spring-security-oauth2授权码模式

完整pom

    4.0.0
    com.sdkj
    security-oauth
    0.0.1-SNAPSHOT
    security-oauth
    Demo project for Spring Boot

    
        1.8
        UTF-8
        UTF-8
        2.3.7.RELEASE
    

    
        
            org.springframework.cloud
            spring-cloud-starter-security
        
        
        
            org.springframework.cloud
            spring-cloud-starter-oauth2
        

        
            org.springframework.boot
            spring-boot-starter-web
        
    

    
        

            
                org.springframework.cloud
                spring-cloud-dependencies
                Hoxton.SR3
                pom
                import
            

            
                org.springframework.boot
                spring-boot-dependencies
                ${spring-boot.version}
                pom
                import
            
        
    

    
        
            
                org.apache.maven.plugins
                maven-compiler-plugin
                3.8.1
                
                    1.8
                    1.8
                    UTF-8
                
            
            
                org.springframework.boot
                spring-boot-maven-plugin
                2.3.7.RELEASE
                
                    com.sdkj.security.oauth.SecurityOauthApplication
                
                
                    
                        repackage
                        
                            repackage
                        
                    
                
            
        
    

User:

package com.sdkj.security.oauth.entity;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.Collection;
import java.util.List;


public class User implements UserDetails
{
    private static final long serialVersionUID = 1L;

    
    private String userName;

    
    private String password;

    
    private List authorities;

    public User() {
    }

    public User(String userName, String password, List authorities) {
        this.userName = userName;
        this.password = password;
        this.authorities = authorities;
    }

    @Override
    public Collection getAuthorities() {
        return this.authorities;
    }

    @Override
    public String getPassword() {
        return this.password;
    }

    @Override
    public String getUsername() {
        return this.userName;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

AuthorizationServerConfig:

package com.sdkj.security.oauth.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    public PasswordEncoder passwordEncoder;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients.inMemory()
                //配置client_id
                .withClient("admin")
                 //配置client_secret
                .secret(passwordEncoder.encode("112233"))
                 //配置访问token的有效期
                .accessTokenValiditySeconds(3600)
                 //配置redirect_url,用于回调的地址
                .redirectUris("http://www.baidu.com")
                //配置申请权限访问
                .scopes("all")
                //配置great_type,表示授权类型
                .authorizedGrantTypes("authorization_code");

    }
}

SecurityConfig:

package com.sdkj.security.oauth.config;

import com.sdkj.security.oauth.handle.MyAccessDeniedHandler;
import com.sdkj.security.oauth.handle.MyAuthenticationFailureHandler;
import com.sdkj.security.oauth.handle.MyAuthenticationSuccessHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public PasswordEncoder getPasswordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Autowired
    private MyAccessDeniedHandler myAccessDeniedHandler;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/oauth/**","/login/**","/logout/**")
            .permitAll()
            .anyRequest()
            .authenticated()
            .and()
            .formLogin()
            .permitAll();
    }


}

ResourceServerConfig:

package com.sdkj.security.oauth.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {

        //配置所有请求均需要授权进行访问,唯独/user/**不需要进行认证
        http.authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .requestMatchers()
                .antMatchers("/user/**");
    }

}

UserDetailServiceImpl:

package com.sdkj.security.oauth.service;

import com.sdkj.security.oauth.entity.User;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;

@Service
public class UserDetailServiceImpl implements UserDetailsService {

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        String password = passwordEncoder.encode("123456");
        return new User(username,password, AuthorityUtils.commaSeparatedStringToAuthorityList("admin,normal"));
    }

}

UserController:

package com.sdkj.security.oauth.controller;

import com.sdkj.security.oauth.entity.User;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/user")
public class UserController {

    @RequestMapping("/getCurrentUser")
    public void getCurrentUser(Authentication authentication)
    {
        User user = (User)authentication.getPrincipal();
        System.out.println(user.getUsername());
    }

}

项目结构:

访问授权:

1.获取code

http://localhost:8080/oauth/authorize?client_id=admin&redirect_uri=http://www.baidu.com&response_type=code&scope=all

2.根据code回去token

http://localhost:8080/oauth/token?code=F3m7bt&grant_type=authorization_code&redirect_uri=http://www.baidu.com&scope=all