEnhancer tokenEnhancer() {
  107.         return new SysTokenEnhancer();
  108.     }
  109.  
  110.     /**
  111.      * jwt 验证
  112.      *
  113.      * @return
  114.      */
  115.     @Bean
  116.     protected JwtAccessTokenConverter jwtTokenEnhancer() {
  117.         JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
  118.         // 设置jwt加解密秘钥，不设置会随机一个
  119.         jwtAccessTokenConverter.setSigningKey(Constant.JWT_SECRET);
  120.         return jwtAccessTokenConverter;
  121.     }
  122. }

SysSecurityConfig

  1. **
  2.  * @program: authority-management-sys-2.0
  3.  * @author: zgr
  4.  * @create: 2021-08-03 09:55
  5.  **/
  6.  
  7. @Configuration
  8. @EnableWebSecurity
  9. public class SysSecurityConfig extends WebSecurityConfigurerAdapter {
  10.  
  11.  
  12.     private final SysUserService sysUserService;
  13.     private final SysLogoutHandler sysLogoutHandler;
  14.     private final SysLogoutSuccessHandler sysLogoutSuccessHandler;
  15.  
  16.  
  17.     public SysSecurityConfig(SysUserService sysUserService, SysLogoutHandler sysLogoutHandler, SysLogoutSuccessHandler sysLogoutSuccessHandler) {
  18.         this.sysUserService = sysUserService;
  19.         this.sysLogoutHandler = sysLogoutHandler;
  20.         this.sysLogoutSuccessHandler = sysLogoutSuccessHandler;
  21.     }
  22.  
  23.     /**
  24.      * 配置认证管理器
  25.      *
  26.      * @return
  27.      * @throws Exception
  28.      */
  29.     @Bean
  30.     @Override
  31.     public AuthenticationManager authenticationManagerBean() throws Exception {
  32.         return super.authenticationManagerBean();
  33.     }
  34.  
  35.  
  36.     /**
  37.      * 这里是对认证管理器的添加配置，自定义用户详情
  38.      *
  39.      * @param auth
  40.      * @throws Exception
  41.      */
  42.     @Override
  43.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  44.         auth.userDetailsService(sysUserService).passwordEncoder(new BCryptPasswordEncoder())
  45.         ;
  46.     }
  47.  
  48.     //web ignore比较适合配置前端相关的静态资源，它是完全绕过spring security的所有filter的
  49.     @Override
  50.     public void configure(WebSecurity web) throws Exception {
  51.         web.ignoring().antMatchers("/resource");
  52.     }
  53.  
  54.  
  55.     /**
  56.      * 安全请求配置,这里配置的是security的部分，这里配置全部通过，安全拦截在资源服务的配置文件中配置，
  57.      * 要不然访问未验证的接口将重定向到登录页面，前后端分离的情况下这样并不友好，无权访问接口返回相关错误信息即可
  58.      *
  59.      * @param http
  60.      * @return void
  61.      */
  62.     @Override
  63.     protected void configure(HttpSecurity http) throws Exception {
  64.         http
  65.                 .formLogin().loginPage("/login").and()
  66.                 .logout().addLogoutHandler(sysLogoutHandler).logoutSuccessHandler(sysLogoutSuccessHandler)
  67.                 .and()
  68.                 // 由于使用的是JWT，我们这里不需要csrf
  69.                 .csrf().disable().cors().and()
  70.                 .authorizeRequests()
  71.                 .antMatchers("/login", "/oauth/authorize").permitAll()
  72.                 // 除上面外的所有请求全部需要鉴权认证
  73.                 .anyRequest().authenticated();
  74.  
  75.     }
  76. }

客户端服务ClientDetailsService

在SysAuthorizationConfig中，我们配置的是客户端 服务为自定义的sysClientService。实际应用中，通过client id查出对应客户端的信息，查询其拥有的resource资源权限，生成access_token。

  1. /**
  2.      * 维护一套客户端的信息 即第三方应用软件申请时记录的一些基本信息
  3.      *
  4.      * @param clients
  5.      * @throws Exception
  6.      */
  7.     @Override
  8.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  9.         clients.withClientDetails(sysClientService);
  10.     }
  1. @Data
  2. @Builder
  3. @AllArgsConstructor
  4. @NoArgsConstructor
  5. public class SysClientDetails implements ClientDetails {
  6.  
  7.     private String clientId;
  8.  
  9.     private Set<String> resourceId;
  10.  
  11.     private Boolean isSecretRequired;
  12.  
  13.     private String clientSecret;
  14.  
  15.     private Boolean isScoped;
  16.  
  17.     private Set<String> scope;
  18.  
  19.     private Set<String> authorizedGrantTypes;
  20.  
  21.     private Set<String> registeredRedirectUri;
  22.  
  23.     private Integer accessTokenValiditySeconds;
  24.  
  25.     private Integer refreshTokenValiditySeconds;
  26.  
  27.     private Boolean isAutoApprove;
  28.  
  29.     private Map<String, Object> additionalInformation;
  30.  
  31.     @Override
  32.     public String getClientId() {
  33.         return this.clientId;
  34.     }
  35.  
  36.     @Override
  37.     public Set<String> getResourceIds() {
  38.         return this.resourceId;
  39.     }
  40.  
  41.     @Override
  42.     public boolean isSecretRequired() {
  43.         return this.isSecretRequired;
  44.     }
  45.  
  46.     @Override
  47.     public String getClientSecret() {
  48.         return this.clientSecret;
  49.     }
  50.  
  51.     @Override
  52.     public boolean isScoped() {
  53.         return this.isScoped;
  54.     }
  55.  
  56.     @Override
  57.     public Set<String> getScope() {
  58.         return this.scope;
  59.     }
  60.  
  61.     @Override
  62.     public Set<String> getAuthorizedGrantTypes() {
  63.         return this.authorizedGrantTypes;
  64.     }
  65.  
  66.     @Override
  67.     public Set<String> getRegisteredRedirectUri() {
  68.         return this.registeredRedirectUri;
  69.     }
  70.  
  71.     @Override
  72.     public Collection<GrantedAuthority> getAuthorities() {
  73.         return Collections.emptyList();
  74.     }
  75.  
  76.     @Override
  77.     public Integer getAccessTokenValiditySeconds() {
  78.         return this.accessTokenValiditySeconds;
  79.     }
  80.  
  81.     @Override
  82.     public Integer getRefreshTokenValiditySeconds() {
  83.         return this.refreshTokenValiditySeconds;
  84.     }
  85.  
  86.     @Override
  87.     public boolean isAutoApprove(String scope) {
  88.         return this.isAutoApprove;
  89.     }
  90.  
  91.     @Override
  92.     public Map<String, Object> getAdditionalInformation() {
  93.         return this.additionalInformation;
  94.     }
  95. }
  1.  
  2.  
  3. /**
  4.  * @program: authority-management-sys-2.0
  5.  * @author: zgr
  6.  * @create: 2021-08-03 10:12
  7.  **/
  8.  
  9. @Service
  10. @Slf4j
  11. public class SysClientServiceImpl implements SysClientService {
  12.  
  13.  
  14.     @Override
  15.     public ClientDetails loadClientByClientId(String clientId) throws ClientRegistrationException {
  16.         log.info("查找客户端id为 {} 的客户端详情", clientId);
  17.  
  18.         //实际使用中可以从数据库查询客户端详细信息，本例子中直接构造一个客户端
  19.  
  20.         Set<String> resourceIds = new HashSet<>();
  21.         resourceIds.add("userservice1");
  22.  
  23.         Set<String> scopes = new HashSet<>(1);
  24.         scopes.add("sever");
  25.  
  26.         Set<String> grantTypes = new HashSet<>(5);
  27.         grantTypes.add("password");
  28.         grantTypes.add("authorization_code");
  29.  
  30.         Set<String> registeredRedirectUris = new HashSet<>(1);
  31.         registeredRedirectUris.add("https://baidu.com");
  32.  
  33.         return SysClientDetails.builder()
  34.                 //客户端id
  35.                 .clientId("userservice1")
  36.                 //拥有的资源id
  37.                 .resourceId(resourceIds)
  38.                 //是否需要secret
  39.                 .isSecretRequired(true)
  40.                 //secret加密方式
  41.                 .clientSecret(new BCryptPasswordEncoder().encode("1234"))
  42.                 //权限范围
  43.                 .scope(scopes)
  44.                 //支持的授权模式，四种模式支持哪几种
  45.                 .authorizedGrantTypes(grantTypes)
  46.                 //官方注册的回调地址，这个地址是需要和授权请求的回调地址一致
  47.                 .registeredRedirectUri(registeredRedirectUris)
  48.                 .isScoped(true)
  49.                 //access_token的有效时间
  50.                 .accessTokenValiditySeconds((int) TimeUnit.DAYS.toSeconds(2))
  51.                 //refresh_token的有效时间
  52.                 .refreshTokenValiditySeconds((int) TimeUnit.DAYS.toSeconds(30))
  53.                 //是否可以自主授权
  54.                 .isAutoApprove(true)
  55.                 .build();
  56.     }
  57. }

postman演示结果

1.资源有着凭据许可

 完整的返回数据：

  1. {
  2.     "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsidXNlcnNlcnZpY2UxIl0sInVzZXJfbmFtZSI6ImFkbWluIiwic2NvcGUiOlsic2V2ZXIiXSwiZXhwIjoxNjI4NzU3NTMzLCJ1c2VyRGV0YWlscyI6eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInBhc3N3b3JkIjpudWxsLCJyb2xlcyI6W3siaWQiOjEsIm5hbWUiOiJSRUFEIn0seyJpZCI6MSwibmFtZSI6IldSSVRFIn1dLCJhdXRob3JpdGllcyI6W3siYXV0aG9yaXR5IjoiUkVBRCJ9LHsiYXV0aG9yaXR5IjoiV1JJVEUifV0sImVuYWJsZWQiOnRydWUsImNyZWRlbnRpYWxzTm9uRXhwaXJlZCI6dHJ1ZSwiYWNjb3VudE5vbkV4cGlyZWQiOnRydWUsImFjY291bnROb25Mb2NrZWQiOnRydWV9LCJhdXRob3JpdGllcyI6WyJSRUFEIiwiV1JJVEUiXSwianRpIjoiODAwZjgwMmUtZTUzNS00N2RiLTkzOTUtZjY5ZmQxM2Q3ZjNjIiwiY2xpZW50X2lkIjoidXNlcnNlcnZpY2UxIn0.N8HLGnDbRiN560SuE_a4IlqEZIk3yCpzpyEXH3VDb1w",
  3.     "token_type": "bearer",
  4.     "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsidXNlcnNlcnZpY2UxIl0sInVzZXJfbmFtZSI6ImFkbWluIiwic2NvcGUiOlsic2V2ZXIiXSwiYXRpIjoiODAwZjgwMmUtZTUzNS00N2RiLTkzOTUtZjY5ZmQxM2Q3ZjNjIiwiZXhwIjoxNjMxMTc2NzMyLCJ1c2VyRGV0YWlscyI6eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInBhc3N3b3JkIjpudWxsLCJyb2xlcyI6W3siaWQiOjEsIm5hbWUiOiJSRUFEIn0seyJpZCI6MSwibmFtZSI6IldSSVRFIn1dLCJhdXRob3JpdGllcyI6W3siYXV0aG9yaXR5IjoiUkVBRCJ9LHsiYXV0aG9yaXR5IjoiV1JJVEUifV0sImVuYWJsZWQiOnRydWUsImNyZWRlbnRpYWxzTm9uRXhwaXJlZCI6dHJ1ZSwiYWNjb3VudE5vbkV4cGlyZWQiOnRydWUsImFjY291bnROb25Mb2NrZWQiOnRydWV9LCJhdXRob3JpdGllcyI6WyJSRUFEIiwiV1JJVEUiXSwianRpIjoiZDMyNGQ4ZjEtMjBiMy00MTg2LTk4NzMtZjg2NDhkNjI1ZTc5IiwiY2xpZW50X2lkIjoidXNlcnNlcnZpY2UxIn0.KbqODRoK0hjrrHWeKvtZ2HNkcREPFmuv7yvOrZGzEnE",
  5.     "expires_in": 172799,
  6.     "scope": "sever",
  7.     "userDetails": {
  8.         "id": 1,
  9.         "username": "admin",
  10.         "password": null,
  11.         "roles": [
  12.             {
  13.                 "id": 1,
  14.                 "name": "READ"
  15.             },
  16.             {
  17.                 "id": 1,
  18.                 "name": "WRITE"
  19.             }
  20.         ],
  21.         "authorities": [
  22.             {
  23.                 "authority": "READ"
  24.             },
  25.             {
  26.                 "authority": "WRITE"
  27.             }
  28.         ],
  29.         "enabled": true,
  30.         "credentialsNonExpired": true,
  31.         "accountNonExpired": true,
  32.         "accountNonLocked": true
  33.     },
  34.     "jti": "800f802e-e535-47db-9395-f69fd13d7f3c"
  35. }

 2.授权码模式

在浏览器输入地址http://localhost:8086/api/v1/oauth/authorize?response_type=code&client_id=userservice1&redirect_uri=https://baidu.com，会跳转到授权页面，授权页面利用spring mvc定义了一个页面放在resources目录下。

  1. <!DOCTYPE html>
  2. <html class="uk-height-1-1" xmlns:th="http://www.thymeleaf.org">
  3. <head>
  4.     <meta charset="UTF-8"/>
  5.     <title>OAuth2 Demo</title>
  6.     <link href="https://cdnjs.cloudflare.com/ajax/libs/uikit/2.26.3/css/uikit.gradient.min.css" rel="stylesheet"/>
  7. </head>
  8.  
  9. <body class="uk-height-1-1">
  10.  
  11. <div class="uk-vertical-align uk-text-center uk-height-1-1">
  12.     <div class="uk-vertical-align-middle" style="width: 250px;">
  13.         <h1>Login Form</h1>
  14.  
  15.         <p class="uk-text-danger" th:if="${param.error}">
  16.             用户名或密码错误...
  17.         </p>
  18.  
  19.         <form class="uk-panel uk-panel-box uk-form" method="post" th:action="@{/login}">
  20.             <div class="uk-form-row">
  21.                 <input class="uk-width-1-1 uk-form-large" name="username" placeholder="Username" type="text"
  22.                        value="admin"/>
  23.             </div>
  24.             <div class="uk-form-row">
  25.                 <input class="uk-width-1-1 uk-form-large" name="password" placeholder="Password" type="password"
  26.                        value="admin"/>
  27.             </div>
  28.             <div class="uk-form-row">
  29.                 <button class="uk-width-1-1 uk-button uk-button-primary uk-button-large">Login</button>
  30.             </div>
  31.         </form>
  32.  
  33.     </div>
  34. </div>
  35. </body>
  36. </html>

 跳转到登录页面，点击登录，登录成功后，跳转到百度页面，并得到code授权码

 

 拿到获取的code，生成access_token

完整的返回信息

  1. {
  2.     "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsidXNlcnNlcnZpY2UxIl0sInVzZXJfbmFtZSI6ImFkbWluIiwic2NvcGUiOlsic2V2ZXIiXSwiZXhwIjoxNjI4NzU4Mjc2LCJ1c2VyRGV0YWlscyI6eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInBhc3N3b3JkIjpudWxsLCJyb2xlcyI6W3siaWQiOjEsIm5hbWUiOiJSRUFEIn0seyJpZCI6MSwibmFtZSI6IldSSVRFIn1dLCJhdXRob3JpdGllcyI6W3siYXV0aG9yaXR5IjoiUkVBRCJ9LHsiYXV0aG9yaXR5IjoiV1JJVEUifV0sImVuYWJsZWQiOnRydWUsImNyZWRlbnRpYWxzTm9uRXhwaXJlZCI6dHJ1ZSwiYWNjb3VudE5vbkV4cGlyZWQiOnRydWUsImFjY291bnROb25Mb2NrZWQiOnRydWV9LCJhdXRob3JpdGllcyI6WyJSRUFEIiwiV1JJVEUiXSwianRpIjoiZGM5Y2FjN2UtN2M3My00YThkLWEzMzYtZTI2ZmNjYzllODE0IiwiY2xpZW50X2lkIjoidXNlcnNlcnZpY2UxIn0.sOhH-eFcldWnnOfZmDqyuPkl4Qkg8LyJnPZ0gwubBWc",
  3.     "token_type": "bearer",
  4.     "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsidXNlcnNlcnZpY2UxIl0sInVzZXJfbmFtZSI6ImFkbWluIiwic2NvcGUiOlsic2V2ZXIiXSwiYXRpIjoiZGM5Y2FjN2UtN2M3My00YThkLWEzMzYtZTI2ZmNjYzllODE0IiwiZXhwIjoxNjMxMTc3NDc2LCJ1c2VyRGV0YWlscyI6eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInBhc3N3b3JkIjpudWxsLCJyb2xlcyI6W3siaWQiOjEsIm5hbWUiOiJSRUFEIn0seyJpZCI6MSwibmFtZSI6IldSSVRFIn1dLCJhdXRob3JpdGllcyI6W3siYXV0aG9yaXR5IjoiUkVBRCJ9LHsiYXV0aG9yaXR5IjoiV1JJVEUifV0sImVuYWJsZWQiOnRydWUsImNyZWRlbnRpYWxzTm9uRXhwaXJlZCI6dHJ1ZSwiYWNjb3VudE5vbkV4cGlyZWQiOnRydWUsImFjY291bnROb25Mb2NrZWQiOnRydWV9LCJhdXRob3JpdGllcyI6WyJSRUFEIiwiV1JJVEUiXSwianRpIjoiNDdmYjUzMDctYzcyYy00ZjI1LWI4MjEtNTY2MGNlYWYyZGMwIiwiY2xpZW50X2lkIjoidXNlcnNlcnZpY2UxIn0.vmtnmLWsaGBxFxAZ-0nsETBUsZ3muSFKqjffAweRZTQ",
  5.     "expires_in": 172799,
  6.     "scope": "sever",
  7.     "userDetails": {
  8.         "id": 1,
  9.         "username": "admin",
  10.         "password": null,
  11.         "roles": [
  12.             {
  13.                 "id": 1,
  14.                 "name": "READ"
  15.             },
  16.             {
  17.                 "id": 1,
  18.                 "name": "WRITE"
  19.             }
  20.         ],
  21.         "authorities": [
  22.             {
  23.                 "authority": "READ"
  24.             },
  25.             {
  26.                 "authority": "WRITE"
  27.             }
  28.         ],
  29.         "enabled": true,
  30.         "credentialsNonExpired": true,
  31.         "accountNonExpired": true,
  32.         "accountNonLocked": true
  33.     },
  34.     "jti": "dc9cac7e-7c73-4a8d-a336-e26fccc9e814"
  35. }

oauth2-resource

oauth2-resource为资源，用户在获得access_token后，携带access_token访问资源。最重要的是资源配置类。

  1. @Configuration
  2. //启用资源服务器
  3. @EnableResourceServer
  4. //启用方法注解方式来进行权限控制
  5. @EnableGlobalMethodSecurity(prePostEnabled = true)
  6. public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
  7.  
  8.  
  9.     /**
  10.      * 声明了资源服务器的ID是userservice，声明了资源服务器的TokenStore是JWT
  11.      * 注意，这里硬编码了资源id，这个资源id和client所拥有的的资源id需要匹配
  12.      *
  13.      * @param resources
  14.      * @throws Exception
  15.      */
  16.     @Override
  17.     public void configure(ResourceServerSecurityConfigurer resources) {
  18.         resources.resourceId("userservice1").tokenStore(tokenStore());
  19.     }
  20.  
  21.     /**
  22.      * 配置TokenStore
  23.      *
  24.      * @return
  25.      */
  26.     @Bean
  27.     public TokenStore tokenStore() {
  28.         return new JwtTokenStore(jwtAccessTokenConverter());
  29.     }
  30.  
  31.     /**
  32.      * 配置解析
  33.      *
  34.      * @return
  35.      */
  36.     @Bean
  37.     protected JwtAccessTokenConverter jwtAccessTokenConverter() {
  38.         JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  39.         //和授权服务的key相同
  40.         converter.setSigningKey(Constant.JWT_SECRET);
  41.         return converter;
  42.     }
  43. }

security配置接口访问权限

  1. @Configuration
  2. @EnableWebSecurity
  3. public class ResourceSecurityConfig extends WebSecurityConfigurerAdapter {
  4.  
  5.     //web ignore比较适合配置前端相关的静态资源，它是完全绕过spring security的所有filter的
  6.     @Override
  7.     public void configure(WebSecurity web) throws Exception {
  8.         web.ignoring().antMatchers("/resource");
  9.     }
  10.  
  11.  
  12.     /**
  13.      * 安全请求配置,这里配置的是security的部分，这里配置全部通过，安全拦截在资源服务的配置文件中配置，
  14.      * 要不然访问未验证的接口将重定向到登录页面，前后端分离的情况下这样并不友好，无权访问接口返回相关错误信息即可
  15.      *
  16.      * @param http
  17.      * @return void
  18.      */
  19.     @Override
  20.     protected void configure(HttpSecurity http) throws Exception {
  21.         http.authorizeRequests()
  22.                 .antMatchers("/user/**").authenticated()
  23.                 .anyRequest().permitAll();
  24.  
  25.     }
  26. }

ctrl接口测试类

  1. **
  2.  * @author honorzhang
  3.  */
  4.  
  5. @RestController
  6. @RequestMapping("/user")
  7. public class ResourceUserController {
  8.  
  9.     @Autowired
  10.     private TokenStore tokenStore;
  11.  
  12.     /***
  13.      * 读权限或写权限可访问，返回登录用户名
  14.      * @param authentication
  15.      * @return
  16.      */
  17.     @PreAuthorize("hasAuthority('READ') or hasAuthority('WRITE')")
  18.     @GetMapping("/name")
  19.     public BaseResponse<String> name(OAuth2Authentication authentication) {
  20.         return BaseResponse.success(authentication.getName());
  21.     }
  22.  
  23.     /**
  24.      * 读权限或写权限可访问，返回登录用户信息
  25.      *
  26.      * @param authentication
  27.      * @return
  28.      */
  29.     @PreAuthorize("hasAuthority('READ') or hasAuthority('WRITE')")
  30.     @GetMapping
  31.     public BaseResponse<OAuth2Authentication> read(OAuth2Authentication authentication) {
  32.         return BaseResponse.success(authentication);
  33.     }
  34.  
  35.     /**
  36.      * 只有写权限可以访问，返回访问令牌中的额外信息
  37.      *
  38.      * @param authentication
  39.      * @return
  40.      */
  41.     @PreAuthorize("hasAuthority('WRITE') and hasAuthority('ADMIN')")
  42.     @PostMapping
  43.     public BaseResponse<Object> write(OAuth2Authentication authentication) {
  44.         OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) authentication.getDetails();
  45.         OAuth2AccessToken accessToken = tokenStore.readAccessToken(details.getTokenValue());
  46.         return BaseResponse.success(accessToken.getAdditionalInformation().getOrDefault("userDetails", null));
  47.     }
  48. }

postman结果测试

access_token 权限包含WRITE 和 READ权限，没有ADMIN权限。

访问read接口，权限通过。

 访问write接口，没有ADMIN权限，不能访问

引用

极客时间OAuth2.0课程

写在最后

本文是根据极客时间的课程，利用spring cloud oauth2 实现的OAuth2.0权限控制。有很多是基于自己的理解，如有不正确之处，请互相指教。

代码连接

https://github.com/airhonor/authority-management-sys-2.0

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/我家小花儿/article/detail/505681
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号