SpringSecurityOAuth简介

今天药忘吃喽~ 2022-05-07 23:52 229阅读 0赞

![在这里插入图片描述][70]

![在这里插入图片描述][70 1]

![在这里插入图片描述][70 2]

## 开启认证服务器 ##

@Configuration
    @EnableAuthorizationServer
    public class ImoocAuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    
    	@Autowired
    	private UserDetailsService userDetailsService;
    
    	@Autowired
    	private AuthenticationManager authenticationManager;
    
    	@Autowired
    	private TokenStore tokenStore;
    
    	@Autowired(required = false)
    	private JwtAccessTokenConverter jwtAccessTokenConverter;
    
    	@Autowired(required = false)
    	private TokenEnhancer jwtTokenEnhancer;
    
    	@Autowired
    	private SecurityProperties securityProperties;
    
    	/**
    	 * 认证及token配置
    	 */
    	@Override
    	public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    		endpoints.tokenStore(tokenStore)
    				.authenticationManager(authenticationManager)
    				.userDetailsService(userDetailsService);
    
    		if (jwtAccessTokenConverter != null && jwtTokenEnhancer != null) {
    			TokenEnhancerChain enhancerChain = new TokenEnhancerChain();
    			List<TokenEnhancer> enhancers = new ArrayList<>();
    			enhancers.add(jwtTokenEnhancer);
    			enhancers.add(jwtAccessTokenConverter);
    			enhancerChain.setTokenEnhancers(enhancers);
    			endpoints.tokenEnhancer(enhancerChain).accessTokenConverter(jwtAccessTokenConverter);
    		}
    
    	}
    
    	/**
    	 * tokenKey的访问权限表达式配置
    	 */
    	public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    		security.tokenKeyAccess("permitAll()");
    	}
    
    	/**
    	 * 客户端配置
    	 */
    	@Override
    	public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    		InMemoryClientDetailsServiceBuilder builder = clients.inMemory();
    		if (ArrayUtils.isNotEmpty(securityProperties.getOauth2().getClients())) {
    			for (OAuth2ClientProperties client : securityProperties.getOauth2().getClients()) {
    				builder.withClient(client.getClientId())
    						.secret(client.getClientSecret())
    						.authorizedGrantTypes("refresh_token", "authorization_code", "password")
    						.accessTokenValiditySeconds(client.getAccessTokenValidateSeconds())
    						.refreshTokenValiditySeconds(2592000)
    						.scopes("all");
    			}
    		}
    	}
    
    }

![在这里插入图片描述][70 3]

官方参数：
    4.1.1.  Authorization Request
    
       The client constructs the request URI by adding the following
       parameters to the query component of the authorization endpoint URI
       using the "application/x-www-form-urlencoded" format, per Appendix B:
    
       response_type
             REQUIRED.  Value MUST be set to "code".
    
       client_id
             REQUIRED.  The client identifier as described in Section 2.2.  不配置，会打印出来
    
       redirect_uri
             OPTIONAL.  As described in Section 3.1.2.
       scope
             OPTIONAL.  The scope of the access request as described by
             Section 3.3.
    
       state
             RECOMMENDED.  An opaque value used by the client to maintain
             state between the request and callback.  The authorization
             server includes this value when redirecting the user-agent back
             to the client.  The parameter SHOULD be used for preventing
             cross-site request forgery as described in Section 10.12.

![在这里插入图片描述][70 4]

imooc.security.oauth2.clients[0].clientId = imooc     第一次配置去掉[0]
    imooc.security.oauth2.clients[0].clientSecret = imoocsecret

![在这里插入图片描述][70 5]

![在这里插入图片描述][70 6]

上一步请求，通过后，点同意授权，获得授权码  
![在这里插入图片描述][70 7]

4.1.3.  Access Token Request
    
       The client makes a request to the token endpoint by sending the
       following parameters using the "application/x-www-form-urlencoded"
       format per Appendix B with a character encoding of UTF-8 in the HTTP
       request entity-body:
    
       grant_type
             REQUIRED.  Value MUST be set to "authorization_code".
    
       code
             REQUIRED.  The authorization code received from the
             authorization server.
    
       redirect_uri
             REQUIRED, if the "redirect_uri" parameter was included in the
             authorization request as described in Section 4.1.1, and their
             values MUST be identical.
    
       client_id
             REQUIRED, if the client is not authenticating with the
             authorization server as described in Section 3.2.1.
    
       If the client type is confidential or the client was issued client
       credentials (or assigned other authentication requirements), the
       client MUST authenticate with the authorization server as described
       in Section 3.2.1.
       
       For example, the client makes the following HTTP request using TLS
       (with extra line breaks for display purposes only):

![在这里插入图片描述][70 8]

![在这里插入图片描述][70 9]

密码模式： 自己公司扮演app，自己公司扮演提供商 可用  
![在这里插入图片描述][70 10]

## 资源服务器 ##

@Configuration
    @EnableResourceServer
    public class ImoocResourceServerConfig extends ResourceServerConfigurerAdapter {
    	
    	@Autowired
    	protected AuthenticationSuccessHandler imoocAuthenticationSuccessHandler;
    	
    	@Autowired
    	protected AuthenticationFailureHandler imoocAuthenticationFailureHandler;
    	
    	@Autowired
    	private SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig;
    	
    	@Autowired
    	private OpenIdAuthenticationSecurityConfig openIdAuthenticationSecurityConfig;
    	
    	@Autowired
    	private ValidateCodeSecurityConfig validateCodeSecurityConfig;
    	
    	@Autowired
    	private SpringSocialConfigurer imoocSocialSecurityConfig;
    	
    	@Autowired
    	private AuthorizeConfigManager authorizeConfigManager;
    	
    	@Autowired
    	private FormAuthenticationConfig formAuthenticationConfig;
    	
    	@Override
    	public void configure(HttpSecurity http) throws Exception {
    		
    		formAuthenticationConfig.configure(http);
    		
    		http.apply(validateCodeSecurityConfig)
    				.and()
    			.apply(smsCodeAuthenticationSecurityConfig)
    				.and()
    			.apply(imoocSocialSecurityConfig)
    				.and()
    			.apply(openIdAuthenticationSecurityConfig)
    				.and()
    			.csrf().disable();
    		
    		authorizeConfigManager.config(http.authorizeRequests());
    	}
    	
    }

![在这里插入图片描述][70 11]

需要加上token\_type 和 token

## 源码解析 ##

![在这里插入图片描述][70 12]

![在这里插入图片描述][70 13]

## 自定义 如短信登录，申请token ##

/**
     * APP环境下认证成功处理器
     */
    @Component("imoocAuthenticationSuccessHandler")
    public class ImoocAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
    	//AuthenticationSuccessHandler
    	private Logger logger = LoggerFactory.getLogger(getClass());
    
    	@Autowired
    	private ObjectMapper objectMapper;
    
    	@Autowired
    	private ClientDetailsService clientDetailsService;
    	
    	@Autowired
    	private AuthorizationServerTokenServices authorizationServerTokenServices;
    
    
    	@SuppressWarnings("unchecked")
    	@Override
    	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
    			Authentication authentication) throws IOException, ServletException {
    
    		logger.info("登录成功");
    
    		String header = request.getHeader("Authorization");
    
    		if (header == null || !header.startsWith("Basic ")) {
    			throw new UnapprovedClientAuthenticationException("请求头中无client信息");
    		}
    
    		String[] tokens = extractAndDecodeHeader(header, request);
    		assert tokens.length == 2;
    
    		String clientId = tokens[0];
    		String clientSecret = tokens[1];
    
    		ClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId);
    
    		if (clientDetails == null) {
    			throw new UnapprovedClientAuthenticationException("clientId对应的配置信息不存在:" + clientId);
    		} else if (!StringUtils.equals(clientDetails.getClientSecret(), clientSecret)) {
    			throw new UnapprovedClientAuthenticationException("clientSecret不匹配:" + clientId);
    		}
    		
    		TokenRequest tokenRequest = new TokenRequest(MapUtils.EMPTY_MAP, clientId, clientDetails.getScope(), "custom");
    		
    		OAuth2Request oAuth2Request = tokenRequest.createOAuth2Request(clientDetails);
    		
    		OAuth2Authentication oAuth2Authentication = new OAuth2Authentication(oAuth2Request, authentication);
    		
    		OAuth2AccessToken token = authorizationServerTokenServices.createAccessToken(oAuth2Authentication);
    
    		response.setContentType("application/json;charset=UTF-8");
    		response.getWriter().write(objectMapper.writeValueAsString(token));
    
    	}
    
    	private String[] extractAndDecodeHeader(String header, HttpServletRequest request) throws IOException {
    
    		byte[] base64Token = header.substring(6).getBytes("UTF-8");
    		byte[] decoded;
    		try {
    			decoded = Base64.decode(base64Token);
    		} catch (IllegalArgumentException e) {
    			throw new BadCredentialsException("Failed to decode basic authentication token");
    		}
    
    		String token = new String(decoded, "UTF-8");
    
    		int delim = token.indexOf(":");
    
    		if (delim == -1) {
    			throw new BadCredentialsException("Invalid basic authentication token");
    		}
    		return new String[] { token.substring(0, delim), token.substring(delim + 1) };
    	}
    
    }

## 重构 社交登录 ##

![在这里插入图片描述][70 14]

[70]: /images/20220508/6d8dbf3c662344678aafb3d1678247be.png
[70 1]: /images/20220508/c6c3970fcf0b4be590ac16f402983fec.png
[70 2]: /images/20220508/36f911165f644d10ad09723fea270b84.png
[70 3]: /images/20220508/40575cc91a7848dc8fcd02e69878cfd0.png
[70 4]: /images/20220508/bc228f20d8364f27aab48caf8000b7ba.png
[70 5]: /images/20220508/e5de0a48ce2d49d4b0a5fa2a5318ac8c.png
[70 6]: /images/20220508/7a31beb159924069a7bd524c49361a33.png
[70 7]: /images/20220508/4249595b127640089a431b365c242c4c.png
[70 8]: /images/20220508/e55acb6f2c0f4ff383a99455ba66fe90.png
[70 9]: /images/20220508/a160caada99e4e84906801bc2e067657.png
[70 10]: /images/20220508/d3a433af45904a65bb43b38440ba1518.png
[70 11]: /images/20220508/0c945c463fd641099c004167f42fbf84.png
[70 12]: /images/20220508/8ec41c45979e40968ce6c00d348d5e83.png
[70 13]: /images/20220508/839611a3eca7439c8df26370f4ddd18c.png
[70 14]: /images/20220508/d476d2a53219446aa49e98edc4b6a931.png