基于Spring Security 5 的 Authorization Server的写法

先看演示

pom.xml

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-parent</artifactId>

        <version>2.6.5</version>

        <relativePath/> <!-- lookup parent from repository -->

    </parent>

    <groupId>com.cjs.example.oauth2</groupId>

    <artifactId>cjs-authorization-server</artifactId>

    <version>0.0.1-SNAPSHOT</version>

    <name>cjs-authorization-server</name>

    <properties>

        <java.version>1.8</java.version>

        <docker.image.prefix>cjssso</docker.image.prefix>

    </properties>

    <dependencies>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-web</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-security</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.security</groupId>

            <artifactId>spring-security-oauth2-authorization-server</artifactId>

            <version>0.2.3</version>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-thymeleaf</artifactId>

        </dependency>

        <dependency>

            <groupId>org.thymeleaf.extras</groupId>

            <artifactId>thymeleaf-extras-springsecurity5</artifactId>

        </dependency>

        <!-- https://www.webjars.org/documentation#springboot -->

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>webjars-locator-core</artifactId>

            <version>0.50</version>

        </dependency>

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>bootstrap</artifactId>

            <version>5.1.3</version>

        </dependency>

        <dependency>

            <groupId>org.webjars</groupId>

            <artifactId>jquery</artifactId>

            <version>3.6.0</version>

        </dependency>

        <dependency>

            <groupId>org.projectlombok</groupId>

            <artifactId>lombok</artifactId>

            <optional>true</optional>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-test</artifactId>

            <scope>test</scope>

        </dependency>

        <dependency>

            <groupId>org.springframework.security</groupId>

            <artifactId>spring-security-test</artifactId>

            <scope>test</scope>

        </dependency>

    </dependencies>

    <build>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

                <configuration>

                    <excludes>

                        <exclude>

                            <groupId>org.projectlombok</groupId>

                            <artifactId>lombok</artifactId>

                        </exclude>

                    </excludes>

                </configuration>

            </plugin>

            <!-- https://github.com/spotify/docker-maven-plugin -->

            <plugin>

                <groupId>com.spotify</groupId>

                <artifactId>docker-maven-plugin</artifactId>

                <version>1.2.2</version>

                <configuration>

                    <imageName>${docker.image.prefix}/${project.artifactId}</imageName>

                    <dockerDirectory>src/main/docker</dockerDirectory>

                    <resources>

                        <resource>

                            <targetPath>/</targetPath>

                            <directory>${project.build.directory}</directory>

                            <include>${project.build.finalName}.jar</include>

                        </resource>

                    </resources>

                </configuration>

            </plugin>

        </plugins>

    </build>

</project>

application.yml



server:

  port: 9000

#  servlet:

#    context-path: /uaa

logging:

  level:

    root: debug

Security配置



package com.cjs.example.oauth2.config;

import com.nimbusds.jose.jwk.JWKSet;

import com.nimbusds.jose.jwk.RSAKey;

import com.nimbusds.jose.jwk.source.ImmutableJWKSet;

import com.nimbusds.jose.jwk.source.JWKSource;

import com.nimbusds.jose.proc.SecurityContext;

import org.springframework.beans.factory.config.BeanDefinition;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.context.annotation.Role;

import org.springframework.core.annotation.Order;

import org.springframework.security.config.Customizer;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;

import org.springframework.security.core.userdetails.User;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

import org.springframework.security.oauth2.core.AuthorizationGrantType;

import org.springframework.security.oauth2.core.ClientAuthenticationMethod;

import org.springframework.security.oauth2.core.oidc.OidcScopes;

import org.springframework.security.oauth2.jwt.JwtDecoder;

import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;

import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;

import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;

import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;

import org.springframework.security.oauth2.server.authorization.config.ClientSettings;

import org.springframework.security.oauth2.server.authorization.config.ProviderSettings;

import org.springframework.security.provisioning.InMemoryUserDetailsManager;

import org.springframework.security.web.SecurityFilterChain;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.interfaces.RSAPrivateKey;

import java.security.interfaces.RSAPublicKey;

import java.util.UUID;

/**

 * @Author ChengJianSheng

 * @Date 2022/3/29

 */

@Configuration

public class OAuth2AuthorizationServerSecurityConfiguration {

    @Bean

    @Order(1)

    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {

        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);

        return http.formLogin(Customizer.withDefaults()).build();

    }

    @Bean

    @Order(2)

    public SecurityFilterChain standardSecurityFilterChain(HttpSecurity http) throws Exception {

        http.authorizeHttpRequests((authorize) -> authorize

                .antMatchers("/webjars/**", "/login", "/login-error").permitAll()

                .anyRequest().authenticated())

                .formLogin().loginPage("/login").failureUrl("/login-error");

        return http.build();

    }

    @Bean

    public RegisteredClientRepository registeredClientRepository() {

        RegisteredClient client1 = RegisteredClient.withId(UUID.randomUUID().toString())

                .clientId("client-1")

                .clientSecret("$2a$10$zNvOs9Ex0cD794OyWwDIXutF7F4hHYjLuEwI.U30p3nNIyumfON42")

                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)

                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)

                .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)

                .redirectUri("http://127.0.0.1:8081/message/login/oauth2/code/mycustom")

                .redirectUri("http://127.0.0.1:8081/message/authorized")

                .clientSettings(ClientSettings.builder().requireAuthorizationConsent(false).build())

                .build();

        RegisteredClient client2 = RegisteredClient.withId(UUID.randomUUID().toString())

                .clientId("client-2")

                .clientSecret("$2a$10$csxC.p5gNQbnpv8Mt5dqPevS66QL2USHERtQ8hEA1TWETIk1Zo3SS")

                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)

                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)

                .redirectUri("http://www.baidu.com")

                .scope("message:read")

                .build();

        return new InMemoryRegisteredClientRepository(client1, client2);

    }

    @Bean

    public JWKSource jwkSource(KeyPair keyPair) {

        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();

        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();

        RSAKey rsaKey = new RSAKey.Builder(publicKey)

                .privateKey(privateKey)

                .keyID(UUID.randomUUID().toString())

                .build();

        JWKSet jwkSet = new JWKSet(rsaKey);

        return new ImmutableJWKSet<>(jwkSet);

    }

    @Bean

    public JwtDecoder jwtDecoder(KeyPair keyPair) {

        return NimbusJwtDecoder.withPublicKey((RSAPublicKey) keyPair.getPublic()).build();

    }

    @Bean

    public ProviderSettings providerSettings() {

        return ProviderSettings.builder().issuer("http://localhost:9000").build();

    }

    @Bean

    public UserDetailsService userDetailsService() {

        UserDetails userDetails = User.withUsername("zhangsan")

                .password("$2a$10$5nlwTDZ9LNbz7UMKcseY3u6YqbkGrMe2tQirfrwrCJAKrDAM78bUa")

                .roles("USER")

                .build();

        return new InMemoryUserDetailsManager(userDetails);

    }

    public static void main(String[] args) {

        System.out.println(new BCryptPasswordEncoder().encode("123456"));

    }

    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

    @Bean

    @Role(BeanDefinition.ROLE_INFRASTRUCTURE)

    KeyPair generateRsaKey() {

        KeyPair keyPair;

        try {

            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");

            keyPairGenerator.initialize(2048);

            keyPair = keyPairGenerator.generateKeyPair();

        } catch (Exception ex) {

            throw new IllegalStateException(ex);

        }

        return keyPair;

    }

}

自定义登录页面

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org">

<head>

    <title>Spring Security OAuth 2.0 Sample</title>

    <meta charset="utf-8" />

    <meta http-equiv="X-UA-Compatible" content="IE=edge" />

    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

    <link rel="stylesheet" href="/webjars/bootstrap/css/bootstrap.css" th:href="@{/webjars/bootstrap/css/bootstrap.css}" />

</head>

<body>

<div class="container">

    <h1>Login</h1>

    <p th:if="${loginError}" style="font-weight:bold;color:red;">Wrong username or password</p>

    <form th:action="@{/login}" method="post">

        <div class="form-row">

            <div class="form-group">

                <label for="username">Username</label>

                <input type="text" id="username" name="username" placeholder="请输入用户名" autofocus="autofocus" class="form-control">

                <small class="form-text text-muted">user1 / password</small>

            </div>

        </div>

        <div class="form-row">

            <div class="form-group">

                <label for="password">Password</label>

                <input type="password" id="password" name="password" placeholder="请输入密码" class="form-control">

            </div>

        </div>

        <div class="form-row">

            <div class="form-group">

                <label for="verificationCode">验证码</label>

                <input type="text" id="verificationCode" name="verificationCode" placeholder="请输入验证码" class="form-control">

            </div>

        </div>

        <button type="submit" class="btn btn-primary">登录</button>

    </form>

</div>

<script src="/webjars/jquery/jquery.min.js" th:src="@{/webjars/jquery/jquery.min.js}"></script>

<script src="/webjars/bootstrap/js/bootstrap.min.js" th:src="@{/webjars/bootstrap/js/bootstrap.min.js}"></script>

</body>

</html>

默认的Controller



package com.cjs.example.oauth2.controller;

import org.springframework.stereotype.Controller;

import org.springframework.ui.Model;

import org.springframework.web.bind.annotation.GetMapping;

/**

 * @Author ChengJianSheng

 * @Date 2022/4/2

 */

@Controller

public class DefaultController {

	@GetMapping("/")

	public String root() {

		return "redirect:/index";

	}

	@GetMapping("/index")

	public String index() {

		return "index";

	}

	@GetMapping("/login")

	public String login() {

		return "login";

	}

	@GetMapping("/login-error")

	public String loginError(Model model) {

		model.addAttribute("loginError", true);

		return login();

	}

}

获取token



GET http://localhost:9000/oauth2/authorize?response_type=code&client_id=client-2&redirect_uri=http://www.baidu.com

POST /oauth2/token HTTP/1.1

Host: localhost:9000

Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=xxx&redirect_uri=http://www.baidu.com

抓包

项目结构

参考

https://github.com/jgrandja/spring-security-oauth-5-2-migrate/tree/main/client-app

OAuth2 Authorization Server的更多相关文章

  1. Spring Cloud(6.1)：搭建OAuth2 Authorization Server

    配置web.xml 添加spring-cloud-starter-security和spring-security-oauth2-autoconfigure两个依赖. </dependency& ...

  2. 使用Identity Server 4建立Authorization Server (6) - js(angular5) 客户端

    预备知识: http://www.cnblogs.com/cgzl/p/7746496.html 第一部分: http://www.cnblogs.com/cgzl/p/7780559.html 第二 ...

  3. 使用Identity Server 4建立Authorization Server (4)

    预备知识: http://www.cnblogs.com/cgzl/p/7746496.html 第一部分: http://www.cnblogs.com/cgzl/p/7780559.html 第二 ...

  4. 每周开源项目分享-年轻人的第一个OAuth2.0 Server:hydra

    年轻人的第一个OAuth2.0 Server:hydra hydra 是什么呢? OpenID Connect certified OAuth2 Server - cloud native, secu ...

  5. Spring Cloud(6.3)：搭建OAuth2 Resource Server

    配置web.xml 添加spring-cloud-starter-security,spring-security-oauth2-autoconfigure2个依赖. <!-- Spring c ...

  6. Spring Authorization Server 全新授权服务器整合使用

    前言 Spring Authorization Server 是 Spring 团队最新开发适配 OAuth 协议的授权服务器项目,旨在替代原有的 Spring Security OAuth 经过半年 ...

  7. Spring Authorization Server的使用

    Spring Authorization Server的使用 一.背景 二.前置知识 三.需求 四.核心代码编写 1.引入授权服务器依赖 2.创建授权服务器用户 3.创建授权服务器和客户端 五.测试 ...

  8. Spring Authorization Server 0.2.3发布，放出联合身份DEMO

    很快啊Spring Authorization Server又发新版本了,现在的版本是0.2.3.本次都有什么改动呢?我们来了解一下. 0.2.3版本特性 本次更新的新特性不少. 为公开客户端提供默认 ...

  9. Spring Authorization Server授权服务器入门

    11月8日Spring官方已经强烈建议使用Spring Authorization Server替换已经过时的Spring Security OAuth2.0,距离Spring Security OA ...

  10. Spring Authorization Server 实现授权中心

    Spring Authorization Server 实现授权中心 源码地址 当前,Spring Security 对 OAuth 2.0 框架提供了全面的支持.Spring Authorizati ...

随机推荐

  1. Angular系列教程之组件

    .markdown-body { line-height: 1.75; font-weight: 400; font-size: 16px; overflow-x: hidden; color: rg ...

  2. Spring Cloud 系列：Seata 中TCC模式具体实现

    概述 https://seata.io/zh-cn/docs/dev/mode/tcc-mode https://seata.io/zh-cn/docs/user/mode/tcc TCC模式与AT模 ...

  3. 【C++】static 静态成员

    静态成员 静态成员包括静态数据成员和静态成员函数,提供了同类对象间数据成员的共享机制 静态成员不是某个对象的成员,是类所有对象的共享成员,只建立一个成员副本 静态成员的定义与引用 定义格式:stati ...

  4. SpringMVC02——第一个MVC程序-注解版（high版！！！！）

    注解版 新建一个子项目,添加Web支持 在pom.xml文件中引入相关的依赖:主要引入Spring框架核心库.SpringMVC.servlet,JSTL等. 创建实体类Fruit package c ...

  5. 百度网盘(百度云)SVIP超级会员共享账号每日更新（2024.01.03）

    一.百度网盘SVIP超级会员共享账号 可能很多人不懂这个共享账号是什么意思,小编在这里给大家做一下解答. 我们多知道百度网盘很大的用处就是类似U盘,不同的人把文件上传到百度网盘,别人可以直接下载,避免 ...

  6. [转帖]DevOps & CI/CD 常见面试题汇总

    https://www.cnblogs.com/Dev0ps/p/15123168.html 什么是 DevOps答:用最简单的术语来说,DevOps 是产品开发过程中开发(Dev)和运营(Ops) ...

  7. [转帖][译]tcpdump 示例教程

    https://colobu.com/2019/07/16/a-tcpdump-tutorial-with-examples/ 目录 [−] 基于IP查找流量 根据来源和目标进行筛选 根据网段进行查找 ...

  8. [转帖]Kafka—配置SASL/PLAIN认证客户端及常用操作命令

    介绍   SASL/PLAIN 是一种简单的 username/password安全认证机制,本文主要总结服务端开启该认证后,命令行客户端进行配置的操作流程. 配置 增加jaas.properties ...

  9. 【转帖】Dockerfile文件指令介绍

    https://blog.whsir.com/post-5327.html Dockerfile其实就是一个文本文件,这个文本文件名称叫Dockerfile,里面包含了一些指令(可以理解成多个指令集合 ...

  10. Chrome 历史版本下载点

    https://www.chromedownloads.net/chrome64win-stable/