springOAuth2教程（基于JDBC）

左手的ㄟ右手 2022-03-08 16:14 236阅读 0赞

前面的文章有提到过springOAuth2基于最基本的内存进行存储的教程，但是总是存在内存中肯定不是很高可用的，所以今天来给大家讲解下基于关系型数据库储存的教程。  
OK，基础的就不多说，详细的可以查看前面的文章，传送门在这里  
[https://mp.csdn.net/postedit/88553568][https_mp.csdn.net_postedit_88553568]  
先说自己的选型，数据库用的是mysql，持久层框架用的是hibernate。  
话不多说，直接上代码，首先是oauth-server（鉴权服务）。  
**OAuthSecurityConfig**

@EnableResourceServer
    @EnableAuthorizationServer
    public class OAuthSecurityConfig extends AuthorizationServerConfigurerAdapter {
        @Autowired
        @Qualifier("authenticationManagerBean")
        AuthenticationManager authenticationManager;
    
        @Autowired
        private DataSource dataSource;
    
        @Autowired
        private TokenStore tokenStore;
    
    
        @Autowired
        private ClientDetailsService clientDetailsService;
    
        @Autowired
        private TokenEndpoint tokenEndpoint;
    
    
        static final Logger logger = LoggerFactory.getLogger(OAuthSecurityConfig.class);
    
        @Bean
        public TokenStore tokenStore() {
            return new JwtTokenStore(jwtAccessTokenConverter());
        }
    
        /**
        * @Description: JWT 密钥非对称加密
        * @param:
        * @return:
        * @author: fanjc
        * @Date: 2019/3/12
        */
        @Bean
        public JwtAccessTokenConverter jwtAccessTokenConverter() {
            KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(new ClassPathResource("test-jwt.jks"), "test123".toCharArray());
            JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
            converter.setKeyPair(keyStoreKeyFactory.getKeyPair("test-jwt"));
            return converter;
        }
    
        @Bean // 声明 ClientDetails实现
        public ClientDetailsService clientDetailsService() {
            return new JdbcClientDetailsService(dataSource);
        }
    
    
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            String finalSecret = "++++++" + new BCryptPasswordEncoder().encode("123456");
            System.out.println(finalSecret);
            clients.withClientDetails(clientDetailsService);
    
        }
    
        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.tokenStore(tokenStore).tokenEnhancer(jwtAccessTokenConverter()).authenticationManager(authenticationManager);
    
            // 配置tokenServices参数
            DefaultTokenServices tokenServices = new DefaultTokenServices();
            tokenServices.setTokenStore(endpoints.getTokenStore());
            tokenServices.setSupportRefreshToken(true);
            tokenServices.setClientDetailsService(endpoints.getClientDetailsService());
            tokenServices.setTokenEnhancer(endpoints.getTokenEnhancer());
            tokenServices.setAccessTokenValiditySeconds((int)TimeUnit.DAYS.toSeconds(30)); // 30天
            endpoints.tokenServices(tokenServices);
        }
    
        @Override
        public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
            // 允许表单认证
            security.allowFormAuthenticationForClients()
                    .tokenKeyAccess("permitAll()")
                    .checkTokenAccess("isAuthenticated()")
                    .passwordEncoder(new BCryptPasswordEncoder());  // client_secret用BCrypt加密
        }
    
       /**
       * @Description: 获取token时接受get方式
       * @param:
       * @return:
       * @author: fanjc
       * @Date: 2019/3/12
       */
        @PostConstruct
        public void reconfigure() {
            Set<HttpMethod> allowedMethods =
                    new HashSet<>(Arrays.asList(HttpMethod.GET, HttpMethod.POST));
            tokenEndpoint.setAllowedRequestMethods(allowedMethods);
        }
    }

1.老套路，还是对AuthorizationServerConfigurerAdapter里面的方法进行重写，不同的是我们这里声明了clientDetailsService的实现，将它设置为JdbcClientDetailsService（基于JDBC实现），感兴趣的同学可以去源码里面看下，spring把我们把sql都写好了，可以直接拿来调用了。  
![在这里插入图片描述][20190315151128897.png]  
2.下面是非常关键的一点，当我们声明了自己的clientDetailsService后，一定要把他装配到ClientDetailsServiceConfigurer里面去，否则是没有效果的。  
![在这里插入图片描述][20190315151134839.png]  
3.然后我们在AuthorizationServerEndpointsConfigurer里面设置我们自定义的DefaultTokenServices

@Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.tokenStore(tokenStore).tokenEnhancer(jwtAccessTokenConverter()).authenticationManager(authenticationManager);
    
            // 配置tokenServices参数
            DefaultTokenServices tokenServices = new DefaultTokenServices();
            tokenServices.setTokenStore(endpoints.getTokenStore());
            tokenServices.setSupportRefreshToken(false);
            tokenServices.setClientDetailsService(endpoints.getClientDetailsService());
            tokenServices.setTokenEnhancer(endpoints.getTokenEnhancer());
            tokenServices.setAccessTokenValiditySeconds((int)TimeUnit.DAYS.toSeconds(30)); // 30天
            endpoints.tokenServices(tokenServices);
        }

关于DefaultTokenServices的定义我们可以来看下官方文档的解释  
![20190315151530244.png][]  
说的比较直白就是我们可以自己定义关于token的策略  
3.1  
SupportRefreshToken：是否支持刷新toke;  
ClientDetailsService:自定义ClientDetailsService；  
AccessTokenValiditySeconds;自定义失效时间；  
关于其他的设置大家可以去官方文档查看，这里就不多说了，传送门在这里  
[https://projects.spring.io/spring-security-oauth/docs/oauth2.html（springOAuth2）][https_projects.spring.io_spring-security-oauth_docs_oauth2.html_springOAuth2]  
[https://docs.spring.io/spring-security/site/docs/3.2.5.RELEASE/reference/htmlsingle/\#el-access][https_docs.spring.io_spring-security_site_docs_3.2.5.RELEASE_reference_htmlsingle_el-access] (spring security)  
4.最后我们在AuthorizationServerSecurityConfigurer里面用BCrypt加密的方式来读取等下我们储存在数据库里面的密码，毕竟采取明文密码肯定是一种不安全的方式。  
**OAuthWebConfig**

@Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class OAuthWebConfig extends WebSecurityConfigurerAdapter {
    
    
    
        @Bean
        public PasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }
    
    
        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
    
            return super.authenticationManagerBean();
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable();
            http.requestMatchers().anyRequest()
                    .and()
                    .authorizeRequests()
                    .antMatchers("/oauth/**").permitAll();
            http.formLogin();
        }
    
        @Autowired
        UserServiceDetail userServiceDetail;
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userServiceDetail).passwordEncoder(new BCryptPasswordEncoder());
        }
    
    }

OAuthWebConfig的变动基本上不多，大家看下就可以理解了。  
Ok,下面我们尝试下用客户端模式来访问下鉴权服务是否可以获取token，但是。。。emmm,似乎数据库表没有导，没有关系，我们导入官方的建表语句就好了（sql放在根目录下面，其中user和rol并非官方sql，而是自建方便用来操作权限的。）

create table oauth_client_details (
      client_id VARCHAR(128) PRIMARY KEY,
      resource_ids VARCHAR(128),
      client_secret VARCHAR(128),
      scope VARCHAR(128),
      authorized_grant_types VARCHAR(128),
      web_server_redirect_uri VARCHAR(128),
      authorities VARCHAR(128),
      access_token_validity INTEGER,
      refresh_token_validity INTEGER,
      additional_information VARCHAR(4096),
      autoapprove VARCHAR(128)
    );
    
    create table oauth_client_token (
      token_id VARCHAR(128),
      token BLOB,
      authentication_id VARCHAR(128) PRIMARY KEY,
      user_name VARCHAR(128),
      client_id VARCHAR(128)
    );
    
    create table oauth_access_token (
      token_id VARCHAR(128),
      token BLOB,
      authentication_id VARCHAR(128) PRIMARY KEY,
      user_name VARCHAR(128),
      client_id VARCHAR(128),
      authentication BLOB,
      refresh_token VARCHAR(128)
    );
    
    create table oauth_refresh_token (
      token_id VARCHAR(128),
      token BLOB,
      authentication BLOB
    );
    
    create table oauth_code (
      code VARCHAR(128), authentication BLOB
    );
    
    create table oauth_approvals (
    	userId VARCHAR(128),
    	clientId VARCHAR(128),
    	scope VARCHAR(128),
    	status VARCHAR(10),
    	expiresAt TIMESTAMP,
    	lastModifiedAt TIMESTAMP
    );
    
    
    -- customized oauth_client_details table
    create table ClientDetails (
      appId VARCHAR(128) PRIMARY KEY,
      resourceIds VARCHAR(128),
      appSecret VARCHAR(128),
      scope VARCHAR(128),
      grantTypes VARCHAR(128),
      redirectUrl VARCHAR(128),
      authorities VARCHAR(128),
      access_token_validity INTEGER,
      refresh_token_validity INTEGER,
      additionalInformation VARCHAR(4096),
      autoApproveScopes VARCHAR(128)
    );

好的，那么导入后我们来查看数据库

![在这里插入图片描述][2019031515265450.png]  
库表搞定了，大家如果有库表1结构不了解的话，给大家一篇大佬解释的文章传送门  
[https://blog.csdn.net/u011676300/article/details/84390988][https_blog.csdn.net_u011676300_article_details_84390988]  
建好了库表之我们肯定是先要插入客户端信息了  
![20190315152852445.png][]  
我在这里直接插入了几条，方便我们后期测试。  
这里的client\_secret我们是用BCrypt加密的，上面我们有提到过了，如果是采用springboot2.0的同学的话可以直接使用PasswordEncoderFactories.createDelegatingPasswordEncoder()方法，spring帮我们封装好了多种的加密方式，非常方便。  
好，那么我们把项目跑起来来测试一下。  
![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNjI0MzYx_size_16_color_FFFFFF_t_70][]  
binggo,获得token啦，那么我们下面来进行资源服务的配置。  
**resource-server**  
**ResourceServerConfiguration**

@Configuration
    @EnableResourceServer
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
    
    
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.csrf().disable()
                    .authorizeRequests()
                    .antMatchers("/registry/**").permitAll()
                    .antMatchers("/**").authenticated();
        }
    
        @Override
        public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        }
    }

**JwtConfig**

@Configuration
    public class JwtConfig {
    
        public static final String public_cert = "public.cert";
    
        @Autowired
        private JwtAccessTokenConverter jwtAccessTokenConverter;
    
        @Bean
        @Qualifier("tokenStore")
        public TokenStore tokenStore() {
            return new JwtTokenStore(jwtAccessTokenConverter);
        }
    
        @Bean
        protected JwtAccessTokenConverter jwtAccessTokenConverter() {
            JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
            Resource resource =  new ClassPathResource(public_cert);
    
            String publicKey;
            try {
                publicKey = new String(FileCopyUtils.copyToByteArray(resource.getInputStream()));
            }catch (IOException e) {
                throw new RuntimeException(e);
            }
    
            converter.setVerifierKey(publicKey);
            return converter;
        }
    }

然后我们自己写一个方法来插入user的数据  
1.首先是user实体类

@Entity
    public class User implements UserDetails, Serializable {
    
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Long id;
    
        @Column(nullable = false, unique = true)
        private String username;
    
        @Column
        private String password;
    
        @ManyToMany(cascade = CascadeType.ALL, fetch = FetchType.EAGER)
        @JoinTable(name = "user_role", joinColumns = @JoinColumn(name = "user_id", referencedColumnName = "id"))
        private List<Role> authorities;
    
        public Long getId() {
            return id;
        }
    
        public void setId(Long id) {
            this.id = id;
        }
    
        public void setUsername(String username) {
            this.username = username;
        }
    
        public void setPassword(String password) {
            this.password = password;
        }
    
        public void setAuthorities(List<Role> authorities) {
            this.authorities = authorities;
        }
    
    
    
        @Override
        public Collection<? extends GrantedAuthority> getAuthorities() {
            return authorities;
        }
    
        @Override
        public String getPassword() {
            return password;
        }
    
        @Override
        public String getUsername() {
            return username;
        }
    
        @Override
        public boolean isAccountNonExpired() {
            return true;
        }
    
        @Override
        public boolean isAccountNonLocked() {
            return true;
        }
    
        @Override
        public boolean isCredentialsNonExpired() {
            return true;
        }
    
        @Override
        public boolean isEnabled() {
            return true;
        }
    }

2.然后是接口类UserService

public interface UserService {
        public User create(String username, String password);
    }

3，再是接口实现类UserServiceImpl

@Service
    public class UserServiceImpl implements UserService {
    
        private static final BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
    
        @Autowired
        private UserDao userDao;
    
        @Override
        public User create(String username, String password) {
            User user = new User();
            user.setUsername(username);
            password =passwordEncoder.encode(password);
            user.setPassword(password);
            User u = userDao.save(user);
            return u;
        }
    }

这里的密码也是禁止明文的，还是用BCrypt来进行加密。  
4.最后是控制层

@RestController
    public class TestController {
    
        Logger logger = LoggerFactory.getLogger(TestController.class);
    
        @Autowired
        private UserService userService;
        
        
        /** 
        * @Description: 输出认证信息
        * @param: 
        * @return: 
        * @author: fanjc
        * @Date: 2019/3/15 
        */ 
        @GetMapping("/getPrinciple")
        public OAuth2Authentication getPrinciple(OAuth2Authentication oAuth2Authentication, Principal principal, Authentication authentication) {
            logger.info(oAuth2Authentication.getUserAuthentication().getAuthorities().toString());
            logger.info(oAuth2Authentication.toString());
            logger.info("principal.toString() " + principal.toString());
            logger.info("principal.getName() " + principal.getName());
            logger.info("authentication: " + authentication.getAuthorities().toString());
    
            return oAuth2Authentication;
        }
    
        /** 
        * @Description: 手动注册用户
        * @param: 
        * @return: 
        * @author: fanjc
        * @Date: 2019/3/15 
        */ 
        @RequestMapping(value = "/registry", method = RequestMethod.POST)
        public User createUser(@RequestParam("username") String username, @RequestParam("password") String password) {
            if (StringUtils.isNotEmpty(username) && StringUtils.isNotEmpty(password)) {
                return userService.create(username, password);
            }
    
            return null;
        }
    
    
    }

OK，搞定之后我们来启动项目，别忘了在yml文件里面配置鉴权服务验证token的地址啦

eureka:
      client:
        service-url:
          defaultZone: http://localhost:8881/eureka/
    server:
      port: 8883
    spring:
      application:
        name: resource-server
      datasource:
          driver-class-name: com.mysql.jdbc.Driver
          url: jdbc:mysql://121.42.238.128/oauth2?useUnicode=true&characterEncoding=utf8&characterSetResults=utf8
          username: hotel
          password: internet
    
      jpa:
        hibernate:
          ddl-auto: update
        show-sql: true
    security:
      oauth2:
        resource:
          jwt:
            key-uri: http://localhost:8882/oauth/token_key

![20190315153932940.png][]  
然后我们可插入我们的用户信息了，拿到用户信息后呢，我们用密码模式来测试下是否可以访问资源服务了。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNjI0MzYx_size_16_color_FFFFFF_t_70 1]  
完美，我们拿到了token  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNjI0MzYx_size_16_color_FFFFFF_t_70 2]  
访问资源服务成功了。  
git源码地址  
[https://github.com/fjc440/spring-oauth2-demo/tree/feature-JWTJDBC][https_github.com_fjc440_spring-oauth2-demo_tree_feature-JWTJDBC]  
（JWTJDBC分支）

[https_mp.csdn.net_postedit_88553568]: https://mp.csdn.net/postedit/88553568
[20190315151128897.png]: /images/20220308/955f2a1b54024d56a0ef58facfd52e30.png
[20190315151134839.png]: /images/20220308/9dea84b101b642298bfa308dbd27b2c3.png
[20190315151530244.png]: /images/20220308/ad3e0de1053c4d5c8573745509f335ca.png
[https_projects.spring.io_spring-security-oauth_docs_oauth2.html_springOAuth2]: https://projects.spring.io/spring-security-oauth/docs/oauth2.html%EF%BC%88springOAuth2%EF%BC%89
[https_docs.spring.io_spring-security_site_docs_3.2.5.RELEASE_reference_htmlsingle_el-access]: https://docs.spring.io/spring-security/site/docs/3.2.5.RELEASE/reference/htmlsingle/#el-access
[2019031515265450.png]: /images/20220308/77208d0d2e6847099ce7e6ccba866269.png
[https_blog.csdn.net_u011676300_article_details_84390988]: https://blog.csdn.net/u011676300/article/details/84390988
[20190315152852445.png]: /images/20220308/36a17a1cff724eac94c94e240eb316c7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNjI0MzYx_size_16_color_FFFFFF_t_70]: /images/20220308/93f31cca8dcc4c64a60e317357aba422.png
[20190315153932940.png]: /images/20220308/75cfda6727e34a0390466f4d771b11e8.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNjI0MzYx_size_16_color_FFFFFF_t_70 1]: /images/20220308/a0654b8abd90403d9c83f77d6cc4e73d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNjI0MzYx_size_16_color_FFFFFF_t_70 2]: /images/20220308/9997fcf294a6442d9debc197aac1d906.png
[https_github.com_fjc440_spring-oauth2-demo_tree_feature-JWTJDBC]: https://github.com/fjc440/spring-oauth2-demo/tree/feature-JWTJDBC