文档章节

Spring-Security-OAuth2

大头鬼_yc
 大头鬼_yc
发布于 2018/05/10 16:16
字数 1359
阅读 235
收藏 18

OAuth 是一个开放标准,允许用户让第三方应用访问该用户在某一网站上存储的私密的资源(如照片,视频,联系人列表),而不需要将用户名和密码提供给第三方应用。OAuth允许用户提供一个令牌,而不是用户名和密码来访问他们存放在特定服务提供者的数据。每一个令牌授权一个特定的网站在特定的时段内访问特定的资源。这样,OAuth让用户可以授权第三方网站访问他们存储在另外服务提供者的某些特定信息。更多OAuth2请参考理解OAuth 2.0

项目准备

  1. 添加依赖

    	<dependency>
    				<groupId>org.springframework.boot</groupId>
    				<artifactId>spring-boot-starter-security</artifactId>
    			</dependency>
    			<dependency>
    				<groupId>org.springframework.boot</groupId>
    				<artifactId>spring-boot-starter-web</artifactId>
    			</dependency>
    			<dependency>
    				<groupId>org.springframework.security.oauth</groupId>
    				<artifactId>spring-security-oauth2</artifactId>
    			</dependency>
    			<dependency>
    				<groupId>org.springframework.boot</groupId>
    				<artifactId>spring-boot-starter-test</artifactId>
    			</dependency>
    
  2. 配置认证服务器

    	@Configuration
    	@EnableAuthorizationServer//是的,没做,就这么一个注解
    	public class MerryyouAuthorizationServerConfig {
    
    	}
    
  3. 配置资源服务器

    	@Configuration
    	@EnableResourceServer//咦,没错还是一个注解
    	public class MerryyouResourceServerConfig {
    	}
    
  4. 配置application.yml客户端信息(不配置的话,控制台会默认打印clientid和clietSecret)

    	security:
    	  oauth2:
    		client:
    		  client-id: merryyou
    		  client-secret: merryyou
    
  5. 定义MyUserDetailsService

    	@Component
    	public class MyUserDetailsService implements UserDetailsService {
    
    		@Override
    		public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    			return new User(username, "123456", AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_USER"));
    		}
    	}
    
  6. 添加测试类SecurityOauth2Test(用户名密码模式)

    	@RunWith(SpringRunner.class)
    	@SpringBootTest
    	@Slf4j
    	public class SecurityOauth2Test {
    		//端口
    		final static long PORT = 9090;
    		//clientId
    		final static String CLIENT_ID = "merryyou";
    		//clientSecret
    		final static String CLIENT_SECRET = "merryyou";
    		//用户名
    		final static String USERNAME = "admin";
    		//密码
    		final static String PASSWORD = "123456";
    		//获取accessToken得URI
    		final static String TOKEN_REQUEST_URI = "http://localhost:"+PORT+"/oauth/token?grant_type=password&username=" + USERNAME + "&password=" + PASSWORD+"&scope=all";
    		//获取用户信息得URL
    		final static String USER_INFO_URI = "http://localhost:"+PORT+"/user";
    
    		@Test
    		public void getUserInfo() throws Exception{
    			RestTemplate rest = new RestTemplate();
    			HttpHeaders headers = new HttpHeaders();
    			headers.add( "authorization", "Bearer " + getAccessToken() );
    			HttpEntity<String> entity = new HttpEntity<String>(null, headers);
    			// pay attention, if using get with headers, should use exchange instead of getForEntity / getForObject
    			ResponseEntity<String> result = rest.exchange( USER_INFO_URI, HttpMethod.GET, entity, String.class, new Object[]{ null } );
    			log.info("用户信息返回的结果={}",JsonUtil.toJson(result));
    		}
    
    		/**
    		 * 获取accessToken
    		 * @return
    		 */
    		private String getAccessToken(){
    			RestTemplate rest = new RestTemplate();
    			HttpHeaders headers = new HttpHeaders();
    			headers.setContentType( MediaType.TEXT_PLAIN );
    			headers.add("authorization", getBasicAuthHeader());
    			HttpEntity<String> entity = new HttpEntity<String>(null, headers);
    			ResponseEntity<OAuth2AccessToken> resp = rest.postForEntity( TOKEN_REQUEST_URI, entity, OAuth2AccessToken.class);
    			if( !resp.getStatusCode().equals( HttpStatus.OK )){
    				throw new RuntimeException( resp.toString() );
    			}
    			OAuth2AccessToken t = resp.getBody();
    			log.info("accessToken={}",JsonUtil.toJson(t));
    			log.info("the response, access_token: " + t.getValue() +"; token_type: " + t.getTokenType() +"; "
    					+ "refresh_token: " + t.getRefreshToken() +"; expiration: " + t.getExpiresIn() +", expired when:" + t.getExpiration() );
    			return t.getValue();
    
    		}
    
    		/**
    		 * 构建header
    		 * @return
    		 */
    		private String getBasicAuthHeader(){
    			String auth = CLIENT_ID + ":" + CLIENT_SECRET;
    			byte[] encodedAuth = Base64.encodeBase64(auth.getBytes());
    			String authHeader = "Basic " + new String(encodedAuth);
    			return authHeader;
    		}
    	}
    

授权码模式效果如下:

授权链接: http://localhost:9090/oauth/authorize?response_type=code&client_id=merryyou&redirect_uri=http://merryyou.cn&scope=all

https://raw.githubusercontent.com/longfeizheng/longfeizheng.github.io/master/images/security/spring-security-oauth201.gif

测试类打印accessToken信息

2018-01-20 18:16:49.900  INFO 16136 --- [           main] cn.merryyou.security.SecurityOauth2Test  : accessToken={
  "value": "8e5ea72c-d153-48f5-8ee7-9b5616fc43dc",
  "expiration": "Jan 21, 2018 6:10:25 AM",
  "tokenType": "bearer",
  "refreshToken": {
    "value": "7adfefec-c80c-4ff4-913c-4f161c47fbf1"
  },
  "scope": [
    "all"
  ],
  "additionalInformation": {}
}

spring security oauth2 登录核心源码

https://raw.githubusercontent.com/longfeizheng/longfeizheng.github.io/master/images/security/spring-security-oatuh202.png

TokenEndpoint

//#1.处理/oauth/token请求
@RequestMapping(value = "/oauth/token", method=RequestMethod.POST)
	public ResponseEntity<OAuth2AccessToken> postAccessToken(Principal principal, @RequestParam
	Map<String, String> parameters) throws HttpRequestMethodNotSupportedException {

		if (!(principal instanceof Authentication)) {
			throw new InsufficientAuthenticationException(
					"There is no client authentication. Try adding an appropriate authentication filter.");
		}
		//获取clientId
		String clientId = getClientId(principal);
		//获取第三方应用的详细配置信息
		ClientDetails authenticatedClient = getClientDetailsService().loadClientByClientId(clientId);
		//使用第三方应用信息创建TokenRequest
		TokenRequest tokenRequest = getOAuth2RequestFactory().createTokenRequest(parameters, authenticatedClient);
		//有没有传clientId
		if (clientId != null && !clientId.equals("")) {
			// Only validate the client details if a client authenticated during this
			// request.
			//与配置里面的是否匹配
			if (!clientId.equals(tokenRequest.getClientId())) {
				// double check to make sure that the client ID in the token request is the same as that in the
				// authenticated client
				throw new InvalidClientException("Given client ID does not match authenticated client");
			}
		}
		if (authenticatedClient != null) {
			//检查scope
			oAuth2RequestValidator.validateScope(tokenRequest, authenticatedClient);
		}
		//grant_type是否存在值,对应四种授权模式和刷新token
		if (!StringUtils.hasText(tokenRequest.getGrantType())) {
			throw new InvalidRequestException("Missing grant type");
		}
		//是否简化模式
		if (tokenRequest.getGrantType().equals("implicit")) {
			throw new InvalidGrantException("Implicit grant type not supported from token endpoint");
		}
		//是否是授权码模式
		if (isAuthCodeRequest(parameters)) {
			// The scope was requested or determined during the authorization step
			if (!tokenRequest.getScope().isEmpty()) {
				logger.debug("Clearing scope of incoming token request");
				//如果是授权码模式scope设置为空,根据获取code时的scope设置
				tokenRequest.setScope(Collections.<String> emptySet());
			}
		}
		//是否刷新令牌
		if (isRefreshTokenRequest(parameters)) {
			// A refresh token has its own default scopes, so we should ignore any added by the factory here.
			//设置scope
			tokenRequest.setScope(OAuth2Utils.parseParameterList(parameters.get(OAuth2Utils.SCOPE)));
		}
		//获取OAuth2AccessToken
		OAuth2AccessToken token = getTokenGranter().grant(tokenRequest.getGrantType(), tokenRequest);
		if (token == null) {
			throw new UnsupportedGrantTypeException("Unsupported grant type: " + tokenRequest.getGrantType());
		}

		return getResponse(token);

	}

ClientDetails

https://raw.githubusercontent.com/longfeizheng/longfeizheng.github.io/master/images/security/spring-security-OAuth203.png

TokenRequest

https://raw.githubusercontent.com/longfeizheng/longfeizheng.github.io/master/images/security/spring-security-OAuth204.png

CompositeTokenGranter#grant

	//四种授权模式+刷新令牌的模式根据grant_type判断
	public OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest) {
		for (TokenGranter granter : tokenGranters) {
			OAuth2AccessToken grant = granter.grant(grantType, tokenRequest);
			if (grant!=null) {
				return grant;
			}
		}
		return null;
	}

tokenGranters

https://raw.githubusercontent.com/longfeizheng/longfeizheng.github.io/master/images/security/spring-security-OAuth204.png

AbstractTokenGranter#grant

public OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest) {
		//判断当前的授权类型和传入的是否匹配
		if (!this.grantType.equals(grantType)) {
			return null;
		}
		//获取clientId
		String clientId = tokenRequest.getClientId();
		ClientDetails client = clientDetailsService.loadClientByClientId(clientId);
		//校验
		validateGrantType(grantType, client);
		
		logger.debug("Getting access token for: " + clientId);
		//产生令牌
		return getAccessToken(client, tokenRequest);

	}

AbstractTokenGranter#getAccessToken

protected OAuth2AccessToken getAccessToken(ClientDetails client, TokenRequest tokenRequest) {
		return tokenServices.createAccessToken(getOAuth2Authentication(client, tokenRequest));
	}

DefaultTokenServices#createAccessToken

public OAuth2AccessToken createAccessToken(OAuth2Authentication authentication) throws AuthenticationException {
		//从tokenStore获取OAuth2AccessToken (如果令牌存在,不同的授权模式下将返回同一个令牌)
		OAuth2AccessToken existingAccessToken = tokenStore.getAccessToken(authentication);
		OAuth2RefreshToken refreshToken = null;
		//判断是否过期
		if (existingAccessToken != null) {
			if (existingAccessToken.isExpired()) {
				if (existingAccessToken.getRefreshToken() != null) {
					//删除过期的令牌
					refreshToken = existingAccessToken.getRefreshToken();
					// The token store could remove the refresh token when the
					// access token is removed, but we want to
					// be sure...

					tokenStore.removeRefreshToken(refreshToken);
				}
				tokenStore.removeAccessToken(existingAccessToken);
			}
			else {
				//如果令牌存在则从新存储一下
				// Re-store the access token in case the authentication has changed
				tokenStore.storeAccessToken(existingAccessToken, authentication);
				//存储完直接返回
				return existingAccessToken;
			}
		}

		// Only create a new refresh token if there wasn't an existing one
		// associated with an expired access token.
		// Clients might be holding existing refresh tokens, so we re-use it in
		// the case that the old access token
		// expired.
		//判断刷新令牌不存在
		if (refreshToken == null) {
			//创建刷新令牌
			refreshToken = createRefreshToken(authentication);
		}
		// But the refresh token itself might need to be re-issued if it has
		// expired.
		else if (refreshToken instanceof ExpiringOAuth2RefreshToken) {
			//过期
			ExpiringOAuth2RefreshToken expiring = (ExpiringOAuth2RefreshToken) refreshToken;
			if (System.currentTimeMillis() > expiring.getExpiration().getTime()) {
				refreshToken = createRefreshToken(authentication);
			}
		}
		//根据刷新令牌创建OAuth2AccessToken
		OAuth2AccessToken accessToken = createAccessToken(authentication, refreshToken);
		tokenStore.storeAccessToken(accessToken, authentication);
		// In case it was modified
		refreshToken = accessToken.getRefreshToken();
		if (refreshToken != null) {
			tokenStore.storeRefreshToken(refreshToken, authentication);
		}
		//返回OAuth2AccessToken
		return accessToken;

	}

代码下载

从我的 github 中下载,https://github.com/longfeizheng/security-oauth2

本文转载自:https://longfeizheng.github.io/2018/01/20/Spring-Security%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E5%8D%

下一篇: OAuth2
大头鬼_yc

大头鬼_yc

粉丝 5
博文 70
码字总数 18031
作品 0
昌平
程序员
私信 提问
Secures your applications with Spring Security 5 and Keycloak

Spring Security 5 brought new OAuth2/OIDC client instead of the legacy client support in the old Spring Security OAuth sub project. The new OAuth2 umbrella modules in the core p......

hantsy
2018/04/24
174
0
Spring Security 从入门到进阶系列教程

Spring Security 入门系列 《保护 Web 应用的安全》 《Spring-Security-入门(一):登录与退出》 《Spring-Security-入门(二):基于数据库验证》 《Spring-Security-入门(三):密码加密...

小致Daddy
2018/08/03
19.7K
1
spring-security-oauth2-boot 2.0.3 发布

spring-security-oauth2-boot 2.0.3 已发布。该项目提供 了spring-security-oauth2 和 Spring Boot 2 的集成(即自动配置)。 未发现具体的更新说明,由提交信息可知, 主要是修复了关于 Sp...

淡漠悠然
2018/08/17
815
0
spring-oauth-server 0.4 发布, Oauth2 与 Spring Security 安全应用整合

在spring-oauth-server 0.4-beta版本从2015-11-18发布一个多月后, 0.4版本正式发布. 在这期间主要测试各项新增功能. spring-oauth-server 是一个整合Oauth2与Spring Security的安全应用项目,...

monkeyk7
2016/01/02
1K
0
Spring Security OAuth2 Boot Auto-config 2.0.4 发布

Spring Security OAuth2 Boot Auto-config 2.0.4 和 2.1.0.M2 已发布。该项目主要是用于为 Spring Security OAuth2 和 Spring Boot 2 提供集成(即自动配置)。 这两个版本主要提供错误修复和...

局长
2018/08/30
1K
2

没有更多内容

加载失败,请刷新页面

加载更多

查看线上日志常用命令

cat 命令(文本输出命令) 通常查找出错误日志 cat error.log | grep 'nick' , 这时候我们要输出当前这个日志的前后几行: 显示file文件里匹配nick那行以及上下5行 cat error.log | grep -C ...

xiaolyuh
34分钟前
5
0
六、Java设计模式之工厂方法

工厂方法定义: 定义一个创建对象的接口,但让实现这个接口的类来决定实例化哪个类,工厂方法让类的实例化推迟到子类中进行 类型:创建型 工厂方法-使用场景: 创建对象需要大量重复的代码 ...

东风破2019
40分钟前
5
0
win服务器管理遇到的一系列问题记录

有些小伙伴在使用iis7远程桌面管理工具的时候总是会遇到一系列的问题,下面就是为大家介绍一下服务器日常管理过程中出现的问题及我的解决办法和心得。希望能帮到大家。   拒绝服务器重新启...

1717197346
48分钟前
6
0
flutter 剪切板 复制粘贴

复制粘贴功能 import 'package:flutter/services.dart'; Clipboard.setData(ClipboardData(text:_text));Clipboard.getData;...

zdglf
50分钟前
4
0
如何保证消息的可靠性传输?或者说,如何处理消息丢失的问题?

面试题 如何保证消息的可靠性传输?或者说,如何处理消息丢失的问题? 面试官心理分析 这个是肯定的,用 MQ 有个基本原则,就是数据不能多一条,也不能少一条,不能多,就是前面说的重复消费...

米兜
51分钟前
4
0

没有更多内容

加载失败,请刷新页面

加载更多

返回顶部
顶部