OAuth2.0授权码模式学习
OAuth2.0授权码模式学习
四种授权方式
1，授权码模式
2，简化模式
3，密码模式
4，客户端模式
授权码模式
四种授权模式中最完成，最严密的授权。
（1）用户访问客户端，后者将前者导入认证服务器
（2）用户选择是否给予客户端授权
（3）假设用户给予授权，认证服务器将用户导向客户端事先指定的“重定向URL”（redirection URL），同时附上一个授权码。
（4）客户端收到授权码，附上早先的“重定向URL”，向认证服务器中申请令牌（assess token）和更新令牌（refresh token）
接入QQ登录的前置条件以及开放平台账号申请
引入官方SDK
--SDK参数配置
--SDK核心方法解读
服务端代码示例：
package com.flash.dataU.oauth.controller2; import com.flash.dataU.oauth.entity.User; import org.apache.oltu.oauth2.as.issuer.MD5Generator; import org.apache.oltu.oauth2.as.issuer.OAuthIssuer; import org.apache.oltu.oauth2.as.issuer.OAuthIssuerImpl; import org.apache.oltu.oauth2.as.request.OAuthAuthzRequest; import org.apache.oltu.oauth2.as.request.OAuthTokenRequest; import org.apache.oltu.oauth2.as.response.OAuthASResponse; import org.apache.oltu.oauth2.common.OAuth; import org.apache.oltu.oauth2.common.exception.OAuthProblemException; import org.apache.oltu.oauth2.common.exception.OAuthSystemException; import org.apache.oltu.oauth2.common.message.OAuthResponse; import org.apache.oltu.oauth2.common.message.types.ParameterStyle; import org.apache.oltu.oauth2.common.utils.OAuthUtils; import org.apache.oltu.oauth2.rs.request.OAuthAccessResourceRequest; import org.apache.oltu.oauth2.rs.response.OAuthRSResponse; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.http.HttpEntity; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.net.URI; import static org.apache.oltu.oauth2.common.OAuth.*; @RequestMapping("/oauthserver") @Controller public class AuthorizeController { private Model model; private HttpServletRequest request; //向客户端返回授权许可码 code @RequestMapping("/responseCode") public Object toShowUser(Model model, HttpServletRequest request){ this.model = model; this.request = request; System.out.println("----------服务端/responseCode--------------------------------------------------------------"); try { //构建OAuth授权请求 OAuthAuthzRequest oauthRequest =new OAuthAuthzRequest(request); /*oauthRequest.getClientId(); oauthRequest.getResponseType(); oauthRequest.getRedirectURI(); System.out.println(oauthRequest.getClientId()); System.out.println(oauthRequest.getResponseType()); System.out.println(oauthRequest.getRedirectURI());*/ if(oauthRequest.getClientId()!=null&&oauthRequest.getClientId()!="") { //设置授权码 String authorizationCode ="authorizationCode"; //利用oauth授权请求设置responseType，目前仅支持CODE，另外还有TOKEN String responseType =oauthRequest.getParam(OAuth.OAUTH_RESPONSE_TYPE); //进行OAuth响应构建 OAuthASResponse.OAuthAuthorizationResponseBuilder builder = OAuthASResponse.authorizationResponse(request, HttpServletResponse.SC_FOUND); //设置授权码 builder.setCode(authorizationCode); //得到到客户端重定向地址 String redirectURI =oauthRequest.getParam(OAUTH_REDIRECT_URI); //构建响应 final OAuthResponse response =builder.location(redirectURI).buildQueryMessage(); System.out.println("服务端/responseCode内，返回的回调路径："+response.getLocationUri()); System.out.println("----------服务端/responseCode--------------------------------------------------------------"); String responceUri =response.getLocationUri(); //根据OAuthResponse返回ResponseEntity响应 HttpHeaders headers =new HttpHeaders(); try { headers.setLocation(new URI(response.getLocationUri())); } catch (Exception e) { // TODO Auto-generated catch block e.printStackTrace(); } return"redirect:"+responceUri; } } catch (Exception e) { e.printStackTrace(); } System.out.println("----------服务端/responseCode--------------------------------------------------------------"); return null; } //获取客户端的code码，向客户端返回access token @RequestMapping(value="/responseAccessToken",method = RequestMethod.POST) public HttpEntity token(HttpServletRequest request){ System.out.println("--------服务端/responseAccessToken-----------------------------------------------------------"); OAuthIssuer oauthIssuerImpl=null; OAuthResponse response=null; //构建OAuth请求 try { OAuthTokenRequest oauthRequest =new OAuthTokenRequest(request); String authCode =oauthRequest.getParam(OAuth.OAUTH_CODE); String clientSecret = oauthRequest.getClientSecret(); if(clientSecret!=null||clientSecret!=""){ //生成Access Token oauthIssuerImpl =new OAuthIssuerImpl(new MD5Generator()); final String accessToken =oauthIssuerImpl.accessToken(); System.out.println(accessToken); System.out.println("--oooo---"); //生成OAuth响应 response = OAuthASResponse .tokenResponse(HttpServletResponse.SC_OK) .setAccessToken(accessToken) .buildJSONMessage(); } System.out.println("--------服务端/responseAccessToken-----------------------------------------------------------"); //根据OAuthResponse生成ResponseEntity return new ResponseEntity(response.getBody(), HttpStatus.valueOf(response.getResponseStatus())); } catch (OAuthSystemException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (OAuthProblemException e) { // TODO Auto-generated catch block e.printStackTrace(); } System.out.println("--------服务端/responseAccessToken-----------------------------------------------------------"); return null; } // 向客户端返回请求资源（username）的controller方法 @RequestMapping("/userInfo") public HttpEntity userInfo(HttpServletRequest request)throws OAuthSystemException{ System.out.println("-----------服务端/userInfo-------------------------------------------------------------"); try { //获取客户端传来的OAuth资源请求 OAuthAccessResourceRequest oauthRequest =new OAuthAccessResourceRequest(request, ParameterStyle.QUERY); //获取Access Token String accessToken =oauthRequest.getAccessToken(); System.out.println("accessToken"); //验证Access Token /*if (accessToken==null||accessToken=="") { // 如果不存在/过期了，返回未验证错误，需重新验证 OAuthResponse oauthResponse = OAuthRSResponse .errorResponse(HttpServletResponse.SC_UNAUTHORIZED) .setError(OAuthError.ResourceResponse.INVALID_TOKEN) .buildHeaderMessage(); HttpHeaders headers = new HttpHeaders(); headers.add(OAuth.HeaderType.WWW_AUTHENTICATE, oauthResponse.getHeader(OAuth.HeaderType.WWW_AUTHENTICATE)); return new ResponseEntity(headers, HttpStatus.UNAUTHORIZED); } */ //返回用户名 User user=new User("小明"); String username = accessToken+"---"+Math.random()+"----"+user.getUsername(); System.out.println(username); System.out.println("服务端/userInfo::::::ppp"); System.out.println("-----------服务端/userInfo----------------------------------------------------------"); return new ResponseEntity(username, HttpStatus.OK); } catch (OAuthProblemException e) { // TODO Auto-generated catch block e.printStackTrace(); //检查是否设置了错误码 String errorCode =e.getError(); if (OAuthUtils.isEmpty(errorCode)) { OAuthResponse oauthResponse = OAuthRSResponse .errorResponse(HttpServletResponse.SC_UNAUTHORIZED) .buildHeaderMessage(); HttpHeaders headers =new HttpHeaders(); headers.add(OAuth.HeaderType.WWW_AUTHENTICATE, oauthResponse.getHeader(OAuth.HeaderType.WWW_AUTHENTICATE)); return new ResponseEntity(headers, HttpStatus.UNAUTHORIZED); } OAuthResponse oauthResponse = OAuthRSResponse .errorResponse(HttpServletResponse.SC_UNAUTHORIZED) .setError(e.getError()) .setErrorDescription(e.getDescription()) .setErrorUri(e.getUri()) .buildHeaderMessage(); HttpHeaders headers =new HttpHeaders(); headers.add(OAuth.HeaderType.WWW_AUTHENTICATE, oauthResponse.getHeader(OAuth.HeaderType.WWW_AUTHENTICATE)); System.out.println("-----------服务端/userInfo------------------------------------------------------------------------------"); return new ResponseEntity(HttpStatus.BAD_REQUEST); } } }
客户端代码示例：
package com.flash.dataU.oauth.controller2; import org.apache.oltu.oauth2.client.OAuthClient; import org.apache.oltu.oauth2.client.URLConnectionClient; import org.apache.oltu.oauth2.client.request.OAuthBearerClientRequest; import org.apache.oltu.oauth2.client.request.OAuthClientRequest; import org.apache.oltu.oauth2.client.response.OAuthAccessTokenResponse; import org.apache.oltu.oauth2.client.response.OAuthResourceResponse; import org.apache.oltu.oauth2.common.OAuth; import org.apache.oltu.oauth2.common.exception.OAuthProblemException; import org.apache.oltu.oauth2.common.exception.OAuthSystemException; import org.apache.oltu.oauth2.common.message.types.GrantType; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.servlet.ModelAndView; import javax.servlet.http.HttpServletRequest; //接受客户端返回的code，提交申请access token的请求 @RequestMapping("/server") @Controller public class ServerController { String clientId = null; String clientSecret = null; String accessTokenUrl = null; String userInfoUrl = null; String redirectUrl = null; String response_type = null; String code= null; //提交申请code的请求 @RequestMapping("/requestServerCode") public String requestServerFirst() { clientId = "clientId"; clientSecret = "clientSecret"; accessTokenUrl = "responseCode"; redirectUrl = "http://localhost:8081/server/callbackCode"; response_type = "code"; OAuthClient oAuthClient = new OAuthClient(new URLConnectionClient()); String requestUrl = null; try { //构建oauthd的请求。设置请求服务地址（accessTokenUrl）、clientId、response_type、redirectUrl OAuthClientRequest accessTokenRequest = OAuthClientRequest .authorizationLocation(accessTokenUrl) .setResponseType(response_type) .setClientId(clientId) .setRedirectURI(redirectUrl) .buildQueryMessage(); requestUrl = accessTokenRequest.getLocationUri(); System.out.println(requestUrl); } catch (Exception e) { e.printStackTrace(); } System.out.println(requestUrl); return "redirect:http://localhost:8080/oauthserver/" + requestUrl; } //接受客户端返回的code，提交申请access token的请求 @RequestMapping("/callbackCode") public Object toLogin(HttpServletRequest request)throws OAuthProblemException{ System.out.println("-----------客户端/callbackCode--------------------------------------------------------------------------------"); clientId = "clientId"; clientSecret = "clientSecret"; accessTokenUrl="http://localhost:8080/oauthserver/responseAccessToken"; userInfoUrl = "userInfoUrl"; redirectUrl = "http://localhost:8081/server/accessToken"; HttpServletRequest httpRequest = (HttpServletRequest)request; code = httpRequest.getParameter("code"); System.out.println(code); OAuthClient oAuthClient =new OAuthClient(new URLConnectionClient()); try { OAuthClientRequest accessTokenRequest = OAuthClientRequest .tokenLocation(accessTokenUrl) .setGrantType(GrantType.AUTHORIZATION_CODE) .setClientId(clientId) .setClientSecret(clientSecret) .setCode(code) .setRedirectURI(redirectUrl) .buildQueryMessage(); //去服务端请求access token，并返回响应 OAuthAccessTokenResponse oAuthResponse =oAuthClient.accessToken(accessTokenRequest, OAuth.HttpMethod.POST); //获取服务端返回过来的access token String accessToken = oAuthResponse.getAccessToken(); //查看access token是否过期 Long expiresIn =oAuthResponse.getExpiresIn(); System.out.println("客户端/callbackCode方法的token：：："+accessToken); System.out.println("-----------客户端/callbackCode--------------------------------------------------------------------------------"); return"redirect:http://localhost:8081/server/accessToken?accessToken="+accessToken; } catch (OAuthSystemException e) { e.printStackTrace(); } return null; } //接受服务端传回来的access token，由此token去请求服务端的资源（用户信息等） @RequestMapping("/accessToken") public ModelAndView accessToken(String accessToken ) { System.out.println("---------客户端/accessToken----------------------------------------------------------------------------------"); userInfoUrl = "http://localhost:8080/oauthserver/userInfo"; System.out.println("accessToken"); OAuthClient oAuthClient =new OAuthClient(new URLConnectionClient()); try { OAuthClientRequest userInfoRequest =new OAuthBearerClientRequest(userInfoUrl) .setAccessToken(accessToken).buildQueryMessage(); OAuthResourceResponse resourceResponse =oAuthClient.resource(userInfoRequest, OAuth.HttpMethod.GET, OAuthResourceResponse.class); String username = resourceResponse.getBody(); System.out.println(username); ModelAndView modelAndView =new ModelAndView("usernamePage"); modelAndView.addObject("username",username); System.out.println("---------客户端/accessToken----------------------------------------------------------------------------------"); return modelAndView; } catch (Exception e) { e.printStackTrace(); } System.out.println("---------客户端/accessToken----------------------------------------------------------------------------------"); return null; } }
