Spring Authorization Server 授权服务器

àì夳堔傛蜴生んèń 2023-09-24 22:16 58阅读 0赞

## 说明 ##

`Spring Authorization Server` 遵循[Oauth2.1][]和[OpenID Connect 1.0][]，它建立在`Spring Security`之上。

## 最小化项目 ##

### 创建项目 ###

要求JDK11以上

使用Idea创建一个Maven的Spring Boot(笔者使用的是`spring boot 2.7`)项目

pom需要引入`Authorization Server的配置`

<dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-oauth2-authorization-server</artifactId>
 <version>0.3.1</version>
 </dependency>
 复制代码

完整的pom.xml文件如下：

<?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 <modelVersion>4.0.0</modelVersion>
 <parent>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-parent</artifactId>
 <version>2.7.0</version>
 <relativePath/> 
 </parent>
 <groupId>com.itlab1024</groupId>
 <artifactId>Spring_Authorization_Server_0_3_x</artifactId>
 <version>0.0.1-SNAPSHOT</version>
 <name>Spring-Authorization-Server-0.3.0</name>
 <description>Spring-Authorization-Server-0.3.0</description>
 <properties>
 <java.version>17</java.version>
 </properties>
 <dependencies>
 
 <dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-oauth2-authorization-server</artifactId>
 <version>0.3.1</version>
 </dependency>
 
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-web</artifactId>
 </dependency>
 
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-actuator</artifactId>
 </dependency>
 
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-test</artifactId>
 <scope>test</scope>
 </dependency>
 </dependencies>
 
 <build>
 <plugins>
 <plugin>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-maven-plugin</artifactId>
 </plugin>
 </plugins>
 </build>
 </project>
 复制代码

### 配置 ###

使用`@Bean`和`@Configuration`创建配置，这是官方推荐的最小配置。

package com.itlab1024.base;
 
 import com.nimbusds.jose.jwk.JWKSet;
 import com.nimbusds.jose.jwk.RSAKey;
 import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
 import com.nimbusds.jose.jwk.source.JWKSource;
 import com.nimbusds.jose.proc.SecurityContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.core.AuthorizationGrantType;
 import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
 import org.springframework.security.oauth2.core.oidc.OidcScopes;
 import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
 import org.springframework.security.oauth2.server.authorization.config.ClientSettings;
 import org.springframework.security.oauth2.server.authorization.config.ProviderSettings;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
 
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
 import java.util.UUID;
 
 @Configuration
 @EnableWebSecurity
 public class SecurityConfig {
 
 /**
 * 这是个Spring security 的过滤器链，默认会配置
 * 
 * OAuth2 Authorization endpoint
 * 
 * OAuth2 Token endpoint
 * 
 * OAuth2 Token Introspection endpoint
 * 
 * OAuth2 Token Revocation endpoint
 * 
 * OAuth2 Authorization Server Metadata endpoint
 * 
 * JWK Set endpoint
 * 
 * OpenID Connect 1.0 Provider Configuration endpoint
 * 
 * OpenID Connect 1.0 UserInfo endpoint
 * 这些协议端点，只有配置了他才能够访问的到接口地址（类似mvc的controller）。
 *
 * @param http
 * @return
 * @throws Exception
 */
 @Bean
 @Order(1)
 public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
 throws Exception {
 OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
 http
 // Redirect to the login page when not authenticated from the
 // authorization endpoint
 .exceptionHandling((exceptions) -> exceptions
 .authenticationEntryPoint(
 new LoginUrlAuthenticationEntryPoint("/login"))
 );
 
 return http.build();
 }
 
 /**
 * 这个也是个Spring Security的过滤器链，用于Spring Security的身份认证。
 * @param http
 * @return
 * @throws Exception
 */
 @Bean
 @Order(2)
 public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http)
 throws Exception {
 http
 .authorizeHttpRequests((authorize) -> authorize
 .anyRequest().authenticated()
 )
 // Form login handles the redirect to the login page from the
 // authorization server filter chain
 .formLogin(Customizer.withDefaults());
 
 return http.build();
 }
 
 /**
 * 配置用户信息，或者配置用户数据来源，主要用于用户的检索。
 * @return
 */
 @Bean
 public UserDetailsService userDetailsService() {
 UserDetails userDetails = User.withDefaultPasswordEncoder()
 .username("user")
 .password("password")
 .roles("USER")
 .build();
 
 return new InMemoryUserDetailsManager(userDetails);
 }
 
 /**
 * oauth2 用于第三方认证，RegisteredClientRepository 主要用于管理第三方（每个第三方就是一个客户端）
 * @return
 */
 @Bean
 public RegisteredClientRepository registeredClientRepository() {
 RegisteredClient registeredClient = RegisteredClient.

[Oauth2.1]: https://link.juejin.cn?target=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-oauth-v2-1-05
[OpenID Connect 1.0]: https://link.juejin.cn?target=https%3A%2F%2Fopenid.net%2Fspecs%2Fopenid-connect-core-1_0.html