基于Spring Security 5 的 Authorization Server的写法

先看演示

pom.xml

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-parent</artifactId>

        <version>2.6.5</version>

        <relativePath/> <!-- lookup parent from repository -->

    </parent>

    <groupId>com.cjs.example.oauth2</groupId>

    <artifactId>cjs-authorization-server</artifactId>

    <version>0.0.1-SNAPSHOT</version>

    <name>cjs-authorization-server</name>

    <properties>

        <java.version>1.8</java.version>

        <docker.image.prefix>cjssso</docker.image.prefix>

    </properties>

    <dependencies>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-web</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-security</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.security</groupId>

            <artifactId>spring-security-oauth2-authorization-server</artifactId>

            <version>0.2.3</version>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-thymeleaf</artifactId>

        </dependency>

        <dependency>

            <groupId>org.thymeleaf.extras</groupId>

            <artifactId>thymeleaf-extras-springsecurity5</artifactId>

        </dependency>

        <!-- https://www.webjars.org/documentation#springboot -->

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>webjars-locator-core</artifactId>

            <version>0.50</version>

        </dependency>

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>bootstrap</artifactId>

            <version>5.1.3</version>

        </dependency>

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>jquery</artifactId>

            <version>3.6.0</version>

        </dependency>

        <dependency>

            <groupId>org.projectlombok</groupId>

            <artifactId>lombok</artifactId>

            <optional>true</optional>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-test</artifactId>

            <scope>test</scope>

        </dependency>

        <dependency>

            <groupId>org.springframework.security</groupId>

            <artifactId>spring-security-test</artifactId>

            <scope>test</scope>

        </dependency>

    </dependencies>

    <build>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

                <configuration>

                    <excludes>

                        <exclude>

                            <groupId>org.projectlombok</groupId>

                            <artifactId>lombok</artifactId>

                        </exclude>

                    </excludes>

                </configuration>

            </plugin>

            <!-- https://github.com/spotify/docker-maven-plugin -->

            <plugin>

                <groupId>com.spotify</groupId>

                <artifactId>docker-maven-plugin</artifactId>

                <version>1.2.2</version>

                <configuration>

                    <imageName>${docker.image.prefix}/${project.artifactId}</imageName>

                    <dockerDirectory>src/main/docker</dockerDirectory>

                    <resources>

                        <resource>

                            <targetPath>/</targetPath>

                            <directory>${project.build.directory}</directory>

                            <include>${project.build.finalName}.jar</include>

                        </resource>

                    </resources>

                </configuration>

            </plugin>

        </plugins>

    </build>

</project>

application.yml



server:

  port: 9000

#  servlet:

#    context-path: /uaa

logging:

  level:

    root: debug

Security配置



package com.cjs.example.oauth2.config;

import com.nimbusds.jose.jwk.JWKSet;

import com.nimbusds.jose.jwk.RSAKey;

import com.nimbusds.jose.jwk.source.ImmutableJWKSet;

import com.nimbusds.jose.jwk.source.JWKSource;

import com.nimbusds.jose.proc.SecurityContext;

import org.springframework.beans.factory.config.BeanDefinition;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.context.annotation.Role;

import org.springframework.core.annotation.Order;

import org.springframework.security.config.Customizer;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;

import org.springframework.security.core.userdetails.User;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

import org.springframework.security.oauth2.core.AuthorizationGrantType;

import org.springframework.security.oauth2.core.ClientAuthenticationMethod;

import org.springframework.security.oauth2.core.oidc.OidcScopes;

import org.springframework.security.oauth2.jwt.JwtDecoder;

import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;

import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;

import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;

import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;

import org.springframework.security.oauth2.server.authorization.config.ClientSettings;

import org.springframework.security.oauth2.server.authorization.config.ProviderSettings;

import org.springframework.security.provisioning.InMemoryUserDetailsManager;

import org.springframework.security.web.SecurityFilterChain;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.interfaces.RSAPrivateKey;

import java.security.interfaces.RSAPublicKey;

import java.util.UUID;

/**

 * @Author ChengJianSheng

 * @Date 2022/3/29

 */

@Configuration

public class OAuth2AuthorizationServerSecurityConfiguration {

    @Bean

    @Order(1)

    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {

        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);

        return http.formLogin(Customizer.withDefaults()).build();

    }

    @Bean

    @Order(2)

    public SecurityFilterChain standardSecurityFilterChain(HttpSecurity http) throws Exception {

        http.authorizeHttpRequests((authorize) -> authorize

                .antMatchers("/webjars/**", "/login", "/login-error").permitAll()

                .anyRequest().authenticated())

                .formLogin().loginPage("/login").failureUrl("/login-error");

        return http.build();

    }

    @Bean

    public RegisteredClientRepository registeredClientRepository() {

        RegisteredClient client1 = RegisteredClient.withId(UUID.randomUUID().toString())

                .clientId("client-1")

                .clientSecret("$2a$10$zNvOs9Ex0cD794OyWwDIXutF7F4hHYjLuEwI.U30p3nNIyumfON42")

                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)

                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)

                .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)

                .redirectUri("http://127.0.0.1:8081/message/login/oauth2/code/mycustom")

                .redirectUri("http://127.0.0.1:8081/message/authorized")

                .clientSettings(ClientSettings.builder().requireAuthorizationConsent(false).build())

                .build();

        RegisteredClient client2 = RegisteredClient.withId(UUID.randomUUID().toString())

                .clientId("client-2")

                .clientSecret("$2a$10$csxC.p5gNQbnpv8Mt5dqPevS66QL2USHERtQ8hEA1TWETIk1Zo3SS")

                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)

                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)

                .redirectUri("http://www.baidu.com")

                .scope("message:read")

                .build();

        return new InMemoryRegisteredClientRepository(client1, client2);

    }

    @Bean

    public JWKSource jwkSource(KeyPair keyPair) {

        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();

        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();

        RSAKey rsaKey = new RSAKey.Builder(publicKey)

                .privateKey(privateKey)

                .keyID(UUID.randomUUID().toString())

                .build();

        JWKSet jwkSet = new JWKSet(rsaKey);

        return new ImmutableJWKSet<>(jwkSet);

    }

    @Bean

    public JwtDecoder jwtDecoder(KeyPair keyPair) {

        return NimbusJwtDecoder.withPublicKey((RSAPublicKey) keyPair.getPublic()).build();

    }

    @Bean

    public ProviderSettings providerSettings() {

        return ProviderSettings.builder().issuer("http://localhost:9000").build();

    }

    @Bean

    public UserDetailsService userDetailsService() {

        UserDetails userDetails = User.withUsername("zhangsan")

                .password("$2a$10$5nlwTDZ9LNbz7UMKcseY3u6YqbkGrMe2tQirfrwrCJAKrDAM78bUa")

                .roles("USER")

                .build();

        return new InMemoryUserDetailsManager(userDetails);

    }

    public static void main(String[] args) {

        System.out.println(new BCryptPasswordEncoder().encode("123456"));

    }

    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

    @Bean

    @Role(BeanDefinition.ROLE_INFRASTRUCTURE)

    KeyPair generateRsaKey() {

        KeyPair keyPair;

        try {

            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");

            keyPairGenerator.initialize(2048);

            keyPair = keyPairGenerator.generateKeyPair();

        } catch (Exception ex) {

            throw new IllegalStateException(ex);

        }

        return keyPair;

    }

}

自定义登录页面

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org">

<head>

    <title>Spring Security OAuth 2.0 Sample</title>

    <meta charset="utf-8" />

    <meta http-equiv="X-UA-Compatible" content="IE=edge" />

    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

    <link rel="stylesheet" href="/webjars/bootstrap/css/bootstrap.css" th:href="@{/webjars/bootstrap/css/bootstrap.css}" />

</head>

<body>

<div class="container">

    <h1>Login</h1>

    <p th:if="${loginError}" style="font-weight:bold;color:red;">Wrong username or password</p>

    <form th:action="@{/login}" method="post">

        <div class="form-row">

            <div class="form-group">

                <label for="username">Username</label>

                <input type="text" id="username" name="username" placeholder="请输入用户名" autofocus="autofocus" class="form-control">

                <small class="form-text text-muted">user1 / password</small>

            </div>

        </div>

        <div class="form-row">

            <div class="form-group">

                <label for="password">Password</label>

                <input type="password" id="password" name="password" placeholder="请输入密码" class="form-control">

            </div>

        </div>

        <div class="form-row">

            <div class="form-group">

                <label for="verificationCode">验证码</label>

                <input type="text" id="verificationCode" name="verificationCode" placeholder="请输入验证码" class="form-control">

            </div>

        </div>

        <button type="submit" class="btn btn-primary">登录</button>

    </form>

</div>

<script src="/webjars/jquery/jquery.min.js" th:src="@{/webjars/jquery/jquery.min.js}"></script>

<script src="/webjars/bootstrap/js/bootstrap.min.js" th:src="@{/webjars/bootstrap/js/bootstrap.min.js}"></script>

</body>

</html>

默认的Controller



package com.cjs.example.oauth2.controller;

import org.springframework.stereotype.Controller;

import org.springframework.ui.Model;

import org.springframework.web.bind.annotation.GetMapping;

/**

 * @Author ChengJianSheng

 * @Date 2022/4/2

 */

@Controller

public class DefaultController {

	@GetMapping("/")

	public String root() {

		return "redirect:/index";

	}

	@GetMapping("/index")

	public String index() {

		return "index";

	}

	@GetMapping("/login")

	public String login() {

		return "login";

	}

	@GetMapping("/login-error")

	public String loginError(Model model) {

		model.addAttribute("loginError", true);

		return login();

	}

}

获取token



GET http://localhost:9000/oauth2/authorize?response_type=code&client_id=client-2&redirect_uri=http://www.baidu.com

POST /oauth2/token HTTP/1.1

Host: localhost:9000

Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=xxx&redirect_uri=http://www.baidu.com

抓包

项目结构

参考

https://github.com/jgrandja/spring-security-oauth-5-2-migrate/tree/main/client-app

OAuth2 Authorization Server的更多相关文章

  1. Spring Cloud(6.1)：搭建OAuth2 Authorization Server

    配置web.xml 添加spring-cloud-starter-security和spring-security-oauth2-autoconfigure两个依赖. </dependency& ...

  2. 使用Identity Server 4建立Authorization Server (6) - js(angular5) 客户端

    预备知识: http://www.cnblogs.com/cgzl/p/7746496.html 第一部分: http://www.cnblogs.com/cgzl/p/7780559.html 第二 ...

  3. 使用Identity Server 4建立Authorization Server (4)

    预备知识: http://www.cnblogs.com/cgzl/p/7746496.html 第一部分: http://www.cnblogs.com/cgzl/p/7780559.html 第二 ...

  4. 每周开源项目分享-年轻人的第一个OAuth2.0 Server:hydra

    年轻人的第一个OAuth2.0 Server:hydra hydra 是什么呢? OpenID Connect certified OAuth2 Server - cloud native, secu ...

  5. Spring Cloud(6.3)：搭建OAuth2 Resource Server

    配置web.xml 添加spring-cloud-starter-security,spring-security-oauth2-autoconfigure2个依赖. <!-- Spring c ...

  6. Spring Authorization Server 全新授权服务器整合使用

    前言 Spring Authorization Server 是 Spring 团队最新开发适配 OAuth 协议的授权服务器项目,旨在替代原有的 Spring Security OAuth 经过半年 ...

  7. Spring Authorization Server的使用

    Spring Authorization Server的使用 一.背景 二.前置知识 三.需求 四.核心代码编写 1.引入授权服务器依赖 2.创建授权服务器用户 3.创建授权服务器和客户端 五.测试 ...

  8. Spring Authorization Server 0.2.3发布，放出联合身份DEMO

    很快啊Spring Authorization Server又发新版本了,现在的版本是0.2.3.本次都有什么改动呢?我们来了解一下. 0.2.3版本特性 本次更新的新特性不少. 为公开客户端提供默认 ...

  9. Spring Authorization Server授权服务器入门

    11月8日Spring官方已经强烈建议使用Spring Authorization Server替换已经过时的Spring Security OAuth2.0,距离Spring Security OA ...

  10. Spring Authorization Server 实现授权中心

    Spring Authorization Server 实现授权中心 源码地址 当前,Spring Security 对 OAuth 2.0 框架提供了全面的支持.Spring Authorizati ...

随机推荐

  1. 【MicroPython】用 c 添加接口 -- 给 module 添加 function

    [来源]https://www.eemaker.com/micropython-c-modfunc.html

  2. 凡是有但是-varchar和nvarchar的初步学习之一

    凡是有但是-varchar和nvarchar的初步学习之一 背景 高应用开发, 在涉及到国内国外的问题时,重要的事情有两个: 时区转换, 字符集转换. 时区转换虽然是很难理清楚, 各种规范不统一的事情 ...

  3. [转帖]java获取到heapdump文件后，如何快速分析？

    https://www.jianshu.com/p/aaf56385766d   简介 在之前的OOM问题复盘之后,本周,又一Java服务出现了内存问题,这次问题不严重,只会触发堆内存占用高报警,没有 ...

  4. [转帖]vSphere虚拟化平台（vCenter和ESXi）升级注意事项

    https://www.dinghui.org/vmware-vsphere-upgrade.html 最近两年做了蛮多vSphere升级项目,几点思路,做一下汇总整理如下供参考: 一.升级必要性 1 ...

  5. [转帖]​Linux开源存储漫谈（2）IO性能测试利器fio

    fio(Flexible I/O Tester)正是非常常用的文件系统和磁盘 I/O 性能基准测试工具.提供了大量的可定制化选项,可以用来测试,裸盘.一个单独的分区或者文件系统在各种场景下的 I/O ...

  6. dmidecode 查看内存以及硬件信息

    安装工具dmidecode 使用 1.查看内存槽及内存条 $ sudo dmidecode -t memory 2.查看内存的插槽数,已经使用多少插槽.每条内存多大 $ sudo dmidecode  ...

  7. flex 布局子元素被挤压的问题

    Flex 意为 "弹性布局",是一种在开发静态页面过程中常用的布局模式. 开发购物车使用flex布局的时候遇到的一种场景:子元素被挤压 具体如图所示, 当商品名称超出两行文字时显示 ...

  8. 火狐谷歌浏览器去掉input type=number时控件的方法

    html 默认:<input type="number" /></br> 处理:<input type="number" clas ...

  9. Linux命令行从x度网盘下载数据

    技术背景 做开源项目的时候,尤其是现在的数据量越来越大,经常会面临到数据往哪里存放的问题.因为自己刚好有一个某度云的会员,看了一下还有几十个TB的空间还没用上.于是考虑把这个网盘变成一个定向共享数据的 ...

  10. AspnetCore接入Nacos配置中心

    一.什么是nacos Nacos /nɑ:kəʊs/ 是 Dynamic Naming and Configuration Service的首字母简称,一个更易于构建云原生应用的动态服务发现.配置管理 ...