spring Security4 和 oauth2整合注解+xml混合使用（替换6位的授权码）

分手后的思念是犯贱 2022-06-03 20:41 213阅读 0赞

## spring Security4 和 oauth2整合替换6位的授权码 ##

git地址：[https://gitee.com/ffch/OauthUmp][https_gitee.com_ffch_OauthUmp]

[spring Security4 和 oauth2整合 注解+xml混合使用（基础运行篇）][spring Security4 _ oauth2_ _xml]  
[spring Security4 和 oauth2整合 注解+xml混合使用（进阶篇）][spring Security4 _ oauth2_ _xml 1]  
[spring Security4 和 oauth2整合 注解+xml混合使用（授权码篇）][spring Security4 _ oauth2_ _xml 2]  
[spring Security4 和 oauth2整合 注解+xml混合使用（注意事项篇）][spring Security4 _ oauth2_ _xml 3]  
[spring Security4 和 oauth2整合 注解+xml混合使用（替换6位的授权码）][spring Security4 _ oauth2_ _xml_6]  
[spring Security4 和 oauth2整合 注解+xml混合使用（替换用户名密码认证）][spring Security4 _ oauth2_ _xml 4]  
[spring Security4 和 oauth2整合 注解+xml混合使用（验证码等额外数据验证）][spring Security4 _ oauth2_ _xml 5]

### InMemoryAuthorizationCodeServices ###

InMemoryAuthorizationCodeServices是spring oauth2生成授权码code的bean，这个是new出来的，所以我们不能通过自定义bean去替换，默认是生成6位的code。但是还是可以替换的。

### 自定义InMemoryAuthorizationCodeServices ###

生成16位code，这里我是通过xml配置了bean，方便替换，也可以用@Component，我这里没去试。

package com.ump.oauth.part;
    
    import java.util.concurrent.ConcurrentHashMap;
    
    import org.springframework.security.oauth2.common.util.RandomValueStringGenerator;
    import org.springframework.security.oauth2.provider.OAuth2Authentication;
    import org.springframework.security.oauth2.provider.code.RandomValueAuthorizationCodeServices;
    
    public class InMemoryAuthorizationCodeServices extends RandomValueAuthorizationCodeServices{
    	protected final ConcurrentHashMap<String, OAuth2Authentication> authorizationCodeStore = new ConcurrentHashMap<String, OAuth2Authentication>();
    	private RandomValueStringGenerator generator = new RandomValueStringGenerator(16);
    	@Override
    	protected void store(String code, OAuth2Authentication authentication) {
    		this.authorizationCodeStore.put(code, authentication);
    	}
    
    	@Override
    	public OAuth2Authentication remove(String code) {
    		OAuth2Authentication auth = this.authorizationCodeStore.remove(code);
    		return auth;
    	}
    	
    	@Override
    	public String createAuthorizationCode(OAuth2Authentication authentication) {
    		String code = generator.generate();
    		store(code, authentication);
    		return code;
    	}
    }

### 认证配置 ###

AuthorizationServerConfiguration中配置AuthorizationServerEndpointsConfigurer有设置authorizationCodeServices的方法。就是一个autowired和endpoints.authorizationCodeServices(authorizationCodeServices);即可。

package com.ump.oauth.config;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Qualifier;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
    import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
    import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
    import org.springframework.security.oauth2.provider.ClientDetailsService;
    import org.springframework.security.oauth2.provider.approval.UserApprovalHandler;
    import org.springframework.security.oauth2.provider.code.AuthorizationCodeServices;
    import org.springframework.security.oauth2.provider.token.TokenStore;
    
    @Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
    
    	private static String REALM = "MY_OAUTH_REALM";
    
    	@Autowired
    	private TokenStore tokenStore;
    	
    	@Autowired
    	@Qualifier("myClientDetailsService") 
    	private ClientDetailsService clientDetailsService;
    
    	@Autowired
    	private UserApprovalHandler userApprovalHandler;
     
    	@Autowired
    	@Qualifier("authenticationManagerBean")
    	private AuthenticationManager authenticationManager;
    	
    	@Autowired
    	@Qualifier("authorizationCodeServices")
    	private AuthorizationCodeServices authorizationCodeServices;
    
    	@Override
    	public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    		clients.withClientDetails(clientDetailsService);
    	}
    
    	@Override
    	public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    		endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
    				.authenticationManager(authenticationManager);
    		endpoints.authorizationCodeServices(authorizationCodeServices);
    	}
    
    	@Override
    	public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
    		oauthServer.allowFormAuthenticationForClients();
    		oauthServer.realm(REALM + "/client");
    	}
    }

[https_gitee.com_ffch_OauthUmp]: https://gitee.com/ffch/OauthUmp
[spring Security4 _ oauth2_ _xml]: http://blog.csdn.net/feiyangtianyao/article/details/78687161
[spring Security4 _ oauth2_ _xml 1]: http://blog.csdn.net/feiyangtianyao/article/details/78687403
[spring Security4 _ oauth2_ _xml 2]: http://blog.csdn.net/feiyangtianyao/article/details/78687569
[spring Security4 _ oauth2_ _xml 3]: http://blog.csdn.net/feiyangtianyao/article/details/78687700
[spring Security4 _ oauth2_ _xml_6]: http://blog.csdn.net/feiyangtianyao/article/details/78721818
[spring Security4 _ oauth2_ _xml 4]: http://blog.csdn.net/feiyangtianyao/article/details/78727949
[spring Security4 _ oauth2_ _xml 5]: http://blog.csdn.net/feiyangtianyao/article/details/78728147