Spring Authorization Server 入门

如果您刚刚开始使用 Spring Authorization Server，下面的部分将引导您创建第一个应用程序。

概述

Spring Authorization Server 是一个框架，它提供了 OAuth 2.1 和 OpenID Connect 1.0 规范以及其他相关规范的实现。它构建在 Spring Security 之上，为构建OpenID Connect 1.0 身份认证和 OAuth2 授权服务器产品提供安全、轻量级和可定制的基础。

系统要求

Spring Authorization Server 需要 Java 8 或更高版本的运行时环境。

安装 Spring Authorization Server

Spring Authorization Server 可以在任何已经使用 Spring Security 的地方使用。

开始使用 Spring Authorization Server 最简单的方法是创建一个基于 Spring boot 的应用程序。然后将 Spring Authorization Server 添加为依赖项：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-authorization-server</artifactId>
    <version>0.3.1</version>
</dependency>

本文代码与项目实战

本文代码已托管至 Gitee：https://gitee.com/linjiabin100/spring-authorization-server-sample/tree/master/getting-started

Spring Authorization Server 实战项目：

Gitee	GitHub
后端	https://gitee.com/linjiabin100/pi-cloud.git	https://github.com/zengpi/pi-cloud.git
前端	https://gitee.com/linjiabin100/pi-cloud-web.git	https://github.com/zengpi/pi-cloud-web.git

开发你的第一个应用程序

您需要在 Spring Boot 配置类中定义 Spring Authorization Server 所需组件。这些组件可以定义如下：

@Configuration
public class SecurityConfig {

    /**
     * Spring Security 过滤器链，用于配置协议端点
     * @param http /
     * @return /
     * @throws Exception /
     */
	@Bean 
	@Order(1)
	public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
			throws Exception {
		OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
		http
			// Redirect to the login page when not authenticated from the
			// authorization endpoint
			.exceptionHandling((exceptions) -> exceptions
				.authenticationEntryPoint(
					new LoginUrlAuthenticationEntryPoint("/login"))
			);

		return http.build();
	}

    /**
     * Spring Security 过滤器链，用于身份验证
     * @param http /
     * @return /
     * @throws Exception /
     */
	@Bean 
	@Order(2)
	public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http)
			throws Exception {
		http
			.authorizeHttpRequests((authorize) -> authorize
				.anyRequest().authenticated()
			)
			// Form login handles the redirect to the login page from the
			// authorization server filter chain
			.formLogin(Customizer.withDefaults());

		return http.build();
	}

    /**
     * UserDetailsService 实例，用于检索要进行身份验证的用户
     * @return /
     */
	@Bean 
	public UserDetailsService userDetailsService() {
		UserDetails userDetails = User.withDefaultPasswordEncoder()
				.username("user")
				.password("password")
				.roles("USER")
				.build();

		return new InMemoryUserDetailsManager(userDetails);
	}

    /**
     * RegisteredClientRepository 实例，用于管理客户端
     * @return /
     */
	@Bean 
	public RegisteredClientRepository registeredClientRepository() {
		RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
				.clientId("messaging-client")
				.clientSecret("{noop}secret")
				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
				.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
				.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
				.redirectUri("http://127.0.0.1:8080/login/oauth2/code/messaging-client-oidc")
				.redirectUri("http://127.0.0.1:8080/authorized")
				.scope(OidcScopes.OPENID)
				.scope("message.read")
				.scope("message.write")
				.clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
				.build();

		return new InMemoryRegisteredClientRepository(registeredClient);
	}

    /**
     * com.nimbusds.jose.jwk.source.JWKSource 实例，用于签署访问令牌
     * @return /
     */
	@Bean 
	public JWKSource<SecurityContext> jwkSource() {
		KeyPair keyPair = generateRsaKey();
		RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
		RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
		RSAKey rsaKey = new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();
		JWKSet jwkSet = new JWKSet(rsaKey);
		return new ImmutableJWKSet<>(jwkSet);
	}

    /**
     * java.security.KeyPair 实例，加载 JWT 公钥和私钥
     * @return /
     */
	private static KeyPair generateRsaKey() { 
		KeyPair keyPair;
		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		}
		catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

    /**
     * （REQUIRED）包含OAuth2授权服务器的配置设置。它指定协议端点的URI以及 issuer 标识符。
     * @return /
     */
	@Bean 
	public ProviderSettings providerSettings() {
		return ProviderSettings.builder().build();
	}

}