基于Spring Security 5 的 Authorization Server的写法

先看演示

pom.xml

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-parent</artifactId>

        <version>2.6.5</version>

        <relativePath/> <!-- lookup parent from repository -->

    </parent>

    <groupId>com.cjs.example.oauth2</groupId>

    <artifactId>cjs-authorization-server</artifactId>

    <version>0.0.1-SNAPSHOT</version>

    <name>cjs-authorization-server</name>

    <properties>

        <java.version>1.8</java.version>

        <docker.image.prefix>cjssso</docker.image.prefix>

    </properties>

    <dependencies>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-web</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-security</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.security</groupId>

            <artifactId>spring-security-oauth2-authorization-server</artifactId>

            <version>0.2.3</version>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-thymeleaf</artifactId>

        </dependency>

        <dependency>

            <groupId>org.thymeleaf.extras</groupId>

            <artifactId>thymeleaf-extras-springsecurity5</artifactId>

        </dependency>

        <!-- https://www.webjars.org/documentation#springboot -->

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>webjars-locator-core</artifactId>

            <version>0.50</version>

        </dependency>

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>bootstrap</artifactId>

            <version>5.1.3</version>

        </dependency>

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>jquery</artifactId>

            <version>3.6.0</version>

        </dependency>

        <dependency>

            <groupId>org.projectlombok</groupId>

            <artifactId>lombok</artifactId>

            <optional>true</optional>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-test</artifactId>

            <scope>test</scope>

        </dependency>

        <dependency>

            <groupId>org.springframework.security</groupId>

            <artifactId>spring-security-test</artifactId>

            <scope>test</scope>

        </dependency>

    </dependencies>

    <build>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

                <configuration>

                    <excludes>

                        <exclude>

                            <groupId>org.projectlombok</groupId>

                            <artifactId>lombok</artifactId>

                        </exclude>

                    </excludes>

                </configuration>

            </plugin>

            <!-- https://github.com/spotify/docker-maven-plugin -->

            <plugin>

                <groupId>com.spotify</groupId>

                <artifactId>docker-maven-plugin</artifactId>

                <version>1.2.2</version>

                <configuration>

                    <imageName>${docker.image.prefix}/${project.artifactId}</imageName>

                    <dockerDirectory>src/main/docker</dockerDirectory>

                    <resources>

                        <resource>

                            <targetPath>/</targetPath>

                            <directory>${project.build.directory}</directory>

                            <include>${project.build.finalName}.jar</include>

                        </resource>

                    </resources>

                </configuration>

            </plugin>

        </plugins>

    </build>

</project>

application.yml



server:

  port: 9000

#  servlet:

#    context-path: /uaa

logging:

  level:

    root: debug

Security配置



package com.cjs.example.oauth2.config;

import com.nimbusds.jose.jwk.JWKSet;

import com.nimbusds.jose.jwk.RSAKey;

import com.nimbusds.jose.jwk.source.ImmutableJWKSet;

import com.nimbusds.jose.jwk.source.JWKSource;

import com.nimbusds.jose.proc.SecurityContext;

import org.springframework.beans.factory.config.BeanDefinition;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.context.annotation.Role;

import org.springframework.core.annotation.Order;

import org.springframework.security.config.Customizer;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;

import org.springframework.security.core.userdetails.User;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

import org.springframework.security.oauth2.core.AuthorizationGrantType;

import org.springframework.security.oauth2.core.ClientAuthenticationMethod;

import org.springframework.security.oauth2.core.oidc.OidcScopes;

import org.springframework.security.oauth2.jwt.JwtDecoder;

import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;

import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;

import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;

import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;

import org.springframework.security.oauth2.server.authorization.config.ClientSettings;

import org.springframework.security.oauth2.server.authorization.config.ProviderSettings;

import org.springframework.security.provisioning.InMemoryUserDetailsManager;

import org.springframework.security.web.SecurityFilterChain;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.interfaces.RSAPrivateKey;

import java.security.interfaces.RSAPublicKey;

import java.util.UUID;

/**

 * @Author ChengJianSheng

 * @Date 2022/3/29

 */

@Configuration

public class OAuth2AuthorizationServerSecurityConfiguration {

    @Bean

    @Order(1)

    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {

        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);

        return http.formLogin(Customizer.withDefaults()).build();

    }

    @Bean

    @Order(2)

    public SecurityFilterChain standardSecurityFilterChain(HttpSecurity http) throws Exception {

        http.authorizeHttpRequests((authorize) -> authorize

                .antMatchers("/webjars/**", "/login", "/login-error").permitAll()

                .anyRequest().authenticated())

                .formLogin().loginPage("/login").failureUrl("/login-error");

        return http.build();

    }

    @Bean

    public RegisteredClientRepository registeredClientRepository() {

        RegisteredClient client1 = RegisteredClient.withId(UUID.randomUUID().toString())

                .clientId("client-1")

                .clientSecret("$2a$10$zNvOs9Ex0cD794OyWwDIXutF7F4hHYjLuEwI.U30p3nNIyumfON42")

                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)

                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)

                .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)

                .redirectUri("http://127.0.0.1:8081/message/login/oauth2/code/mycustom")

                .redirectUri("http://127.0.0.1:8081/message/authorized")

                .clientSettings(ClientSettings.builder().requireAuthorizationConsent(false).build())

                .build();

        RegisteredClient client2 = RegisteredClient.withId(UUID.randomUUID().toString())

                .clientId("client-2")

                .clientSecret("$2a$10$csxC.p5gNQbnpv8Mt5dqPevS66QL2USHERtQ8hEA1TWETIk1Zo3SS")

                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)

                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)

                .redirectUri("http://www.baidu.com")

                .scope("message:read")

                .build();

        return new InMemoryRegisteredClientRepository(client1, client2);

    }

    @Bean

    public JWKSource jwkSource(KeyPair keyPair) {

        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();

        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();

        RSAKey rsaKey = new RSAKey.Builder(publicKey)

                .privateKey(privateKey)

                .keyID(UUID.randomUUID().toString())

                .build();

        JWKSet jwkSet = new JWKSet(rsaKey);

        return new ImmutableJWKSet<>(jwkSet);

    }

    @Bean

    public JwtDecoder jwtDecoder(KeyPair keyPair) {

        return NimbusJwtDecoder.withPublicKey((RSAPublicKey) keyPair.getPublic()).build();

    }

    @Bean

    public ProviderSettings providerSettings() {

        return ProviderSettings.builder().issuer("http://localhost:9000").build();

    }

    @Bean

    public UserDetailsService userDetailsService() {

        UserDetails userDetails = User.withUsername("zhangsan")

                .password("$2a$10$5nlwTDZ9LNbz7UMKcseY3u6YqbkGrMe2tQirfrwrCJAKrDAM78bUa")

                .roles("USER")

                .build();

        return new InMemoryUserDetailsManager(userDetails);

    }

    public static void main(String[] args) {

        System.out.println(new BCryptPasswordEncoder().encode("123456"));

    }

    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

    @Bean

    @Role(BeanDefinition.ROLE_INFRASTRUCTURE)

    KeyPair generateRsaKey() {

        KeyPair keyPair;

        try {

            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");

            keyPairGenerator.initialize(2048);

            keyPair = keyPairGenerator.generateKeyPair();

        } catch (Exception ex) {

            throw new IllegalStateException(ex);

        }

        return keyPair;

    }

}

自定义登录页面

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org">

<head>

    <title>Spring Security OAuth 2.0 Sample</title>

    <meta charset="utf-8" />

    <meta http-equiv="X-UA-Compatible" content="IE=edge" />

    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

    <link rel="stylesheet" href="/webjars/bootstrap/css/bootstrap.css" th:href="@{/webjars/bootstrap/css/bootstrap.css}" />

</head>

<body>

<div class="container">

    <h1>Login</h1>

    <p th:if="${loginError}" style="font-weight:bold;color:red;">Wrong username or password</p>

    <form th:action="@{/login}" method="post">

        <div class="form-row">

            <div class="form-group">

                <label for="username">Username</label>

                <input type="text" id="username" name="username" placeholder="请输入用户名" autofocus="autofocus" class="form-control">

                <small class="form-text text-muted">user1 / password</small>

            </div>

        </div>

        <div class="form-row">

            <div class="form-group">

                <label for="password">Password</label>

                <input type="password" id="password" name="password" placeholder="请输入密码" class="form-control">

            </div>

        </div>

        <div class="form-row">

            <div class="form-group">

                <label for="verificationCode">验证码</label>

                <input type="text" id="verificationCode" name="verificationCode" placeholder="请输入验证码" class="form-control">

            </div>

        </div>

        <button type="submit" class="btn btn-primary">登录</button>

    </form>

</div>

<script src="/webjars/jquery/jquery.min.js" th:src="@{/webjars/jquery/jquery.min.js}"></script>

<script src="/webjars/bootstrap/js/bootstrap.min.js" th:src="@{/webjars/bootstrap/js/bootstrap.min.js}"></script>

</body>

</html>

默认的Controller



package com.cjs.example.oauth2.controller;

import org.springframework.stereotype.Controller;

import org.springframework.ui.Model;

import org.springframework.web.bind.annotation.GetMapping;

/**

 * @Author ChengJianSheng

 * @Date 2022/4/2

 */

@Controller

public class DefaultController {

	@GetMapping("/")

	public String root() {

		return "redirect:/index";

	}

	@GetMapping("/index")

	public String index() {

		return "index";

	}

	@GetMapping("/login")

	public String login() {

		return "login";

	}

	@GetMapping("/login-error")

	public String loginError(Model model) {

		model.addAttribute("loginError", true);

		return login();

	}

}

获取token



GET http://localhost:9000/oauth2/authorize?response_type=code&client_id=client-2&redirect_uri=http://www.baidu.com

POST /oauth2/token HTTP/1.1

Host: localhost:9000

Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=xxx&redirect_uri=http://www.baidu.com

抓包

项目结构

参考

https://github.com/jgrandja/spring-security-oauth-5-2-migrate/tree/main/client-app

OAuth2 Authorization Server的更多相关文章

  1. Spring Cloud(6.1)：搭建OAuth2 Authorization Server

    配置web.xml 添加spring-cloud-starter-security和spring-security-oauth2-autoconfigure两个依赖. </dependency& ...

  2. 使用Identity Server 4建立Authorization Server (6) - js(angular5) 客户端

    预备知识: http://www.cnblogs.com/cgzl/p/7746496.html 第一部分: http://www.cnblogs.com/cgzl/p/7780559.html 第二 ...

  3. 使用Identity Server 4建立Authorization Server (4)

    预备知识: http://www.cnblogs.com/cgzl/p/7746496.html 第一部分: http://www.cnblogs.com/cgzl/p/7780559.html 第二 ...

  4. 每周开源项目分享-年轻人的第一个OAuth2.0 Server:hydra

    年轻人的第一个OAuth2.0 Server:hydra hydra 是什么呢? OpenID Connect certified OAuth2 Server - cloud native, secu ...

  5. Spring Cloud(6.3)：搭建OAuth2 Resource Server

    配置web.xml 添加spring-cloud-starter-security,spring-security-oauth2-autoconfigure2个依赖. <!-- Spring c ...

  6. Spring Authorization Server 全新授权服务器整合使用

    前言 Spring Authorization Server 是 Spring 团队最新开发适配 OAuth 协议的授权服务器项目,旨在替代原有的 Spring Security OAuth 经过半年 ...

  7. Spring Authorization Server的使用

    Spring Authorization Server的使用 一.背景 二.前置知识 三.需求 四.核心代码编写 1.引入授权服务器依赖 2.创建授权服务器用户 3.创建授权服务器和客户端 五.测试 ...

  8. Spring Authorization Server 0.2.3发布，放出联合身份DEMO

    很快啊Spring Authorization Server又发新版本了,现在的版本是0.2.3.本次都有什么改动呢?我们来了解一下. 0.2.3版本特性 本次更新的新特性不少. 为公开客户端提供默认 ...

  9. Spring Authorization Server授权服务器入门

    11月8日Spring官方已经强烈建议使用Spring Authorization Server替换已经过时的Spring Security OAuth2.0,距离Spring Security OA ...

  10. Spring Authorization Server 实现授权中心

    Spring Authorization Server 实现授权中心 源码地址 当前,Spring Security 对 OAuth 2.0 框架提供了全面的支持.Spring Authorizati ...

随机推荐

  1. Laravel - Eloquent 删除数据

        public function ormDelete()     {         # 1.通过模型删除         // $student = Student::where('id',5 ...

  2. Redis不同版本,内存分配,硬件的性能研究

    Redis不同版本,内存分配,硬件的性能研究 前言 Konw more ! Do more ! Gain more ! 骨折之后开始减肥. 前段时间跳绳导致膝盖不舒服,现在改骑车和走路. 在有限的没人 ...

  3. [转帖]TiKV Config Learn the TiKV configuration file

    The TiKV configuration file supports more options than command-line parameters. You can find the def ...

  4. [转帖]解析Linux gcore: 揭示程序内存捕获的秘密（linuxgcore）

    https://www.dbs724.com/133618.html Linux gcore 是一种在Linux系统中使用命令行工具捕获进程内存内容的方法.它允许程序员制定程序的一个内存快照,从而帮助 ...

  5. 日常测试进行beans比较的简单方法

    日常测试进行beans比较的简单方法 摘要 想每天把有变化的bean抓取出来有新增的beans时能够及时进行分析和介入 保证beans 都是符合规范的. 方式和方法 开启actuator 打开bean ...

  6. [转帖]深入内存/主存：解剖DRAM存储器

    https://zhuanlan.zhihu.com/p/561501585 2022/9/9更新:经过和评论区大佬的交流,准备研读一下JEDEC标准,主要是加深自己对banking和访存加速的理解( ...

  7. 记录TritonServer部署多模型到多GPU踩坑 | 京东云技术团队

    一.问题是怎么发现的 部署chatglm2和llama2到一个4*V100的GPU机器上遇到问题 config.pbtxt 中设置模型分别在指定gpu上部署实例配置不生效 如以下配置为在gpu0上部署 ...

  8. 【K哥爬虫普法】大众点评VS百度地图，论“数据权属”对爬虫开发的罪与罚！

    我国目前并未出台专门针对网络爬虫技术的法律规范,但在司法实践中,相关判决已屡见不鲜,K哥特设了"K哥爬虫普法"专栏,本栏目通过对真实案例的分析,旨在提高广大爬虫工程师的法律意识,知 ...

  9. .netcore项目发布到IIS全流程

    一.环境准备 保证电脑上有.net core runtime下载地址:https://dotnet.microsoft.com/download/dotnet-core/current/runtime ...

  10. Rocketmq学习4——Broker消息持久化原理源码浅析

    一丶前言 在<Rocketmq学习3--消息发送原理源码浅析>中,我们学习了消息发送的要点: 本地缓存+rpc 请求namesever + 定时刷新,topic路由信息 负载均衡的选择一个 ...