用户权限模块之oauth2.0
主要是在springsecurity上面扩展即可，所以内容也是基于上一个，
sql：
CREATE TABLE `auth_access_token` (
`id` int(11) NOT NULL AUTO_INCREMENT COMMENT 'id',
`token_id` varchar(255) DEFAULT NULL COMMENT 'token id',
`token` blob COMMENT 'token',
`authentication_id` varchar(255) DEFAULT NULL COMMENT '认证id',
`user_name` varchar(100) DEFAULT NULL COMMENT '用户名',
`client_id` varchar(100) DEFAULT NULL COMMENT '终端id',
`authentication` blob COMMENT '认证',
`refresh_token` varchar(255) DEFAULT NULL COMMENT '刷新token',
`created_by` int(11) DEFAULT NULL COMMENT '创建人',
`created_dt` datetime DEFAULT NULL COMMENT '创建时间',
`last_update_by` int(11) DEFAULT NULL COMMENT '最后更新人',
`last_update_dt` datetime DEFAULT NULL COMMENT '最后更新时间',
`sts` char(1) DEFAULT NULL COMMENT '状态',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=2122 DEFAULT CHARSET=utf8 COMMENT='认证token表';
CREATE TABLE `auth_client_details` (
`id` int(11) NOT NULL AUTO_INCREMENT COMMENT 'id',
`client_id` varchar(255) DEFAULT NULL COMMENT '终端码',
`resource_ids` varchar(255) DEFAULT NULL COMMENT '资源id',
`client_secret` varchar(255) DEFAULT NULL COMMENT '终端密钥',
`scope` varchar(255) DEFAULT 'read,write,trust' COMMENT 'scope',
`authorized_grant_types` varchar(255) DEFAULT 'password,refresh_token,authorization_code,client_credentials' COMMENT '授权类型',
`web_server_redirect_uri` varchar(255) DEFAULT NULL COMMENT '跳转地址',
`authorities` varchar(255) DEFAULT 'ROLE_CLIENT' COMMENT '权限',
`access_token_validity` int(11) DEFAULT NULL,
`refresh_token_validity` int(11) DEFAULT NULL,
`additional_information` varchar(500) DEFAULT NULL,
`archived` tinyint(1) DEFAULT '0',
`trusted` tinyint(1) DEFAULT '0',
`autoapprove` varchar(255) DEFAULT 'false',
`created_by` int(11) DEFAULT NULL COMMENT '创建人',
`created_dt` datetime DEFAULT NULL COMMENT '创建时间',
`last_update_by` int(11) DEFAULT NULL COMMENT '最后更新人',
`last_update_dt` datetime DEFAULT NULL COMMENT '最后更新时间',
`sts` char(1) DEFAULT NULL COMMENT '状态',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=11 DEFAULT CHARSET=utf8 COMMENT='认证client配置表';
CREATE TABLE `auth_code` (
`id` int(11) NOT NULL AUTO_INCREMENT COMMENT 'id',
`code` varchar(255) DEFAULT NULL,
`authentication` blob,
`created_by` int(11) DEFAULT NULL COMMENT '创建人',
`created_dt` datetime DEFAULT NULL COMMENT '创建时间',
`last_update_by` int(11) DEFAULT NULL COMMENT '最后更新人',
`last_update_dt` datetime DEFAULT NULL COMMENT '最后更新时间',
`sts` char(1) DEFAULT NULL COMMENT '状态',
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='认证代码码';
CREATE TABLE `auth_client_details` (
`id` int(11) NOT NULL AUTO_INCREMENT COMMENT 'id',
`client_id` varchar(255) DEFAULT NULL COMMENT '终端码',
`resource_ids` varchar(255) DEFAULT NULL COMMENT '资源id',
`client_secret` varchar(255) DEFAULT NULL COMMENT '终端密钥',
`scope` varchar(255) DEFAULT 'read,write,trust' COMMENT 'scope',
`authorized_grant_types` varchar(255) DEFAULT 'password,refresh_token,authorization_code,client_credentials' COMMENT '授权类型',
`web_server_redirect_uri` varchar(255) DEFAULT NULL COMMENT '跳转地址',
`authorities` varchar(255) DEFAULT 'ROLE_CLIENT' COMMENT '权限',
`access_token_validity` int(11) DEFAULT NULL,
`refresh_token_validity` int(11) DEFAULT NULL,
`additional_information` varchar(500) DEFAULT NULL,
`archived` tinyint(1) DEFAULT '0',
`trusted` tinyint(1) DEFAULT '0',
`autoapprove` varchar(255) DEFAULT 'false',
`created_by` int(11) DEFAULT NULL COMMENT '创建人',
`created_dt` datetime DEFAULT NULL COMMENT '创建时间',
`last_update_by` int(11) DEFAULT NULL COMMENT '最后更新人',
`last_update_dt` datetime DEFAULT NULL COMMENT '最后更新时间',
`sts` char(1) DEFAULT NULL COMMENT '状态',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=11 DEFAULT CHARSET=utf8 COMMENT='认证client配置表';
CREATE TABLE `auth_refresh_token` (
`id` int(11) NOT NULL AUTO_INCREMENT COMMENT 'id',
`token_id` varchar(255) DEFAULT NULL,
`token` blob,
`authentication` blob,
`created_by` int(11) DEFAULT NULL COMMENT '创建人',
`created_dt` datetime DEFAULT NULL COMMENT '创建时间',
`last_update_by` int(11) DEFAULT NULL COMMENT '最后更新人',
`last_update_dt` datetime DEFAULT NULL COMMENT '最后更新时间',
`sts` char(1) DEFAULT NULL COMMENT '状态',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=535 DEFAULT CHARSET=utf8 COMMENT='认证授权码表';
======================
application-security.xml中加上oauth配置
<sec:http pattern="/oauth/token" create-session="stateless"
authentication-manager-ref="clientAuthenticationManager"
entry-point-ref="oauth2AuthenticationEntryPoint">
<sec:intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
<sec:anonymous enabled="false" />
<sec:http-basic entry-point-ref="oauth2AuthenticationEntryPoint" />
<sec:custom-filter ref="clientCredentialsTokenEndpointFilter"
before="BASIC_AUTH_FILTER" />
<sec:access-denied-handler ref="oauthAccessDeniedHandler" />
</sec:http>
<sec:http pattern="/api/**" create-session="never" access-decision-manager-ref="oauth2AccessDecisionManager"
entry-point-ref="oauth2AuthenticationEntryPoint">
<sec:anonymous enabled="false" />
<sec:custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR" />
<sec:custom-filter ref="mobileResourceServer" before="PRE_AUTH_FILTER"/>
<sec:access-denied-handler ref="oauthAccessDeniedHandler" />
</sec:http>
<oauth2:authorization-server
client-details-service-ref="clientDetailsService" token-services-ref="tokenServices"
user-approval-handler-ref="oauthUserApprovalHandler"
user-approval-page="approval" error-page="/403">
<oauth2:authorization-code authorization-code-services-ref="codeServices"/>
<oauth2:implicit />
<oauth2:refresh-token />
<oauth2:client-credentials />
<oauth2:password />
</oauth2:authorization-server>
<oauth2:resource-server id="mobileResourceServer" resource-id="mobile-resource" token-services-ref="tokenServices"/>
<bean id="oauthUserApprovalHandler" class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
<property name="tokenStore" ref="tokenStore"/>
<property name="clientDetailsService" ref="clientDetailsService"/>
<property name="requestFactory" ref="oAuth2RequestFactory"/>
</bean>
<bean class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"
id="oAuth2RequestFactory">
<constructor-arg name="clientDetailsService" ref="clientDetailsService"/>
</bean>
<bean id="oauth2ClientDetailsUserService"
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<constructor-arg ref="clientDetailsService" />
</bean>
<sec:authentication-manager id="clientAuthenticationManager">
<sec:authentication-provider user-service-ref="oauth2ClientDetailsUserService" />
</sec:authentication-manager>
<bean id="oauth2AuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint" />
<bean id="clientCredentialsTokenEndpointFilter"
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
<property name="authenticationManager" ref="clientAuthenticationManager" />
</bean>
<bean id="oauthAccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
<bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
<property name="tokenStore" ref="tokenStore"/>
<property name="clientDetailsService" ref="clientDetailsService"/>
<property name="supportRefreshToken" value="true"/>
</bean>
<bean id="clientDetailsService" class="com.linxingall.auth.security.oauth.CustomClientDetailsService"/>
<bean id="tokenStore" class="com.linxingall.auth.security.oauth.CustomTokenStore"/>
<bean id="codeServices" class="com.linxingall.auth.security.oauth.AuthCodeService"/>
<bean id="oauth2AccessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased">
<constructor-arg>
<list>
<bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/>
<bean class="org.springframework.security.access.vote.RoleVoter"/>
<bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</list>
</constructor-arg>
</bean>
java代码
CustomClientDetailsService
public class CustomClientDetailsService implements ClientDetailsService {
protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
@Autowired
private ClientDetailsDao clientDetailsDao;
@Override
public ClientDetails loadClientByClientId(String client) throws ClientRegistrationException {
List<ClientDetailsDo> clientDetailsDos = clientDetailsDao.query(client);
if(CollectionUtils.isNotEmpty(clientDetailsDos)){
return new TmsClientDetails(clientDetailsDos.get(0)) ;
}else{
throw new UsernameNotFoundException(this.messages.getMessage("DigestAuthenticationFilter.usernameNotFound",new Object[]{client}, "Client {0} not found"));
}
}
}
CustomTokenStore
CustomTokenStore implements TokenStore
重写token的保存 刷新 读取方法
AuthCodeService
AuthCodeService extends RandomValueAuthorizationCodeServices
重写保存和移除code方法
