Spring Cloud(6.2)：搭建OAuth2 Client
配置web.xml
添加spring-cloud-starter-security，spring-security-oauth2-autoconfigure和spring-boot-starter-oauth2-client 3个依赖。
<!-- Spring cloud starter: Security --> <!-- Include: web, actuator, security, zuul, etc. --> <dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-security</artifactId> </dependency> <!-- Spring Security OAuth2 Autoconfigure (optional in spring-cloud-security after 2.1) --> <dependency> <groupId>org.springframework.security.oauth.boot</groupId> <artifactId>spring-security-oauth2-autoconfigure</artifactId> </dependency> <!-- Spring Security OAuth2 Client (optional in spring-cloud-security after 2.1) --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-oauth2-client</artifactId> </dependency>
此外，它还是一个Eureka Client和Config Client，如何配置Eureka Client和Config Client请看前面章节。
配置Application
添加@EnableOAuth2Client注解，声明为OAuth2 Client。
@SpringBootApplication @EnableOAuth2Client public class AppSqlApplication { public static void main(String[] args) { SpringApplication.run(AppSqlApplication.class, args); } }
SSO单点登录的配置
（1）配置Configer
该服务作为一个OAuth2 Client，可以使用上一节的OAuth2 Server来登录。这其实就是SSO单点登录的例子。
package com.mycloud.demo.config; import java.util.ArrayList; import java.util.List; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.oauth2.client.userinfo.DefaultOAuth2UserService; import org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest; import org.springframework.security.oauth2.client.userinfo.OAuth2UserService; import org.springframework.security.oauth2.core.user.DefaultOAuth2User; import org.springframework.security.oauth2.core.user.OAuth2User; @Configuration public class AppSqlConfiger2 extends WebSecurityConfigurerAdapter { /* (non-Javadoc) * @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.web.builders.HttpSecurity) */ @Override protected void configure(HttpSecurity http) throws Exception { //@formatter:off http.authorizeRequests() .antMatchers("/", "/index**", "/login**", "/error**").permitAll() .antMatchers("/sql-sp-search/**").hasRole("SQL_USER") .antMatchers("/sql-tr-search/**").hasRole("SQL_USER") .and().logout().logoutSuccessUrl("/") .and().oauth2Login().userInfoEndpoint().userService(userService()) ; //@formatter:on } @SuppressWarnings("unchecked") private OAuth2UserService<OAuth2UserRequest, OAuth2User> userService() { //@formatter:off // Why configure this? // The default user-authority is DefaultOAuth2UserService.java, OAuth2UserAuthority.java and DefaultOAuth2User.java. // But the authority is set to ROLE_USER instead of authorities come from user-info endpoint on OAuth2UserAuthority. // So we need to reset the authority again after 'DefaultOAuth2UserService.loadUser()'. //@formatter:on final OAuth2UserService<OAuth2UserRequest, OAuth2User> delegate = new DefaultOAuth2UserService(); return (userRequest) -> { OAuth2User oauthUser = delegate.loadUser(userRequest); List<GrantedAuthority> authorities = new ArrayList<>(); Object obj = oauthUser.getAttributes().get("authorities"); if (obj != null) { List<String> authoritiesStrList = (List<String>) obj; for (String elem : authoritiesStrList) { GrantedAuthority authority = new SimpleGrantedAuthority(elem); authorities.add(authority); } } return new DefaultOAuth2User(authorities, oauthUser.getAttributes(), "user"); }; } }
[注1] 我们在这里使用了oauth2Login()及自定义了一个OAuth2UserService。OAuth2UserService实际上就是上一节中讲的调用Authorization Server的/user端点拿到的User信息。至于为什么自定义了一个OAuth2UserService，可以看代码中的注释。
（2）配置参数
## Spring info spring: # OAuth2 Client info (see ClientRegistration.java) security: oauth2: client: registration: server-auth: client-id: app-sql-client client-secret: '{cipher}e93cce4a8056a7359ded238e97a1c6d25142e6b688873a1e6181ac06753dd9ae' # basic or post (default is basic) # client-authentication-method: basic # authorizationGrantType cannot be null, authorizationGrantType must be authorization_code authorization-grant-type: authorization_code # redirectUriTemplate cannot be empty, default is '{baseUrl}/login/oauth2/code/{registrationId}' redirect-uri: http://localhost:10200/app-sql/login/oauth2/code/server-auth scope: all # client-name: app-sql provider: server-auth: # It's very important to add 'scope=all' to the url. Auth Server didn't config the scope, so in client side, # we must config it, otherwise, 'Empty scope (either the client or the user is not allowed the requested scopes)' # error occurred. # use zuul to replace 'http://localhost:10030/server-auth/xxx' token-uri: http://localhost:10020/server-zuul/s3/server-auth/oauth/token?scope=all authorization-uri: http://localhost:10020/server-zuul/s3/server-auth/oauth/authorize user-info-uri: http://localhost:10020/server-zuul/s3/server-auth/user # header, form or query (default is header) # user-info-authentication-method: header # the key used to get the user's "name" user-name-attribute: user
使用OAuth2RestTemplate在Client端调用被OAuth2保护的Resource
上面几步实际上是搭建一个SSO登录系统，但是如果我们想要在OAuth2 Client端调用OAuth2 Resource时，就需要做一些额外配置了。OAuth2 Resource的配置会在下一节详细介绍，这里主要来讲在OAuth2 Client端如何配置。
在OAuth2 Client端配置的核心就是OAuth2RestTemplate。我们通过给OAuth2RestTemplate配置好所有访问OAuth2 Authorization Server的参数创建OAuth2RestTemplate，接下来对OAuth2 Resource的调用交给OAuth2RestTemplate即可。
这里使用password模式为例。
（1）配置Configer
@Configuration public class AppSqlConfiger { @Bean @ConfigurationProperties("app-sql.resources.app-db") protected OAuth2ProtectedResourceDetails resource() { return new ResourceOwnerPasswordResourceDetails(); } @Bean public OAuth2RestTemplate restTemplate() { AccessTokenRequest atr = new DefaultAccessTokenRequest(); return new OAuth2RestTemplate(resource(), new DefaultOAuth2ClientContext(atr)); } }
（2）配置参数
## Regard 'app-sql' as oauth2-client and 'app-db' as oauth2-resource. ## Create OAuth2RestTemplate in 'app-sql' and set parameters(see AppSqlConfiger.java) and call 'app-db'. app-sql: resources: app-db: clientId: app-sql-client clientSecret: '{cipher}e93cce4a8056a7359ded238e97a1c6d25142e6b688873a1e6181ac06753dd9ae' grantType: password # use zuul to replace 'http://localhost:10030/server-auth/xxx' accessTokenUri: http://localhost:10020/server-zuul/s3/server-auth/oauth/token scope: all username: '{cipher}18a05787c976397d4d7d090ad326cc7417122109f590d8a8ba80cfa35f7a15c3' password: '{cipher}ab3894c202393761b8f789dd9f047e116b2008ae98b5f8119030796f905471d8'
再看Discovery Client
在Eureka Client一节中，我们讲了使用discoveryClient和loadBalancer来发现服务。现在，我们可以通过zuul来调用其他服务，和loadBalancer类似：
ServiceInstance instance = loadBalancer.choose("server-zuul");
String path = String.format("http://%s:%s/server-zuul/a2/app-db/structure-search/app/MORT/env/%s/db/%s/name/%s", instance.getHost(), instance.getPort(), env, db, name);
ResponseEntity<String> response = restTemplate.exchange(path, HttpMethod.GET, null, String.class);
