OAuth2.0系列五：OAuth2.0客户端凭证

- 日理万妓 2024-04-18 21:01 31阅读 0赞

## 凭证模式 ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dZQTE5OTM_size_16_color_FFFFFF_t_70][]

客户端通过客户端的id和secret申请授权，这种方式给出的令牌，是针对第三方应用的，而不是针对用户的，即有可能多个用户共享同一个令牌。

## 代码实战 ##

**第一步**，创建maven应用client\_server，pom文件如下：

<parent>
            <artifactId>microservice-parent</artifactId>
            <groupId>com.curise.microservice</groupId>
            <version>1.0-SNAPSHOT</version>
        </parent>
        <modelVersion>4.0.0</modelVersion>
    
        <artifactId>client_server</artifactId>
        <description>OAuth2.0客户端凭证模式</description>
    
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework.security.oauth</groupId>
                <artifactId>spring-security-oauth2</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
            </dependency>
    
        </dependencies>

**第二步**，创建授权管理器

@Configuration
    @EnableAuthorizationServer
    public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdapter {
    
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                    // 客户端id
                    .withClient("app")
                    // 客户端密钥
                    .secret("123")
                    // 权限
                    .scopes("read","write")
                    // 获取授权码后重定向地址
                    .redirectUris("http://localhost:9000/callback")
                    // 授权码和刷新token
                    .authorizedGrantTypes("authorization_code","refresh_token")
                    .and()
                    .withClient("app1")
                    .secret("1234")
                    .scopes("read", "write")
                    // 密码模式和刷新token
                    .authorizedGrantTypes("password", "refresh_token")
                    .and()
                    .withClient("app2")
                    .secret("1234")
                    .scopes("read", "write")
                    .redirectUris("http://localhost:9000/callback")
                    // 令牌有效时间120s
                    .accessTokenValiditySeconds(120)
                    // 简化模式
                    .authorizedGrantTypes("implicit")
                    .and()
                    .withClient("app3")
                    .secret("1234")
                    .scopes("read", "write")
                    // 客户端凭证模式
                    .authorizedGrantTypes("client_credentials");
        }
    }

**第三步**，创建资源管理器

@Configuration
    @EnableResourceServer
    public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter {
        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                    .anyRequest()
                    .authenticated()
                    .and()
                    .requestMatchers()
                    // /api/**请求需要OAuth鉴权
                    .antMatchers("/api/**");
        }
    }

**第四步**，创建配置文件

server.port=8080
    security.user.name=root
    security.user.password=root

**第五步**，创建Controller输出资源

@RestController
    public class UserController {
    
        @GetMapping("/api/userList")
        public ResponseEntity<List<UserInfo>> getUserInfo(){
            List<UserInfo> users = new ArrayList<>();
            users.add(new UserInfo("test1", "test1@qq.com"));
            users.add(new UserInfo("test2", "test2@qq.com"));
            return ResponseEntity.ok(users);
        }
    
    }

**第六步**，启动应用

**第七步**，申请令牌

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dZQTE5OTM_size_16_color_FFFFFF_t_70 1][]

设置grant\_type=client\_credentials表示通过客户端凭证方式授权，直接返回令牌

**第八步**，获取用户信息

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dZQTE5OTM_size_16_color_FFFFFF_t_70 2][]

因为这种方式授权不是针对一个用户的，而是针对第三方机构的，所以这里没有向前三种方式一样直接获取用户信息。

代码已经共享到GitHub，地址：[https://github.com/WYA1993/microservice][https_github.com_WYA1993_microservice]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dZQTE5OTM_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/e7e496b2b75d422ba902de474bb3ac5f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dZQTE5OTM_size_16_color_FFFFFF_t_70 1]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/a17f6cfddaa0465f942f53d6c6b8f6ee.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1dZQTE5OTM_size_16_color_FFFFFF_t_70 2]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/4b470d2ab36a4aea8dbd9f4a38ffc29e.png
[https_github.com_WYA1993_microservice]: https://github.com/WYA1993/microservice