SpringBoot从入门到精通教程（二十二）- Oauth2+Token详细用法/SpringSecurity

灰太狼 2021-12-04 02:51 723阅读 0赞

# 需求背景 #

> 本篇文章讲解如何通过Springboot2集成验证服务Token，以及资源服务的用法（[更多官方关于 Oauth2][Oauth2]）

# 概要 #

主要使用Spring Boot2和SpringSecurity5

# OAuth2术语 #

*  资源拥有者 Resource Owner
    
     *  用户授权哪些应用程序，能够去访问资源信息等，访问受限于作用域
 *  资源服务 Resource Server
    
     *  一个在客户端拥有令牌后，处理验证它请求的服务
 *  客户端 Client
    
     *  一个代表资源拥有者的应用程序，可以访问受保护的资源
 *  授权服务 Authorization Server
    
     *  一个在成功验证了客户端和资源拥有者，以及验证请求后，分发令牌的授权服务
 *  令牌 Access Token
    
     *  一个用于访问受限资源的唯一token
 *  作用域范围 Scope
    
     *  一个许可权限
 *  授权类型 Grant type
    
     *  授权是指获得令牌的方法（[更多官方支持的Grant Type][Grant Type]）

# Oauth2 密码授权流程 #

在oauth2协议中，一个应用会有自己的clientId和clientSecret（从认证方申请），由认证方下发clientId和secret

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70][]

# 代码演示 #

> 授权服务 Authorization Server

构建Authorization Server，这里我使用了SpringSecurity5 和 SpringBoot 2.0.6版本

**1. 项目目录结构**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 1][]

**2. pom.xml依赖组件**

<dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>net.sf.json-lib</groupId>
        <artifactId>json-lib-ext-spring</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security.oauth.boot</groupId>
        <artifactId>spring-security-oauth2-autoconfigure</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-jdbc</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-configuration-processor</artifactId>
        <optional>true</optional>
    </dependency>
    <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
        <scope>runtime</scope>
    </dependency>

**3. 这里为演示，使用了H2数据库**

以下是Spring Security需要用到的OAuth2 SQL

CREATE TABLE IF NOT EXISTS oauth_client_details (
      client_id VARCHAR(256) PRIMARY KEY,
      resource_ids VARCHAR(256),
      client_secret VARCHAR(256) NOT NULL,
      scope VARCHAR(256),
      authorized_grant_types VARCHAR(256),
      web_server_redirect_uri VARCHAR(256),
      authorities VARCHAR(256),
      access_token_validity INTEGER,
      refresh_token_validity INTEGER,
      additional_information VARCHAR(4000),
      autoapprove VARCHAR(256)
    );
    
    CREATE TABLE IF NOT EXISTS oauth_client_token (
      token_id VARCHAR(256),
      token BLOB,
      authentication_id VARCHAR(256) PRIMARY KEY,
      user_name VARCHAR(256),
      client_id VARCHAR(256)
    );
    
    CREATE TABLE IF NOT EXISTS oauth_access_token (
      token_id VARCHAR(256),
      token BLOB,
      authentication_id VARCHAR(256),
      user_name VARCHAR(256),
      client_id VARCHAR(256),
      authentication BLOB,
      refresh_token VARCHAR(256)
    );
    
    CREATE TABLE IF NOT EXISTS oauth_refresh_token (
      token_id VARCHAR(256),
      token BLOB,
      authentication BLOB
    );
    
    CREATE TABLE IF NOT EXISTS oauth_code (
      code VARCHAR(256), authentication BLOB
    );

使用下面这句：

INSERT INTO oauth_client_details (client_id, client_secret, scope, authorized_grant_types, authorities, access_token_validity)
      VALUES ('clientId', '{bcrypt}$2a$10$vCXMWCn7fDZWOcLnIEhmK.74dvK1Eh8ae2WrWlhr2ETPLoxQctN4.', 'read,write', 'password,refresh_token,client_credentials', 'ROLE_CLIENT', 300);

> 特别要注意：这里是下发clientId和secret，值分别为clientId和secret（这两个值后面要用到）

这里的`client_secret列值，由`[bcrypt][]生成

而`{bcrypt}前缀写法，这是`Spring Security 5 [DelegatingPasswordEncoder][]的新用法

> access\_token\_validity列：表示token有效时间，单位秒，即300秒有效

同时，以下是User和Authority表（被org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl使用到）

CREATE TABLE IF NOT EXISTS users (
      id INT AUTO_INCREMENT PRIMARY KEY,
      username VARCHAR(256) NOT NULL,
      password VARCHAR(256) NOT NULL,
      enabled TINYINT(1),
      UNIQUE KEY unique_username(username)
    );
    
    CREATE TABLE IF NOT EXISTS authorities (
      username VARCHAR(256) NOT NULL,
      authority VARCHAR(256) NOT NULL,
      PRIMARY KEY(username, authority)
    );

--------------------

同样，使用下面的sql，初始化user和authority

INSERT INTO users (id, username, password, enabled) VALUES (1, 'user', '{bcrypt}$2a$10$cyf5NfobcruKQ8XGjUJkEegr9ZWFqaea6vjpXWEaSqTa2xL9wjgQC', 1);
    INSERT INTO authorities (username, authority) VALUES ('user', 'ROLE_USER');

> 注意：用户名是user，password的值是：pass，后面会用到

Spring Security Configuration 部分

**4. WebSecurityConfiguration.java文件**

package com.md.demo.oauth.opaque.config;
    
    import org.springframework.context.annotation.Bean;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.WebSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl;
    import org.springframework.security.crypto.factory.PasswordEncoderFactories;
    import org.springframework.security.crypto.password.PasswordEncoder;
    
    import javax.sql.DataSource;
    
    @EnableWebSecurity
    public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    	private final DataSource dataSource;
    
    	private PasswordEncoder passwordEncoder;
    	private UserDetailsService userDetailsService;
    
    	public WebSecurityConfiguration(final DataSource dataSource) {
    		this.dataSource = dataSource;
    	}
    
    	// 排除路径验证
    	@Override
    	public void configure(WebSecurity web) throws Exception {
    		web.ignoring().antMatchers("/hello");
    	}
    
    	@Override
    	protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
    		auth.userDetailsService(userDetailsService()).passwordEncoder(passwordEncoder());
    	}
    
    	@Bean
    	@Override
    	public AuthenticationManager authenticationManagerBean() throws Exception {
    		return super.authenticationManagerBean();
    	}
    
    	@Bean
    	public PasswordEncoder passwordEncoder() {
    		if (passwordEncoder == null) {
    			passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
    		}
    		return passwordEncoder;
    	}
    
    	@Bean
    	@Override
    	public UserDetailsService userDetailsService() {
    		if (userDetailsService == null) {
    			userDetailsService = new JdbcDaoImpl();
    			((JdbcDaoImpl) userDetailsService).setDataSource(dataSource);
    		}
    		return userDetailsService;
    	}
    
    }

> 一起使用@EnableWebSecurity注解和WebSecurityConfigurerAdapter，可以提供web基础安全机制

**5. 附加说明**

如果你使用了springboot DataSource数据源对象，它会自动装配，你不需要再自定义，只需要注入即可。它需要注入到由Spring Security提供的UserDetailsService中，结合使用JdbcDaoImpl。如果需要，你也能替换它去自定义实现。

**6. 验证服务配置**

验证服务验证客户端和用户凭证，同时生成token

package com.md.demo.oauth.opaque.config;
    
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
    import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
    import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
    import org.springframework.security.oauth2.provider.ClientDetailsService;
    import org.springframework.security.oauth2.provider.token.DefaultTokenServices;
    import org.springframework.security.oauth2.provider.token.TokenStore;
    import org.springframework.security.oauth2.provider.token.store.JdbcTokenStore;
    
    import javax.sql.DataSource;
    
    @Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
    
        private final DataSource dataSource;
        private final PasswordEncoder passwordEncoder;
        private final AuthenticationManager authenticationManager;
    
        private TokenStore tokenStore;
    
        public AuthorizationServerConfiguration(final DataSource dataSource, final PasswordEncoder passwordEncoder,
                                                final AuthenticationManager authenticationManager) {
            this.dataSource = dataSource;
            this.passwordEncoder = passwordEncoder;
            this.authenticationManager = authenticationManager;
        }
    
        @Bean
        public TokenStore tokenStore() {
            if (tokenStore == null) {
                tokenStore = new JdbcTokenStore(dataSource);
            }
            return tokenStore;
        }
    
        @Bean
        public DefaultTokenServices tokenServices(final ClientDetailsService clientDetailsService) {
            DefaultTokenServices tokenServices = new DefaultTokenServices();
            tokenServices.setSupportRefreshToken(true);
            tokenServices.setTokenStore(tokenStore());
            tokenServices.setClientDetailsService(clientDetailsService);
            tokenServices.setAuthenticationManager(authenticationManager);
            return tokenServices;
        }
    
        @Override
        public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
            clients.jdbc(dataSource);
        }
    
        @Override
        public void configure(final AuthorizationServerEndpointsConfigurer endpoints) {
            endpoints.authenticationManager(authenticationManager)
                    .tokenStore(tokenStore());
        }
    
        @Override
        public void configure(final AuthorizationServerSecurityConfigurer oauthServer) {
            oauthServer.passwordEncoder(passwordEncoder)
                    .tokenKeyAccess("permitAll()")
                    .checkTokenAccess("isAuthenticated()");
        }
    
    }

**7. 测试接口访问**

package com.md.demo.oauth.rest;
    
    import org.springframework.http.ResponseEntity;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import java.security.Principal;
    
    @RestController
    @RequestMapping("/profile")
    public class ProfileController {
    
        //http://localhost:9001/profile/me?access_token=xxxxxx
        @GetMapping("/me")
        public ResponseEntity<Principal> get(final Principal principal) {
            return ResponseEntity.ok(principal);
        }
    
        /*
    	 * 通过以下接口Post请求获得access_token：
    	 * http://localhost:9001/oauth/token?grant_type=password&username=user&password=pass
    	 * 
    	 * 注意：Authorization中使用BasicAuth，Username和Password分别为：clientId，secret
    	 */
    }

> 资源服务 Resource Server

**1. 项目目录结构**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 2][]

**2. pom.xml依赖组件**

<dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>net.sf.json-lib</groupId>
        <artifactId>json-lib-ext-spring</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security.oauth.boot</groupId>
        <artifactId>spring-security-oauth2-autoconfigure</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-configuration-processor</artifactId>
        <optional>true</optional>
    </dependency>
    <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
    </dependency>

**3. 接口访问（受保护）**

package com.md.demo.oauth.rest;
    
    import org.springframework.http.ResponseEntity;
    import org.springframework.security.access.prepost.PreAuthorize;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import java.security.Principal;
    
    @RestController
    @RequestMapping("/me")
    public class UserController {
    
        //http://localhost:9101/me?access_token=xxxxxx
        @GetMapping
        @PreAuthorize("hasRole('ROLE_USER')")
        public ResponseEntity<Principal> get(final Principal principal) {
            return ResponseEntity.ok(principal);
        }
    
        /*
    	 * 通过以下接口Post请求获得access_token：
    	 * http://localhost:9001/oauth/token?grant_type=password&username=user&password=pass
    	 * 
    	 * 注意：Authorization中使用BasicAuth，Username和Password分别为：clientId，secret
    	 */
    }

@PreAuthorize注解验证用户的权限去是否执行代码，同时需要启用prePost注解

**4. Web安全配置**

package com.md.demo.oauth.opaque.ds.config;
    
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class WebSecurityConfiguration {
    
    }

prePostEnabled默认是false，使@PreAuthorize生效，则设为true

**5. 资源服务配置**

package com.md.demo.oauth.opaque.ds.config;
    
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
    import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
    
    @Configuration
    @EnableResourceServer
    public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
    
    	private static final String ROOT_PATTERN = "/**";
    
    	@Override
    	public void configure(HttpSecurity http) throws Exception {
    		http.authorizeRequests()
    				// 排除路径验证
    				.antMatchers("/hello")
    					.permitAll()
    				.antMatchers(ROOT_PATTERN)
    					.authenticated();
    	}
    }

**6. application.yml配置**

server:
      port: 9101
    
    # 设置url，把token转换成authentication对象
    security:
      oauth2:
        resource:
          user-info-uri: http://localhost:9001/profile/me
    
    spring:
      jackson:
        serialization:
          INDENT_OUTPUT: true

# 测试访问 #

1. 访问受保护接口：[http://localhost:9101/me][http_localhost_9101_me]，默认失败

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 3][]

2. 获得token接口：[http://localhost:9001/oauth/token?grant\_type=password&username=user&password=pass][http_localhost_9001_oauth_token_grant_type_password_username_user_password_pass]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 4][]

3. 再访问受保护接口：[http://localhost:9101/me?access\_token=8df31c53-e616-47d1-802e-9b00adf64266][http_localhost_9101_me_access_token_8df31c53-e616-47d1-802e-9b00adf64266]，即可访问成功

[![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 5][]][http_localhost_9101_me]

# 完整源码下载 #

我的[Github源码仓库地址：][Github]

*   OAuth2 Server端对应的[Github源码地址][Github 1]
 *   OAuth2 Resource端对应的[Github源码地址][Github 2]

# 下一章教程 #

[SpringBoot从入门到精通教程（二十三）- Oauth2+JWT集成/SpringSecurity][SpringBoot_- Oauth2_JWT_SpringSecurity]

# 该系列教程 #

[SpringBoot从入门到精通教程][SpringBoot]

至此，全部介绍就结束了

\------------------------------------------------------

[关于我][Link 1]（个人域名）

[我的开源项目集Github][Github 3]

期望和大家***一起学习，一起成长***，共勉，O(∩\_∩)O谢谢

欢迎交流问题，可加个人QQ 469580884，

或者，加我的群号 **751925591**，一起探讨交流问题

不讲虚的，只做实干家

Talk is cheap，show me the code

![20180411181545874][]

[Oauth2]: https://www.oauth.com/
[Grant Type]: https://oauth.net/2/grant-types/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70]: /images/20211203/703bd5ff808647e2b40015580d51e752.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 1]: /images/20211203/d6e6ef38ac134316ba80c5d5e9ef7c4f.png
[bcrypt]: https://en.wikipedia.org/wiki/Bcrypt
[DelegatingPasswordEncoder]: https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#pe-dpe
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 2]: /images/20211203/d26c03d80e5d447ebbb6a96829db8bde.png
[http_localhost_9101_me]: http://localhost:9101/me
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 3]: /images/20211203/a1404afa73bf4477a2ccf341c75b3916.png
[http_localhost_9001_oauth_token_grant_type_password_username_user_password_pass]: http://localhost:9001/oauth/token?grant_type=password&username=user&password=pass
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 4]: /images/20211203/01a0be44c14641b6a4b3ad43a2bee7b8.png
[http_localhost_9101_me_access_token_8df31c53-e616-47d1-802e-9b00adf64266]: http://localhost:9101/me?access_token=8df31c53-e616-47d1-802e-9b00adf64266
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9oZW1pbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 5]: /images/20211203/74a141ff36424d3685af1df2eb2c9557.png
[Github]: https://github.com/hemin1003/spring-boot-study/tree/master/spring-boot2-study/spring-boot2-parent
[Github 1]: https://github.com/hemin1003/spring-boot-study/tree/master/spring-boot2-study/spring-boot2-parent/spring-boot2-oauth2-opaque-server
[Github 2]: https://github.com/hemin1003/spring-boot-study/tree/master/spring-boot2-study/spring-boot2-parent/spring-boot2-oauth2-opaque-resource
[SpringBoot_- Oauth2_JWT_SpringSecurity]: https://blog.csdn.net/hemin1003/article/details/96483461
[SpringBoot]: https://hemin.blog.csdn.net/column/info/40170
[Link 1]: http://heminit.com/about/
[Github 3]: https://github.com/hemin1003
[20180411181545874]: /images/20211203/206ff15b32a74af384d1fd79dd9e5a58.png