SpringBoot2 + SpringSecurity + oauth2 搭建用户登录授权框架

港控/mmm° 2021-11-27 01:50 671阅读 0赞

# 前言 #

以前搭建过一个通过SpringSercurity去实现oauth2协议的简单框架，但是整体过于简单了，很多细节的实施都有许多的问题。另一方面呢，查看了网上许多关于这方面的技术文档，发现不是技术老旧，就是抄袭，还有的只是简单的去实现，没有从实际的需求去搭建。这一次决定抽出时间好好把这部分全部解决掉。

先简单介绍一下oauth2协议：  
客户端与服务器之间，存在一个授权层。客户端不能直接访问服务器，需要先从授权层得到token。接下来就是对资源的请求，每次请求需要带上token。  
简单来说就是：  
1. 用户访问授权服务器获取token。  
2. 用户携带token访问资源即可。

项目构建使用的技术栈：  
SpringBoot SpringSecurity Oauth2 MyBatis-Plus MySQL

# 核心部分配置 #

通过查看网上的一些文档，全部都是授权服务器与资源服务器相隔离。也就是说想使用这些必须要开启多个服务去支持。用户先去访问授权服务器，获得授权后再去访问资源服务器。但是，我想能不能融合起来，不需要多个服务，就在一个服务上搭建出来。下面就是将授权服务器与资源服务器融合起来的搭建方式。

### 数据库文件 ###

/*
     Navicat Premium Data Transfer
    
     Source Server         : localhost
     Source Server Type    : MySQL
     Source Server Version : 50643
     Source Host           : localhost:3306
     Source Schema         : bln
    
     Target Server Type    : MySQL
     Target Server Version : 50643
     File Encoding         : 65001
    
     Date: 23/07/2019 18:09:21
    */
    
    SET NAMES utf8mb4;
    SET FOREIGN_KEY_CHECKS = 0;
    
    -- ----------------------------
    -- Table structure for clientdetails
    -- ----------------------------
    DROP TABLE IF EXISTS `clientdetails`;
    CREATE TABLE `clientdetails`  (
      `appId` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
      `resourceIds` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `appSecret` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `scope` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `grantTypes` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `redirectUrl` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `authorities` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `access_token_validity` int(11) NULL DEFAULT NULL,
      `refresh_token_validity` int(11) NULL DEFAULT NULL,
      `additionalInformation` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `autoApproveScopes` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      PRIMARY KEY (`appId`) USING BTREE
    ) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Table structure for oauth_access_token
    -- ----------------------------
    DROP TABLE IF EXISTS `oauth_access_token`;
    CREATE TABLE `oauth_access_token`  (
      `id` int(11) NOT NULL AUTO_INCREMENT,
      `token_id` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `token` blob NULL,
      `authentication_id` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
      `user_name` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `client_id` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `authentication` blob NULL,
      `refresh_token` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `insert_date` timestamp(0) NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP(0),
      PRIMARY KEY (`id`) USING BTREE
    ) ENGINE = InnoDB AUTO_INCREMENT = 100 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
    
    
    -- ----------------------------
    -- Table structure for oauth_approvals
    -- ----------------------------
    DROP TABLE IF EXISTS `oauth_approvals`;
    CREATE TABLE `oauth_approvals`  (
      `userId` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `clientId` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `scope` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `status` varchar(10) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `expiresAt` timestamp(0) NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP(0),
      `lastModifiedAt` timestamp(0) NOT NULL DEFAULT '0000-00-00 00:00:00'
    ) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Table structure for oauth_client_details
    -- ----------------------------
    DROP TABLE IF EXISTS `oauth_client_details`;
    CREATE TABLE `oauth_client_details`  (
      `client_id` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
      `resource_ids` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `client_secret` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `scope` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `authorized_grant_types` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `web_server_redirect_uri` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `authorities` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `access_token_validity` int(11) NULL DEFAULT NULL,
      `refresh_token_validity` int(11) NULL DEFAULT NULL,
      `additional_information` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `autoapprove` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      PRIMARY KEY (`client_id`) USING BTREE
    ) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Records of oauth_client_details
    -- ----------------------------
    INSERT INTO `oauth_client_details` VALUES ('client', '*', 'E10ADC3949BA59ABBE56E057F20F883E', 'all', 'client_credentials,refresh_token,password', '', '*', NULL, NULL, NULL, NULL);
    
    -- ----------------------------
    -- Table structure for oauth_client_token
    -- ----------------------------
    DROP TABLE IF EXISTS `oauth_client_token`;
    CREATE TABLE `oauth_client_token`  (
      `token_id` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `token` blob NULL,
      `authentication_id` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
      `user_name` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `client_id` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      PRIMARY KEY (`authentication_id`) USING BTREE
    ) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Table structure for oauth_code
    -- ----------------------------
    DROP TABLE IF EXISTS `oauth_code`;
    CREATE TABLE `oauth_code`  (
      `code` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `authentication` blob NULL
    ) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Table structure for oauth_refresh_token
    -- ----------------------------
    DROP TABLE IF EXISTS `oauth_refresh_token`;
    CREATE TABLE `oauth_refresh_token`  (
      `token_id` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
      `token` blob NULL,
      `authentication` blob NULL
    ) ENGINE = InnoDB CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Records of oauth_refresh_token
    -- ----------------------------
    
    -- ----------------------------
    -- Table structure for role
    -- ----------------------------
    DROP TABLE IF EXISTS `role`;
    CREATE TABLE `role`  (
      `role_id` int(11) NOT NULL AUTO_INCREMENT,
      `role_code` varchar(255) CHARACTER SET utf8 COLLATE utf8_bin NULL DEFAULT NULL,
      `role_name` varchar(255) CHARACTER SET utf8 COLLATE utf8_bin NULL DEFAULT NULL,
      PRIMARY KEY (`role_id`) USING BTREE
    ) ENGINE = InnoDB AUTO_INCREMENT = 5 CHARACTER SET = utf8 COLLATE = utf8_bin ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Records of role
    -- ----------------------------
    INSERT INTO `role` VALUES (1, 'ROLE_ADM', '管理员');
    INSERT INTO `role` VALUES (2, 'ROLE_TEMP', '临时用户');
    INSERT INTO `role` VALUES (3, 'ROLE_HIGH_USER', '高级用户');
    INSERT INTO `role` VALUES (4, 'ROLE_USER', '普通用户');
    
    -- ----------------------------
    -- Table structure for user
    -- ----------------------------
    DROP TABLE IF EXISTS `user`;
    CREATE TABLE `user`  (
      `user_id` int(11) NOT NULL AUTO_INCREMENT,
      `username` varchar(255) CHARACTER SET utf8 COLLATE utf8_bin NULL DEFAULT NULL,
      `password` varchar(255) CHARACTER SET utf8 COLLATE utf8_bin NULL DEFAULT NULL,
      PRIMARY KEY (`user_id`) USING BTREE,
      UNIQUE INDEX `username_unique_index`(`username`) USING BTREE
    ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8 COLLATE = utf8_bin ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Records of user
    -- ----------------------------
    INSERT INTO `user` VALUES (1, '管理员', 'E10ADC3949BA59ABBE56E057F20F883E');
    INSERT INTO `user` VALUES (2, '普通用户', 'E10ADC3949BA59ABBE56E057F20F883E');
    INSERT INTO `user` VALUES (3, '临时用户', 'E10ADC3949BA59ABBE56E057F20F883E');
    
    -- ----------------------------
    -- Table structure for user_role
    -- ----------------------------
    DROP TABLE IF EXISTS `user_role`;
    CREATE TABLE `user_role`  (
      `user_role_id` int(11) NOT NULL AUTO_INCREMENT,
      `user_id` int(11) NULL DEFAULT NULL,
      `role_id` int(11) NULL DEFAULT NULL,
      PRIMARY KEY (`user_role_id`) USING BTREE
    ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8 COLLATE = utf8_bin ROW_FORMAT = Compact;
    
    -- ----------------------------
    -- Records of user_role
    -- ----------------------------
    INSERT INTO `user_role` VALUES (1, 1, 1);
    INSERT INTO `user_role` VALUES (2, 2, 4);
    INSERT INTO `user_role` VALUES (3, 3, 2);
    
    SET FOREIGN_KEY_CHECKS = 1;

### POM文件 ###

使用的依赖不多，主要是几个核心的包。有些不需要的包可以直接移除掉

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
    
        <groupId>com.fcz.oauth</groupId>
        <artifactId>spring-security-oauth2</artifactId>
        <version>0.0.0-SNAPSHOT</version>
        <packaging>jar</packaging>
    
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.0.9.RELEASE</version>
        </parent>
    
        <properties>
            <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
            <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
            <java.version>1.8</java.version>
        </properties>
    
        <dependencies>
            
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework.security.oauth</groupId>
                <artifactId>spring-security-oauth2</artifactId>
                <version>2.3.6.RELEASE</version>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.security.oauth.boot</groupId>
                <artifactId>spring-security-oauth2-autoconfigure</artifactId>
                <version>2.0.9.RELEASE</version>
            </dependency>
    
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
            </dependency>
    
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>druid</artifactId>
                <version>1.1.16</version>
            </dependency>
            
            <dependency>
                <groupId>com.ibeetl</groupId>
                <artifactId>beetl</artifactId>
                <version>2.7.27</version>
            </dependency>
            
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <optional>true</optional>
            </dependency>
            
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>fastjson</artifactId>
                <version>1.2.58</version>
            </dependency>
            
            <dependency>
                <groupId>io.springfox</groupId>
                <artifactId>springfox-swagger2</artifactId>
                <version>2.9.2</version>
            </dependency>
            
            <dependency>
                <groupId>io.springfox</groupId>
                <artifactId>springfox-swagger-ui</artifactId>
                <version>2.9.2</version>
            </dependency>
            
            <dependency>
                <groupId>com.baomidou</groupId>
                <artifactId>mybatis-plus-boot-starter</artifactId>
                <version>3.1.2</version>
            </dependency>
            
            <dependency>
                <groupId>com.baomidou</groupId>
                <artifactId>mybatis-plus-generator</artifactId>
                <version>3.1.2</version>
            </dependency>
            
            <dependency>
                <groupId>org.apache.velocity</groupId>
                <artifactId>velocity-engine-core</artifactId>
                <version>2.1</version>
            </dependency>
            
            <dependency>
                <groupId>org.freemarker</groupId>
                <artifactId>freemarker</artifactId>
                <version>2.3.28</version>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-data-redis</artifactId>
            </dependency>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-pool2</artifactId>
            </dependency>
    </project>

### 认证授权服务 ###

该类负责配置授权服务，包括对客户端的配置、token令牌的配置。  
在下侧定义令牌token中，我使用的是自定义的SystemTokenServices ，在其中我改了一些业务代码，下面也会讲到，如果不需要使用默认实现的DefaultTokenServices即可。

@Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
    
        @Resource
        private AuthenticationManager authenticationManager;
    
        @Resource
        private SystemUserDetailsService systemUserDetailsService;
    
        @Resource
        private DataSource dataSource;
    
        // 初始化JdbcTokenStore
        @Bean
        public TokenStore jdbcTokenStore() {
            return new SystemJdbcTokenStore(dataSource);
        }
    
        @Bean
        public ClientDetailsService clientDetails() {
            return new JdbcClientDetailsService(dataSource);
        }
    
        // 定义客户端
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            // 配置客户端, 用于client认证
            clients.withClientDetails(clientDetails());
        }
    
        // 定义令牌token
        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
            endpoints.tokenStore(jdbcTokenStore())  // 数据库保存token
                    .authenticationManager(authenticationManager)
                    .userDetailsService(systemUserDetailsService);
    
            // 配置TokenServices参数 自定义SystemTokenServices 的实现
            SystemTokenServices tokenServices = new SystemTokenServices();
            tokenServices.setTokenStore(endpoints.getTokenStore());
            tokenServices.setSupportRefreshToken(true);
            tokenServices.setClientDetailsService(endpoints.getClientDetailsService());
            tokenServices.setTokenEnhancer(endpoints.getTokenEnhancer());
            tokenServices.setReuseRefreshToken(false);  // 每次刷新token 都会重新生成新的refresh token
            tokenServices.setRefreshTokenValiditySeconds((int) TimeUnit.DAYS.toSeconds(7)); // 刷新token有效时(天)
            tokenServices.setAccessTokenValiditySeconds((int) TimeUnit.HOURS.toSeconds(2)); //token有效时间(小时)
    //        tokenServices.setRefreshTokenValiditySeconds((int) TimeUnit.SECONDS.toSeconds(600)); // 刷新token有效时 测试
    //        tokenServices.setAccessTokenValiditySeconds((int) TimeUnit.SECONDS.toSeconds(60)); //token有效时间 测试
            endpoints.tokenServices(tokenServices);
        }
    
        // 定义令牌端点上的安全性约束
        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
            oauthServer.allowFormAuthenticationForClients();
        }

### 资源服务器 ###

配置资源访问的权限

@Configuration
    @EnableResourceServer
    public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
    
        private static final String DEMO_RESOURCE_ID = "*";
    
        @Resource
        private SystemAuthenticationEntryPoint systemAuthenticationEntryPoint;
        @Resource
        private SystemAccessDeniedHandler systemAccessDeniedHandler;
        @Resource
    
        private ResourceServerTokenServices systemTokenServices;
    
        @Override
        public void configure(ResourceServerSecurityConfigurer resources) {
            resources.resourceId(DEMO_RESOURCE_ID).stateless(true);
            resources.tokenServices(systemTokenServices)
                    .authenticationEntryPoint(systemAuthenticationEntryPoint)
                    .accessDeniedHandler(systemAccessDeniedHandler);
        }
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
    
            http.requestMatchers()
                    .antMatchers("/api/**")
                    .and()
                    .authorizeRequests()
                    .antMatchers("/login","/api/token/**").permitAll() // for login
                     //.permitAll()  // swagger2
    //                .antMatchers( "/webjars/**", "/resources/**", "/swagger-ui.html",
    //                        "/swagger-resources/**", "/v2/api-docs").permitAll()
                    .anyRequest()
                    .authenticated();
        }
    }

### Web端点配置 ###

@Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(securedEnabled = true)  // 开启注解权限配置
    public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
    
        @Autowired
        private SystemUserDetailsService systemUserDetailsService;
    
        @Autowired
        private AuthenticationSuccessHandler authenticationSuccessHandler;
    
        @Autowired
        private AuthenticationFailureHandler authenticationFailureHandler;
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(systemUserDetailsService).passwordEncoder(new SecurityPasswordEncoder());
        }
    
        // 对password授权模式的支持
        @Bean
        @Override
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }
    
        // 静态资源不拦截配置
        @Override
        public void configure(WebSecurity web) {
            web.ignoring().antMatchers("/static/**");
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
    //        http.csrf();
            http.csrf().disable();
    
            // session 无状态 不使用 基于token访问
            http.sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    
    		// 表单登录配置
            http.formLogin()
                    .loginPage("/")
                    .loginProcessingUrl("/login")  // 用户登录
                    .usernameParameter("username").passwordParameter("password")
                    .successHandler(authenticationSuccessHandler)  // 登录成功处理
                    .failureHandler(authenticationFailureHandler);  // 登录失败处理
    
            http.logout()
                    .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                    .deleteCookies("remember-me")
                    .invalidateHttpSession(true);
        }
    }

实现这三个类，基本上就有了一个大致的框架，我们有了授权、资源等配置。

获取token: POST http://localhost:8081/oauth/token?grant\_type=password&username=user\_1&password=123456&client\_id=apply&client\_secret=123456  
返回结果格式:

{
        "access_token": "a5471852-d78b-456c-ac92-0cb4f3fd30de",  这个就是我们需要的token
        "token_type": "bearer",  token类型
        "refresh_token": "0f175abb-bedc-4dfb-9798-7e380046564e", 刷新token 负责刷新token
        "expires_in": 7199, 有效期 
        "scope": "all" 
        }

### 自定义用户 ###

用户信息的获取

@Service
    public class SystemUserDetailsService implements UserDetailsService {
    
        @Autowired
        private UserMapper userMapper;
    
        @Override
        public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
            User user = userMapper.selectOne(new QueryWrapper<User>().eq("username",userName));
            if (user == null) {
                throw new BadCredentialsException("user: " + userName + " not found.");
            }
            List<String> roleCodeList = userMapper.queryUserOwnedRoleCodes(userName);
    
            Set<GrantedAuthority> authorities =
                    roleCodeList.stream().map(e -> new SimpleGrantedAuthority(e)).collect(Collectors.toSet());
    
            return new SystemUserDetails(user,authorities);
        }
    }

### 自定义token ###

如果使用的是JdbcTokenStore，那么数据库中表就不能发生改变了。当然在实际项目中数据库表结构肯定是会发生变动的，我们可以重写该类，修改其中的SQL语句就可以自定义了，然后进行注入。

详细请查看GitHub中的代码。

只有这些是远远不够的，我们需要一个完整的用户登录流程

1.  用户请求登录接口
2.  服务器对用户名密码进行验证。
3.  验证成功后对用户授权，获取token。
4.  将token返回给前端

接下来，当用户登录的时候访问哪个接口，怎么获取token呢。  
大家可以看到WebSecurityConfiguration 类中的表单登录配置上，对用户登录的策略进行了配置，用户填写账号密码后访问/login接口，会自动验证用户的账号密码，成功后会执行 successHandler(authenticationSuccessHandler) ，失败则是执行failureHandler(authenticationFailureHandler)。  
当用户登录成功后，我们就要去实现获取token的策略了。

### 用户登录处理 ###

登录成功处理

@Component
    public class AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
    
        private static Logger logger = LogManager.getLogger(AuthenticationSuccessHandler.class.getName());
        @Autowired
        private TokenController tokenController;
    
        @Override
        public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                                            Authentication authentication) throws IOException {
            String username = request.getParameter("username");
            String password = request.getParameter("password");
            // 获取token 这里tokenController最好封装到Service层中 这里为了省事 直接这么写了
            Wrapper result = tokenController.loadToken(username,password);
            response.setStatus(HttpStatus.OK.value());
            response.setHeader("Content-Type", "application/json;charset=UTF-8");
            if (result == null) {
                response.getWriter().println(Wrapper.error().toJsonString());
                return;
            }
            if (result.getCode() != ResponseConstant.SUCCESS_CODE) {
                response.getWriter().println(Wrapper.error().toJsonString());
                return;
            }
      		 response.getWriter().println(result.toJsonString());
        }
    }

登录成功以后请求接口获取用户的token，然后将token返回。

> 获取token代码 在[GitHub ][GitHub]

### TOKEN刷新 ###

流程执行到这里，一个简单的用户登录就已经完成了，接下来该用户就可以携带token访问资源了。

如果**token过期后怎么处理**呢，如果让用户重新登录那么用户体验一定很差。因此可以使用refresh\_token去刷新token。  
使用refresh\_token刷新token的**一种方案**是，在获取token后，将refresh\_token保存在客户端，每次请求要带上token和refresh\_token。服务器验证每一次token的有效时长，当快要过期的时候就是用refresh\_token进行刷新token即可。  
但是，这样做也就将**token完全公开**了，如果被人劫持了，可以一直通过refresh\_token去刷新token，那么token的安全性就降低了。

> 发现使用TokenStore可以通过token找出refresh\_token，这样的话，我就可以在完全保密refresh\_token的情况下，去刷新token。

使用这种做法还需要**捕获到token 的异常**，分为两种，一种是**token失效**，另一种就是**token过期**。 这个地方有需要配置异常的自定义处理了。后面会讲到。  
**刷新流程**  
1. 当用户使用过期token请求后端  
2. 服务器捕获到token异常，判断出过期异常。  
3. 刷新token，并将新的token返回。  
4. 前端再更新token后重新请求。

使用这样的流程就可以很好的解决问题了。

刷新token代码如下:

/**
         * description 通过refreshToken刷新新的token
         * @param token 刷新token
         * @author Mr.F
         * @since 2019/7/9
         **/
        public Wrapper refreshToken(@PathVariable("token") String token) {
            // 获取token信息
            OAuth2AccessToken oAuth2AccessToken = jdbcTokenStore.readAccessToken(token);
            // 得到refresh_token
            OAuth2RefreshToken oAuth2RefreshToken = oAuth2AccessToken.getRefreshToken();
            String refreshToken = oAuth2RefreshToken.getValue();
            String url = authorizationUri + "/oauth/token?grant_type=refresh_token&refresh_token=" + refreshToken
                    + "&client_id=" + clientId + "&client_secret=" + clientSecret;
            try {
                String newToken = requestToken(url);
                return Wrapper.info(ResponseConstant.TOKEN_EXPIRED_CODE, ResponseConstant.TOKEN_EXPIRED_MESSAGE, newToken);
            } catch (Exception e) {
                logger.debug("access_token 和 refresh_token 都失效,需要重新登录  access_token:[{}], refresh_token: [{}]", token, refreshToken);
                return Wrapper.info(ResponseConstant.USER_LOGIN_EXPIRED_CODE, ResponseConstant.USER_LOGIN_EXPIRED_MESSAGE);
            }
        }
    
        /**
         * description  请求url获取token
         * @param url
         * @author Mr.F
         * @since 2019/7/9
         **/
        private String requestToken(String url) {
            String token;
            HttpHeaders headers = new HttpHeaders();
            headers.setContentType(MediaType.APPLICATION_JSON_UTF8);
            HttpEntity<String> entity = new HttpEntity<>("", headers);
            ResponseEntity<String> response = null;
            response = restTemplate.exchange(url, HttpMethod.POST, entity, String.class);
            JSONObject tokenJson = JSONObject.parseObject(response.getBody());
            token = tokenJson.getString("access_token");
            return token;
        }

> 代码有点多，粘上来的代码并不全 [GitHub ][GitHub]

当进行到这里，发现了一个很 **严重的问题**：通过源码进行分析，当异常处理捕获到token的异常时，会直接删除该token，这样的话，下一步通过该token找到refresh\_token就会找不到。  
源码分析:  
org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter类  
首先会获取到请求的token，然后去认证，如果认证成功会将用户信息放入SecurityContextHolder中。

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
            boolean debug = logger.isDebugEnabled();
            HttpServletRequest request = (HttpServletRequest)req;
            HttpServletResponse response = (HttpServletResponse)res;
            try {
                Authentication authentication = this.tokenExtractor.extract(request);
                if (authentication == null) {
                    if (this.stateless && this.isAuthenticated()) {
                        if (debug) {
                            logger.debug("Clearing security context.");
                        }
    
                        SecurityContextHolder.clearContext();
                    }
    
                    if (debug) {
                        logger.debug("No token in request, will continue chain.");
                    }
                } else {
                	// 重要的地方来了
                    request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_VALUE, authentication.getPrincipal());
                    if (authentication instanceof AbstractAuthenticationToken) {
                        AbstractAuthenticationToken needsDetails = (AbstractAuthenticationToken)authentication;
                        needsDetails.setDetails(this.authenticationDetailsSource.buildDetails(request));
                    }
                    // 认证用户的token 认证失败会抛出异常  
                    // 
                    Authentication authResult = this.authenticationManager.authenticate(authentication);
                    if (debug) {
                        logger.debug("Authentication success: " + authResult);
                    }
                    this.eventPublisher.publishAuthenticationSuccess(authResult);
                    // 将用户信息放入ThreadLocal中
                    SecurityContextHolder.getContext().setAuthentication(authResult);
                }
            } catch (OAuth2Exception var9) {
                // 清空用户信息
                SecurityContextHolder.clearContext();
                if (debug) {
                    logger.debug("Authentication request failed: " + var9);
                }
                this.eventPublisher.publishAuthenticationFailure(new BadCredentialsException(var9.getMessage(), var9), new PreAuthenticatedAuthenticationToken("access-token", "N/A"));
                // 对异常的处理 自定义异常处理就是实现该方法
                this.authenticationEntryPoint.commence(request, response, new InsufficientAuthenticationException(var9.getMessage(), var9));
                return;
            }
            chain.doFilter(request, response);
        }

Authentication authResult = this.authenticationManager.authenticate(authentication);方法的实现  
org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationManager  
负责找到token以及关联的数据

public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            if (authentication == null) {
                throw new InvalidTokenException("Invalid token (token not found)");
            } else {
                String token = (String)authentication.getPrincipal();
                // 最重要的 找到该token
                OAuth2Authentication auth = this.tokenServices.loadAuthentication(token);
                if (auth == null) {
                    throw new InvalidTokenException("Invalid token: " + token);
                } else {
                // 这里做一下资源的认证 
                    Collection<String> resourceIds = auth.getOAuth2Request().getResourceIds();
                    if (this.resourceId != null && resourceIds != null && !resourceIds.isEmpty() && !resourceIds.contains(this.resourceId)) {
                        throw new OAuth2AccessDeniedException("Invalid token does not contain resource id (" + this.resourceId + ")");
                    } else {
                        this.checkClientDetails(auth);
                        if (authentication.getDetails() instanceof OAuth2AuthenticationDetails) {
                            OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails)authentication.getDetails();
                            if (!details.equals(auth.getDetails())) {
                                details.setDecodedDetails(auth.getDetails());
                            }
                        }
    
                        auth.setDetails(authentication.getDetails());
                        auth.setAuthenticated(true);
                        return auth;
                    }
                }
            }
        }

OAuth2Authentication auth = this.tokenServices.loadAuthentication(token); 方法的实现  
org.springframework.security.oauth2.provider.token.DefaultTokenServices (该类实现的是token的存取策略)  
获取token实例

public OAuth2Authentication loadAuthentication(String accessTokenValue) throws AuthenticationException, InvalidTokenException {
    		// 从数据源中 获取token
            OAuth2AccessToken accessToken = this.tokenStore.readAccessToken(accessTokenValue);
            if (accessToken == null) {
                // token不存在 抛出token无效的异常
                throw new InvalidTokenException("Invalid access token: " + accessTokenValue);
            } else if (accessToken.isExpired()) {
                // token过期 会删除该token（就是这个地方删除了我们的token）
                this.tokenStore.removeAccessToken(accessToken);
                throw new InvalidTokenException("Access token expired: " + accessTokenValue);
            } else {
                OAuth2Authentication result = this.tokenStore.readAuthentication(accessToken);
                if (result == null) {
                    throw new InvalidTokenException("Invalid access token: " + accessTokenValue);
                } else {
                    if (this.clientDetailsService != null) {
                        String clientId = result.getOAuth2Request().getClientId();
    
                        try {
                            this.clientDetailsService.loadClientByClientId(clientId);
                        } catch (ClientRegistrationException var6) {
                            throw new InvalidTokenException("Client not valid: " + clientId, var6);
                        }
                    }
    
                    return result;
                }
            }
        }

认真看完这些源码立马就想清楚怎么回事了，在我获取之前就已经被删除了。那既然想进行下去，那我只能给他替换掉了。我重新实现这个方法，在token过期的判断中，**不再删除token**即可。

> 相信细心的人会想到，如果不删除token，再次重新获取token，那么会不会存在大量的冗余数据呢。实际上是不会的，在refreshToken方法内，已经帮助我们做到了这些。

这些都做完，那么一个较为完善的用户登录授权已经初具规模了。我们有完整的认证流程以及完善的token刷新机制。

### 用户的多端登录 ###

这些都做完的时候，突然想到。如果同一用户在多个终端登录会有问题么？事实上是有问题的。  
还是在org.springframework.security.oauth2.provider.token.DefaultTokenServices代码中

每次登录验证通过后，授权时，都会调用该方法去获取token。当已经存在一个token时，再次获取token，会直接获取到该token。这样的机制就带来了上面所说到的问题。

例如使用 “用户A” 在 “终端A” 进行登录获取到了tokenA，当我在 “终端B” 使用 “用户A” 进行登录的时候，或直接获取到“终端A”的tokenA。当tokenA过期重新刷新后，那么两边终端token肯定会冲突。

那么怎么解决这个问题呢？非常简单，只需要修改一下其中的代码逻辑，不去判断token是否存在了，只要是用户登录直接去创建一条新的token记录即可。

public OAuth2AccessToken createAccessToken(OAuth2Authentication authentication) throws AuthenticationException {
            // 判断该用户的token是否存在
            OAuth2AccessToken existingAccessToken = this.tokenStore.getAccessToken(authentication);
            OAuth2RefreshToken refreshToken = null;
            if (existingAccessToken != null) {
                 // 已经存在
                if (!existingAccessToken.isExpired()) {
                     // 当前token没有过期 直接返回即可
                    this.tokenStore.storeAccessToken(existingAccessToken, authentication);
                    return existingAccessToken;
                }
                if (existingAccessToken.getRefreshToken() != null) {
                	// 获取refreshToken
                    refreshToken = existingAccessToken.getRefreshToken();
                    this.tokenStore.removeRefreshToken(refreshToken);
                }
                // 删除该token 重新认证
                this.tokenStore.removeAccessToken(existingAccessToken);
            }
    
            if (refreshToken == null) {
                refreshToken = this.createRefreshToken(authentication);
            } else if (refreshToken instanceof ExpiringOAuth2RefreshToken) {
                ExpiringOAuth2RefreshToken expiring = (ExpiringOAuth2RefreshToken)refreshToken;
                if (System.currentTimeMillis() > expiring.getExpiration().getTime()) {
                    refreshToken = this.createRefreshToken(authentication);
                }
            }
            // 下面的就是认证 就不介绍了 
            OAuth2AccessToken accessToken = this.createAccessToken(authentication, refreshToken);
            this.tokenStore.storeAccessToken(accessToken, authentication);
            refreshToken = accessToken.getRefreshToken();
            if (refreshToken != null) {
                this.tokenStore.storeRefreshToken(refreshToken, authentication);
            }
    
            return accessToken;
        }

上面是源码，修改为

public OAuth2AccessToken createAccessToken(OAuth2Authentication authentication) throws AuthenticationException {
            OAuth2RefreshToken refreshToken = null;
            refreshToken = this.createRefreshToken(authentication);
    
            OAuth2AccessToken accessToken = this.createAccessToken(authentication, refreshToken);
            this.jdbcTokenStore.storeAccessToken(accessToken, authentication);
            refreshToken = accessToken.getRefreshToken();
            if (refreshToken != null) {
                this.jdbcTokenStore.storeRefreshToken(refreshToken, authentication);
            }
    
            return accessToken;
        }

直接生成token就完成。

这样同一用户多端登录也就完成了

### 完结 ###

项目也终于搭建好了。在 [GitHub ][GitHub]上，是一个完整搭建好的框架，已经集成了一些好用的插件，例如swagger2，Mybatis-plus的代码自动生成。  
如果对你有帮助，麻烦在 [GitHub ][GitHub]上动动小手，点一下start。

[GitHub]: https://github.com/fangchunzao/spring-security-oauth2