Spring security oauth2 包含以下两个endpoint来实现Authorization Server:
AuthorizationEndpoint: 授权请求访问端点， 默认url: /oauth/authorize
TokenEndpoint: 获取access token的请求的访问端点， 默认url: /oauth/token
添加依赖
<dependency>
<groupId>org.springframework.security.oauth</groupId>
<artifactId>spring-security-oauth2</artifactId>
</dependency>
配置Authorization Server
@EnableAuthprizationServer注解， 配合实现了AuthorizationServerConfigurer的配置类来配置Authorization Server。
AuthorizationServerConfigurer中主要的配置有三个， 覆盖对应的方法即可：
ClientDetailsServiceConfigurer:
定义了client detail service, 可以简单的指定几个client， 或者指向数据库中的表。
可以存储client信息到内存中或数据库中， 即in-memory和JDBC两种实现。
AuthorizationServerSecurityConfigurer:
定义了token端点的安全策略
其中有两个重要的端点：
/oauth/check_token: 检查token的有效性
/oauth/token_key: 获取token的key
AuthorizationServerEndpointsConfigurer:
定义authorization endpoint, token endpoint以及token service。token service管理token相关的一切， 除了token的持久化是委托给TokenStore来实现， 默认的实现是DefaultTokenServices.
有三种类型的TokenStore:
InMemoryTokenStore: 默认实现， 存储在内存中。
JdbcTokenStore: token数据存储在关系型数据库中。
JWT 类型的TokenStore， 典型的是JwtTokenStore， 不存储到任何地方， 把所有的数据编码到token中， 因此token的撤回(revoke)实现起来优点麻烦。
配置：
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpHeaders;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.common.exceptions.OAuth2Exception;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.error.DefaultWebResponseExceptionTranslator;
import org.springframework.security.oauth2.provider.error.WebResponseExceptionTranslator;
import org.springframework.security.oauth2.provider.token.TokenEnhancerChain;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
import java.util.Arrays;
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
@Value("${security.oauth2.client.client-id}")
private String clientId;
@Value("${security.oauth2.client.client-secret}")
private String clientCredentials;
private final PasswordEncoder passwordEncoder;
private final AuthenticationManager authenticationManager;
private final DefaultTokenEnhancer defaultTokenEnhancer;
private final UserDetailsService userDetailsService;
@Autowired
public AuthorizationServerConfig(PasswordEncoder passwordEncoder, AuthenticationManager authenticationManager,
DefaultTokenEnhancer defaultTokenEnhancer,
UserDetailsService userDetailsService) {
this.passwordEncoder = passwordEncoder;
this.authenticationManager = authenticationManager;
this.defaultTokenEnhancer = defaultTokenEnhancer;
this.userDetailsService = userDetailsService;
}
public void configure(ClientDetailsServiceConfigurer configurer) throws Exception {
configurer
.inMemory()
.withClient(clientId)
.secret(passwordEncoder.encode(clientCredentials))
.authorizedGrantTypes("password", "refresh_token")
.accessTokenValiditySeconds(3600);
}
@Override
public void configure(final AuthorizationServerSecurityConfigurer oauthServer) {
oauthServer.tokenKeyAccess("permitAll()")
.checkTokenAccess("isAuthenticated()")
.allowFormAuthenticationForClients(); // 默认通过basic authentication， 即加一个header为Authorization: Basic base64(username:password), 指定这个可以设置form提交， 把client-id, client-secret放到post参数中。
}
@Bean
TokenStore tokenStore() {
return new JwtTokenStore(jwtAccessTokenConverter());
}
@Bean
public JwtAccessTokenConverter jwtAccessTokenConverter() {
JwtAccessTokenConverter jwtConverter = new JwtAccessTokenConverter();
jwtConverter.setSigningKey("your-sign-key");
return jwtConverter;
}
@Bean
public WebResponseExceptionTranslator loggingExceptionTranslator() {
return new DefaultWebResponseExceptionTranslator() {
@Override
public ResponseEntity<OAuth2Exception> translate(Exception e) throws Exception {
e.printStackTrace();
ResponseEntity<OAuth2Exception> responseEntity = super.translate(e);
HttpHeaders headers = new HttpHeaders();
headers.setAll(responseEntity.getHeaders().toSingleValueMap());
OAuth2Exception excBody = responseEntity.getBody();
return new ResponseEntity<>(excBody, headers, responseEntity.getStatusCode());
}
};
}
public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
tokenEnhancerChain.setTokenEnhancers(Arrays.asList(defaultTokenEnhancer, jwtAccessTokenConverter()));
endpoints.authenticationManager(authenticationManager)
.userDetailsService(userDetailsService)
.tokenStore(tokenStore())
.tokenEnhancer(tokenEnhancerChain)
.exceptionTranslator(loggingExceptionTranslator());
}
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
@EnableWebSecurity
@Order(1)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder(10);
}
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return this.authenticationManager();
}
protected void configure(HttpSecurity http) throws Exception {
http
.formLogin().permitAll()
.and()
.csrf().disable()
.cors().disable()
.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS).permitAll()
.antMatchers("/oauth/**").permitAll()
.anyRequest().authenticated();
}
}
formLogin().permitAll()对password flow不是必须的， 只对implicit flow有影响。
当时测试implicit flow的时候确实是这样， 在访问/oauth/authorize之后， 需要登录， 登录后一直提示错误， 但没有错误信息， 从而获取不到token， 加了formLogin().permitAll()选项后就正常返回token了。
获取access token:
访问地址： POST localhost:8080/oauth/token
参数：client_id=clientId&client_secret=clientSecret&grant_type=password&username=username&password=password
刷新access token:
POST localhost:8080/oauth/token
参数：
client_id=clientId&client_secret=clientSecret&grant_type=refresh_token&scope=any&refresh_token=refreshToken
顺便介绍一下其他的grant type:
grant type授权类型一般有client credentials, password, implicit, authorization code, refresh。
client credentials是直接访问/oauth/token端点带grant_type
password 访问/oauth/token端点带grant_type
implicit 访问/oauth/authorize端点带response_type参数， 值为token， 然后会直接重定向到你指定的redirect_uri, url中带access_token参数
authorize code 先访问/oauth/authorize端点带response_type参数， 值为code， 然后它会返回一个code参数; 带上code参数访问/oauth/token端点获取access token。
refer:
https://www.baeldung.com/rest-api-spring-oauth2-angular
https://dzone.com/articles/spring-boot-oauth2-getting-the-authorization-code
https://walkingtree.tech/securing-microservices-oauth2/
https://projects.spring.io/spring-security-oauth/docs/oauth2.html
