软件系统开发定制（一）学习spring-cloud:2021之spring-authorization-server

1. 前言

1.1 软件系统开发定制为什么使用spring-authorization-server？

        真实原因：软件系统开发定制原先是因为个人原因，软件系统开发定制需要研究新版鉴权服务，看到了spring-authorization-server，软件系统开发定制使用过程中，软件系统开发定制想着能不能整合新版本cloud，软件系统开发定制因此此处先以springboot搭建spring-authorization-server，软件系统开发定制后续再替换为springcloud2021。

        官方原因：原先使用Spring Security OAuth，软件系统开发定制而该项目已经逐渐被淘汰，软件系统开发定制虽然网上还是有不少该方案，软件系统开发定制但秉着技术要随时代更新，从而使用spring-authorization-server

2.软件系统开发定制项目迭代历程

  6. 引入gateway网关，swagger文档工具

  7. 待续

3.项目构建

        

3.1 以springboot搭建spring-authorization-server（即认证与资源服务器）

        数据库相关表结构构建

        需要创建3张表，sql分别如下

  1. CREATE TABLE `oauth2_authorization`  (
  2.   `id` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  3.   `registered_client_id` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  4.   `principal_name` varchar(200) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  5.   `authorization_grant_type` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  6.   `attributes` varchar(4000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  7.   `state` varchar(500) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  8.   `authorization_code_value` blob NULL,
  9.   `authorization_code_issued_at` timestamp(0) NULL DEFAULT NULL,
  10.   `authorization_code_expires_at` timestamp(0) NULL DEFAULT NULL,
  11.   `authorization_code_metadata` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  12.   `access_token_value` blob NULL,
  13.   `access_token_issued_at` timestamp(0) NULL DEFAULT NULL,
  14.   `access_token_expires_at` timestamp(0) NULL DEFAULT NULL,
  15.   `access_token_metadata` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  16.   `access_token_type` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  17.   `access_token_scopes` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  18.   `oidc_id_token_value` blob NULL,
  19.   `oidc_id_token_issued_at` timestamp(0) NULL DEFAULT NULL,
  20.   `oidc_id_token_expires_at` timestamp(0) NULL DEFAULT NULL,
  21.   `oidc_id_token_metadata` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  22.   `refresh_token_value` blob NULL,
  23.   `refresh_token_issued_at` timestamp(0) NULL DEFAULT NULL,
  24.   `refresh_token_expires_at` timestamp(0) NULL DEFAULT NULL,
  25.   `refresh_token_metadata` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  26.   PRIMARY KEY (`id`) USING BTREE
  27. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_unicode_ci ROW_FORMAT = Dynamic;
  28.  
  29.  
  30. CREATE TABLE `oauth2_authorization_consent`  (
  31.   `registered_client_id` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  32.   `principal_name` varchar(200) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  33.   `authorities` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  34.   PRIMARY KEY (`registered_client_id`, `principal_name`) USING BTREE
  35. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_unicode_ci ROW_FORMAT = Dynamic;
  36.  
  37.  
  38.  
  39. CREATE TABLE `oauth2_registered_client`  (
  40.   `id` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  41.   `client_id` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  42.   `client_id_issued_at` timestamp(0) NOT NULL DEFAULT CURRENT_TIMESTAMP(0),
  43.   `client_secret` varchar(200) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  44.   `client_secret_expires_at` timestamp(0) NULL DEFAULT NULL,
  45.   `client_name` varchar(200) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  46.   `client_authentication_methods` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  47.   `authorization_grant_types` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  48.   `redirect_uris` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL DEFAULT NULL,
  49.   `scopes` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  50.   `client_settings` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  51.   `token_settings` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  52.   PRIMARY KEY (`id`) USING BTREE
  53. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_unicode_ci ROW_FORMAT = Dynamic;

        先进行认证服务器相关配置

        pom.xml引入依赖

        注意！！！spring boot版本需2.6.x以上，是为后面升级成cloud做准备

  1. <dependency>
  2.     <groupId>org.projectlombok</groupId>
  3.     <artifactId>lombok</artifactId>
  4.     <version>1.18.22</version>
  5. </dependency>
  6.  
  7. <!-- 此依赖是个人公共依赖，你们引入其他具体依赖即可 -->
  8. <dependency>
  9.     <groupId>com.xxxx.iov</groupId>
  10.     <artifactId>iov-cloud-framework-web</artifactId>
  11.     <version>2.0.0-SNAPSHOT</version>
  12.     <exclusions>
  13.         <!-- 这里是因为公共依赖中的web版本太低，所以移除 -->
  14.         <exclusion>
  15.             <groupId>org.springframework.boot</groupId>
  16.             <artifactId>spring-boot-starter-web</artifactId>
  17.         </exclusion>
  18.     </exclusions>
  19. </dependency>
  20.  
  21. <dependency>
  22.     <groupId>org.springframework.boot</groupId>
  23.     <artifactId>spring-boot-starter-web</artifactId>
  24.     <version>2.6.6</version>
  25. </dependency>
  26.  
  27. <!-- hutool -->
  28. <dependency>
  29.     <groupId>cn.hutool</groupId>
  30.     <artifactId>hutool-all</artifactId>
  31.     <version>5.8.0</version>
  32. </dependency>
  33.  
  34. <!-- fastjson -->
  35. <dependency>
  36.     <groupId>com.alibaba</groupId>
  37.     <artifactId>fastjson</artifactId>
  38.     <version>1.2.39</version>
  39. </dependency>
  40.  
  41. <!-- security -->
  42. <dependency>
  43.     <groupId>org.springframework.boot</groupId>
  44.     <artifactId>spring-boot-starter-security</artifactId>
  45. </dependency>
  46.  
  47. <!-- oauth2-authorization-server -->
  48. <dependency>
  49.     <groupId>org.springframework.security</groupId>
  50.     <artifactId>spring-security-oauth2-authorization-server</artifactId>
  51.     <version>0.2.3</version>
  52. </dependency>
  53.  
  54. <!-- security-cas -->
  55. <dependency>
  56.     <groupId>org.springframework.security</groupId>
  57.     <artifactId>spring-security-cas</artifactId>
  58. </dependency>
  59.  
  60. <!-- thymeleaf -->
  61. <dependency>
  62.     <groupId>org.springframework.boot</groupId>
  63.     <artifactId>spring-boot-starter-thymeleaf</artifactId>
  64. </dependency>
  65.  
  66. <!-- 数据连接池 -->
  67. <dependency>
  68.     <groupId>com.alibaba</groupId>
  69.     <artifactId>druid-spring-boot-starter</artifactId>
  70.     <version>1.2.9</version>
  71. </dependency>
  72.  
  73. <!-- 数据库驱动 -->
  74. <dependency>
  75.     <groupId>mysql</groupId>
  76.     <artifactId>mysql-connector-java</artifactId>
  77.     <version>8.0.28</version>
  78. </dependency>
  79.  
  80. <!-- mybatis-plus -->
  81. <dependency>
  82.     <groupId>com.baomidou</groupId>
  83.     <artifactId>mybatis-plus-boot-starter</artifactId>
  84.     <version>3.5.1</version>
  85. </dependency>
  86.  
  87. <!-- guava -->
  88. <dependency>
  89.     <groupId>com.google.guava</groupId>
  90.     <artifactId>guava</artifactId>
  91.     <version>31.1-jre</version>
  92. </dependency>

        创建自定义登录页面 login.html (可不要，使用自带的登录界面)

  1. <!DOCTYPE html>
  2. <html lang="en"
  3.       xmlns:th="https://www.thymeleaf.org"
  4.       xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5">
  5. <head>
  6.     <meta charset="utf-8">
  7.     <meta name="author" content="test">
  8.     <meta name="viewport" content="width=device-width,initial-scale=1">
  9.     <meta name="description" content="This is a login page template based on Bootstrap 5">
  10.     <title>Login Page</title>
  11.     <style>
  12.         .is-invalid {
  13.             color: red;
  14.         }
  15.  
  16.         .invalid-feedback {
  17.             color: red;
  18.         }
  19.  
  20.         .mb-3 {
  21.             margin-bottom: 3px;
  22.         }
  23.     </style>
  24.     <script th:inline="javascript">
  25.         /*<![CDATA[*/
  26.         // const baseURL = /*[[@{/}]]*/ ''; /*]]>*/
  27.         if (window !== top) {
  28.             top.location.href = location.href;
  29.         }
  30.     </script>
  31. </head>
  32. <body class="hold-transition login-page">
  33. <div class="login-box">
  34.     <div class="card">
  35.         <div class="card-body login-card-body">
  36.             <p class="login-box-msg">Sign in to start your session</p>
  37.             <div th:if="${param.error}" class="alert alert-error">
  38.                 Invalid username and password.
  39.             </div>
  40.             <div th:if="${param.logout}" class="alert alert-success">
  41.                 You have been logged out.
  42.             </div>
  43.             <form th:action="@{/login}" method="post" id="loginForm">
  44.                 <div class="input-group mb-3">
  45.                     <input type="text" class="form-control" value="zxg" name="username" placeholder="Email"
  46.                            autocomplete="off">
  47.                 </div>
  48.                 <div class="input-group mb-3">
  49.                     <input type="password" id="password" name="password" value="123" class="form-control"
  50.                            maxlength="25" placeholder="Password"
  51.                            autocomplete="off">
  52.                 </div>
  53.                 <div class="row">
  54.                     <div class="col-4">
  55.                         <button type="submit" id="submitBtn">Sign In</button>
  56.                     </div>
  57.                 </div>
  58.             </form>
  59.             <p class="mb-1">
  60.                 <a href="javascript:void(0)">I forgot my password</a>
  61.             </p>
  62.             <p class="mb-0">
  63.                 <a href="javascript:void(0)" class="text-center">Register a new membership</a>
  64.             </p>
  65.         </div>
  66.     </div>
  67. </div>
  68.  
  69. <script src="https://cdn.bootcdn.net/ajax/libs/jquery/3.6.0/jquery.js"></script>
  70. <script src="https://cdn.bootcdn.net/ajax/libs/jsencrypt/3.1.0/jsencrypt.min.js"></script>
  71. <script src="https://cdn.bootcdn.net/ajax/libs/jquery-validate/1.9.0/jquery.validate.min.js"></script>
  72. <script src="https://cdn.bootcdn.net/ajax/libs/jquery-validate/1.9.0/additional-methods.min.js"></script>
  73.  
  74. <script th:inline="javascript">
  75.  
  76.     $(function () {
  77.         var encrypt = new JSEncrypt();
  78.  
  79.         $.validator.setDefaults({
  80.             submitHandler: function (form) {
  81.                 console.log("Form successful submitted!");
  82.                 form.submit();
  83.             }
  84.         });
  85.  
  86.     });
  87. </script>
  88. </body>
  89. </html>

创建自定义授权页面 consent.html（可不要，可使用自带的授权页面）

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="utf-8">
  5.     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
  6.     <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css"
  7.           integrity="sha384-JcKb8q3iqJ61gNV9KGb8thSsNjpSL0n8PARn9HuZOnIxN0hoP+VmmDGMN5t9UJ0Z" crossorigin="anonymous">
  8.     <title>授权页面</title>
  9.     <style>
  10.         body {
  11.             background-color: aliceblue;
  12.         }
  13.     </style>
  14.    <script>
  15.       function cancelConsent() {
  16.          document.consent_form.reset();
  17.          document.consent_form.submit();
  18.       }
  19.    </script>
  20. </head>
  21. <body>
  22. <div class="container">
  23.     <div class="py-5">
  24.         <h1 class="text-center text-primary">用户授权确认</h1>
  25.     </div>
  26.     <div class="row">
  27.         <div class="col text-center">
  28.             <p>
  29.                 应用
  30.                 <a href="https://felord.cn"><span class="font-weight-bold text-primary" th:text="${clientName}"></span></a>
  31.                 想要访问您的账号
  32.                 <span class="font-weight-bold" th:text="${principalName}"></span>
  33.             </p>
  34.         </div>
  35.     </div>
  36.     <div class="row pb-3">
  37.         <div class="col text-center"><p>上述应用程序请求以下权限<br/>请审阅以下选项并勾选您同意的权限</p></div>
  38.     </div>
  39.     <div class="row">
  40.         <div class="col text-center">
  41.             <form name="consent_form" method="post" action="/oauth2/authorize">
  42.                 <input type="hidden" name="client_id" th:value="${clientId}">
  43.                 <input type="hidden" name="state" th:value="${state}">
  44.  
  45.                 <div th:each="scope: ${scopes}" class="form-group form-check py-1">
  46.                     <input class="form-check-input"
  47.                            type="checkbox"
  48.                            name="scope"
  49.                            th:value="${scope.scope}"
  50.                            th:id="${scope.scope}">
  51.                     <label class="form-check-label font-weight-bold" th:for="${scope.scope}" th:text="${scope.scope}"></label>
  52.                     <p class="text-primary" th:text="${scope.description}"></p>
  53.                 </div>
  54.  
  55.                 <p th:if="${not #lists.isEmpty(previouslyApprovedScopes)}">您已对上述应用授予以下权限：</p>
  56.                 <div th:each="scope: ${previouslyApprovedScopes}" class="form-group form-check py-1">
  57.                     <input class="form-check-input"
  58.                            type="checkbox"
  59.                            th:id="${scope.scope}"
  60.                            disabled
  61.                            checked>
  62.                     <label class="form-check-label font-weight-bold" th:for="${scope.scope}" th:text="${scope.scope}"></label>
  63.                     <p class="text-primary" th:text="${scope.description}"></p>
  64.                 </div>
  65.  
  66.                 <div class="form-group pt-3">
  67.                     <button class="btn btn-primary btn-lg" type="submit" id="submit-consent">
  68.                         同意授权
  69.                     </button>
  70.                 </div>
  71.                 <div class="form-group">
  72.                     <button class="btn btn-link regular" type="button" id="cancel-consent" onclick="cancelConsent();">
  73.                         取消授权
  74.                     </button>
  75.                 </div>
  76.             </form>
  77.         </div>
  78.     </div>
  79.     <div class="row pt-4">
  80.         <div class="col text-center">
  81.             <p>
  82.                 <small>
  83.                     需要您同意并提供访问权限。
  84.                     <br/>如果您不同意，请单击<span class="font-weight-bold text-primary">取消授权</span>，将不会为上述应用程序提供任何您的信息。
  85.                 </small>
  86.             </p>
  87.         </div>
  88.     </div>
  89. </div>
  90. </body>
  91. </html>

        修改配置文件 application.yml（配置内容可自行简略）

  1. server:
  2.   port: 9000
  3.  
  4. spring:
  5.   application:
  6.     name: authorization-server
  7.   thymeleaf:
  8.     cache: false
  9.   datasource:
  10.     url: jdbc:mysql://192.168.1.69:3306/test
  11.     username: root
  12.     password: root
  13.     driver-class-name: com.mysql.cj.jdbc.Driver
  14.   security:
  15.     oauth2:
  16.       resourceserver:
  17.         jwt:
  18.           issuer-uri: http://127.0.0.1:9000  #认证中心端点，作为资源端的配置
  19.           
  20. application:
  21.   security:
  22.     excludeUrls: #excludeUrls中存放白名单地址
  23.       - "/favicon.ico" 
  24.  
  25. # mybatis plus配置
  26. mybatis-plus:
  27.   mapper-locations: classpath:/mapper/*Mapper.xml
  28.   global-config:
  29.     # 关闭MP3.0自带的banner
  30.     banner: false
  31.     db-config:
  32.       #主键类型  0:"数据库ID自增", 1:"不操作", 2:"用户输入ID",3:"数字型snowflake", 4:"全局唯一ID UUID", 5:"字符串型snowflake";
  33.       id-type: AUTO
  34.       #字段策略
  35.       insert-strategy: not_null
  36.       update-strategy: not_null
  37.       select-strategy: not_null
  38.       #驼峰下划线w转换
  39.       table-underline: true
  40.       # 逻辑删除配置
  41.       # 逻辑删除全局值（1表示已删除，这也是Mybatis Plus的默认配置）
  42.       logic-delete-value: 1
  43.       # 逻辑未删除全局值（0表示未删除，这也是Mybatis Plus的默认配置）
  44.       logic-not-delete-value: 0
  45.   configuration:
  46.     #驼峰
  47.     map-underscore-to-camel-case: true
  48.     #打开二级缓存
  49.     cache-enabled: true
  50.     # log-impl: org.apache.ibatis.logging.stdout.StdOutImpl #开启sql日志

        新增认证服务器配置文件 AuthorizationServerConfig

  1. @Configuration(proxyBeanMethods = false)
  2. public class AuthorizationServerConfig {
  3.     /**
  4.      * 自定义授权页面
  5.      * 使用系统自带的即不用
  6.      */
  7.     private static final String CUSTOM_CONSENT_PAGE_URI = "/oauth2/consent";
  8.  
  9.     /**
  10.      * 自定义UserDetailsService
  11.      */
  12.     @Autowired
  13.     private UserService userService;
  14.  
  15.  
  16.     /**
  17.      *
  18.      * 使用默认配置进行form表单登录
  19.      * OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http)
  20.      */
  21.     @Bean
  22.     @Order(Ordered.HIGHEST_PRECEDENCE)
  23.     public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
  24.         OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer = new OAuth2AuthorizationServerConfigurer<>();
  25.  
  26.         authorizationServerConfigurer.authorizationEndpoint(authorizationEndpoint -> authorizationEndpoint.consentPage(CUSTOM_CONSENT_PAGE_URI));
  27.  
  28.         RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
  29.  
  30.         http
  31.                 .requestMatcher(endpointsMatcher)
  32.                 .userDetailsService(userService)
  33.                 .authorizeRequests(authorizeRequests -> authorizeRequests.anyRequest().authenticated())
  34.                 .csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
  35.                 .apply(authorizationServerConfigurer);
  36.         return http.formLogin(Customizer.withDefaults()).build();
  37.     }
  38.  
  39.     /**
  40.      * 注册客户端应用
  41.      */
  42.     @Bean
  43.     public RegisteredClientRepository registeredClientRepository(JdbcTemplate jdbcTemplate) {
  44.         // Save registered client in db as if in-jdbc
  45.         RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
  46.                 .clientId("zxg")
  47.                 .clientSecret("123")
  48.                 .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
  49.                 .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
  50.                 .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
  51.                 .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
  52.                 // 回调地址
  53.                 .redirectUri("http://www.baidu.com")
  54.                 // scope自定义的客户端范围
  55.                 .scope(OidcScopes.OPENID)
  56.                 .scope("message.read")
  57.                 .scope("message.write")
  58.                 // client请求访问时需要授权同意
  59.                 .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
  60.                 // token配置项信息
  61.                 .tokenSettings(TokenSettings.builder()
  62.                         // token有效期100分钟
  63.                         .accessTokenTimeToLive(Duration.ofMinutes(100L))
  64.                         // 使用默认JWT相关格式
  65.                         .accessTokenFormat(OAuth2TokenFormat.SELF_CONTAINED)
  66.                         // 开启刷新token
  67.                         .reuseRefreshTokens(true)
  68.                         // refreshToken有效期120分钟
  69.                         .refreshTokenTimeToLive(Duration.ofMinutes(120L))
  70.                         .idTokenSignatureAlgorithm(SignatureAlgorithm.RS256).build()
  71.                 )
  72.                 .build();
  73.  
  74.         // Save registered client in db as if in-memory
  75.         JdbcRegisteredClientRepository registeredClientRepository = new JdbcRegisteredClientRepository(jdbcTemplate);
  76.         registeredClientRepository.save(registeredClient);
  77.         return registeredClientRepository;
  78.     }
  79.  
  80.     /**
  81.      * 授权服务：管理OAuth2授权信息服务
  82.      */
  83.     @Bean
  84.     public OAuth2AuthorizationService authorizationService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) {
  85.         return new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository);
  86.     }
  87.  
  88.     /**
  89.      * 授权确认信息处理服务
  90.      */
  91.     @Bean
  92.     public OAuth2AuthorizationConsentService authorizationConsentService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) {
  93.         return new JdbcOAuth2AuthorizationConsentService(jdbcTemplate, registeredClientRepository);
  94.     }
  95.  
  96.     /**
  97.      * 加载JWK资源
  98.      * JWT：指的是 JSON Web Token，不存在签名的JWT是不安全的，存在签名的JWT是不可窜改的
  99.      * JWS：指的是签过名的JWT，即拥有签名的JWT
  100.      * JWK：既然涉及到签名，就涉及到签名算法，对称加密还是非对称加密，那么就需要加密的 密钥或者公私钥对。此处我们将 JWT的密钥或者公私钥对统一称为 JSON WEB KEY，即 JWK。
  101.      */
  102.     @Bean
  103.     public JWKSource<SecurityContext> jwkSource() {
  104.         RSAKey rsaKey = JwksUtils.generateRsa();
  105.         JWKSet jwkSet = new JWKSet(rsaKey);
  106.         return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
  107.     }
  108.  
  109.     /**
  110.      * 配置 OAuth2.0 提供者元信息
  111.      */
  112.     @Bean
  113.     public ProviderSettings providerSettings() {
  114.         return ProviderSettings.builder().issuer("http://127.0.0.1:9000").build();
  115.     }
  116.  
  117. }

        新增Security的配置文件WebSecurityConfig

  1. @Configuration
  2. @EnableWebSecurity(debug = true) //开启Security
  3. public class WebSecurityConfig {
  4.     @Autowired
  5.     private ApplicationProperties properties;
  6.  
  7.     /**
  8.      * 设置加密方式
  9.      */
  10.     @Bean
  11.     public PasswordEncoder passwordEncoder() {
  12. //        // 将密码加密方式采用委托方式，默认以BCryptPasswordEncoder方式进行加密，兼容ldap,MD4,MD5等方式
  13. //        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
  14.  
  15.         // 此处我们使用明文方式 不建议这样
  16.         return NoOpPasswordEncoder.getInstance();
  17.     }
  18.  
  19.     /**
  20.      * 使用WebSecurity.ignoring()忽略某些URL请求，这些请求将被Spring Security忽略
  21.      */
  22.     @Bean
  23.     WebSecurityCustomizer webSecurityCustomizer() {
  24.         return new WebSecurityCustomizer() {
  25.             @Override
  26.             public void customize(WebSecurity web) {
  27.                 // 读取配置文件application.security.excludeUrls下的链接进行忽略
  28.                 web.ignoring().antMatchers(properties.getSecurity().getExcludeUrls().toArray(new String[]{}));
  29.             }
  30.         };
  31.     }
  32.  
  33.     /**
  34.      * 针对http请求，进行拦截过滤
  35.      *
  36.      * CookieCsrfTokenRepository进行CSRF保护的工作方式：
  37.      *      1.客户端向服务器发出GET请求，例如请求主页
  38.      *      2.Spring发送 GET 请求的响应以及 Set-cookie 标头，其中包含安全生成的XSRF令牌
  39.      */
  40.     @Bean
  41.     public SecurityFilterChain httpSecurityFilterChain(HttpSecurity httpSecurity) throws Exception {
  42.         httpSecurity
  43.                 .authorizeRequests(authorizeRequests ->
  44.                         authorizeRequests.antMatchers("/login").permitAll()
  45.                                 .anyRequest().authenticated()
  46.                 )
  47.  
  48.                 //使用默认登录页面
  49.                 //.formLogin(withDefaults())
  50.  
  51.                 //设置form登录，设置且放开登录页login
  52.                 .formLogin(fromlogin -> fromlogin.loginPage("/login").permitAll())
  53.  
  54.                 // Spring Security CSRF保护
  55.                 .csrf(csrfToken -> csrfToken.csrfTokenRepository(new CookieCsrfTokenRepository()))
  56.                 
  57. //                 //开启认证服务器的资源服务器相关功能，即需校验token
  58. //                .oauth2ResourceServer()
  59. //                .accessDeniedHandler(new SimpleAccessDeniedHandler())
  60. //                .authenticationEntryPoint(new SimpleAuthenticationEntryPoint())
  61. //                .jwt()
  62.         ;
  63.         return httpSecurity.build();
  64.     }
  65.  
  66. }

        新增读取application配置的类 ApplicationProperties

  1. /**
  2. * 此步主要是获取配置文件中配置的白名单，可自行舍去或自定义实现其他方式
  3. **/
  4. @Data
  5. @Component
  6. @ConfigurationProperties("application")
  7. public class ApplicationProperties {
  8.     private final Security security = new Security();
  9.  
  10.     @Data
  11.     public static class Security {
  12.         private Oauth2 oauth2;
  13.         private List<String> excludeUrls = new ArrayList<>();
  14.  
  15.         @Data
  16.         public static class Oauth2 {
  17.             private String issuerUrl;
  18.  
  19.         }
  20.     }
  21. }

        新增 JwksUtils 类和 KeyGeneratorUtils，这两个类作为JWT对称加密

  1. public final class JwksUtils {
  2.  
  3.     private JwksUtils() {
  4.     }
  5.  
  6.     /**
  7.      * 生成RSA加密key (即JWK)
  8.      */
  9.     public static RSAKey generateRsa() {
  10.         // 生成RSA加密的key
  11.         KeyPair keyPair = KeyGeneratorUtils.generateRsaKey();
  12.         // 公钥
  13.         RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
  14.         // 私钥
  15.         RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
  16.         // 构建RSA加密key
  17.         return new RSAKey.Builder(publicKey)
  18.                 .privateKey(privateKey)
  19.                 .keyID(UUID.randomUUID().toString())
  20.                 .build();
  21.     }
  22.  
  23.     /**
  24.      * 生成EC加密key (即JWK)
  25.      */
  26.     public static ECKey generateEc() {
  27.         // 生成EC加密的key
  28.         KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
  29.         // 公钥
  30.         ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
  31.         // 私钥
  32.         ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
  33.         // 根据公钥参数生成曲线
  34.         Curve curve = Curve.forECParameterSpec(publicKey.getParams());
  35.         // 构建EC加密key
  36.         return new ECKey.Builder(curve, publicKey)
  37.                 .privateKey(privateKey)
  38.                 .keyID(UUID.randomUUID().toString())
  39.                 .build();
  40.     }
  41.  
  42.     /**
  43.      * 生成HmacSha256密钥
  44.      */
  45.     public static OctetSequenceKey generateSecret() {
  46.         SecretKey secretKey = KeyGeneratorUtils.generateSecretKey();
  47.         return new OctetSequenceKey.Builder(secretKey)
  48.                 .keyID(UUID.randomUUID().toString())
  49.                 .build();
  50.     }
  51. }
  52.  
  53.  
  54. class KeyGeneratorUtils {
  55.  
  56.     private KeyGeneratorUtils() {
  57.     }
  58.  
  59.     /**
  60.      * 生成RSA密钥
  61.      */
  62.     static KeyPair generateRsaKey() {
  63.         KeyPair keyPair;
  64.         try {
  65.             KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
  66.             keyPairGenerator.initialize(2048);
  67.             keyPair = keyPairGenerator.generateKeyPair();
  68.         } catch (Exception ex) {
  69.             throw new IllegalStateException(ex);
  70.         }
  71.         return keyPair;
  72.     }
  73.  
  74.     /**
  75.      * 生成EC密钥
  76.      */
  77.     static KeyPair generateEcKey() {
  78.         EllipticCurve ellipticCurve = new EllipticCurve(
  79.                 new ECFieldFp(
  80.                         new BigInteger("115792089210356248762697446949407573530086143415290314195533631308867097853951")),
  81.                 new BigInteger("115792089210356248762697446949407573530086143415290314195533631308867097853948"),
  82.                 new BigInteger("41058363725152142129326129780047268409114441015993725554835256314039467401291"));
  83.         ECPoint ecPoint = new ECPoint(
  84.                 new BigInteger("48439561293906451759052585252797914202762949526041747995844080717082404635286"),
  85.                 new BigInteger("36134250956749795798585127919587881956611106672985015071877198253568414405109"));
  86.         ECParameterSpec ecParameterSpec = new ECParameterSpec(
  87.                 ellipticCurve,
  88.                 ecPoint,
  89.                 new BigInteger("115792089210356248762697446949407573529996955224135760342422259061068512044369"),
  90.                 1);
  91.  
  92.         KeyPair keyPair;
  93.         try {
  94.             KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
  95.             keyPairGenerator.initialize(ecParameterSpec);
  96.             keyPair = keyPairGenerator.generateKeyPair();
  97.         } catch (Exception ex) {
  98.             throw new IllegalStateException(ex);
  99.         }
  100.         return keyPair;
  101.     }
  102.  
  103.     /**
  104.      * 生成HmacSha256密钥
  105.      */
  106.     static SecretKey generateSecretKey() {
  107.         SecretKey hmacKey;
  108.         try {
  109.             hmacKey = KeyGenerator.getInstance("HmacSha256").generateKey();
  110.         } catch (Exception ex) {
  111.             throw new IllegalStateException(ex);
  112.         }
  113.         return hmacKey;
  114.     }
  115. }

        新建 ConsentController，编写登录和认证页面的跳转

        如果在上面没有使用自定义的登录和授权页面，下面的跳转方法按需舍去

  1. @Slf4j
  2. @Controller
  3. public class ConsentController {
  4.  
  5.     private final RegisteredClientRepository registeredClientRepository;
  6.     private final OAuth2AuthorizationConsentService authorizationConsentService;
  7.  
  8.     public ConsentController(RegisteredClientRepository registeredClientRepository,
  9.                              OAuth2AuthorizationConsentService authorizationConsentService) {
  10.         this.registeredClientRepository = registeredClientRepository;
  11.         this.authorizationConsentService = authorizationConsentService;
  12.     }
  13.  
  14.     @ResponseBody
  15.     @GetMapping("/favicon.ico")
  16.     public String faviconico(){
  17.         return "favicon.ico";
  18.     }
  19.  
  20.     @GetMapping("/login")
  21.     public String loginPage(){
  22.         return "login";
  23.     }
  24.  
  25.     @GetMapping(value = "/oauth2/consent")
  26.     public String consent(Principal principal, Model model,
  27.                           @RequestParam(OAuth2ParameterNames.CLIENT_ID) String clientId,
  28.                           @RequestParam(OAuth2ParameterNames.SCOPE) String scope,
  29.                           @RequestParam(OAuth2ParameterNames.STATE) String state) {
  30.  
  31.         // Remove scopes that were already approved
  32.         Set<String> scopesToApprove = new HashSet<>();
  33.         Set<String> previouslyApprovedScopes = new HashSet<>();
  34.         RegisteredClient registeredClient = this.registeredClientRepository.findByClientId(clientId);
  35.         OAuth2AuthorizationConsent currentAuthorizationConsent =
  36.                 this.authorizationConsentService.findById(registeredClient.getId(), principal.getName());
  37.         Set<String> authorizedScopes;
  38.         if (currentAuthorizationConsent != null) {
  39.             authorizedScopes = currentAuthorizationConsent.getScopes();
  40.         } else {
  41.             authorizedScopes = Collections.emptySet();
  42.         }
  43.         for (String requestedScope : StringUtils.delimitedListToStringArray(scope, " ")) {
  44.             if (authorizedScopes.contains(requestedScope)) {
  45.                 previouslyApprovedScopes.add(requestedScope);
  46.             } else {
  47.                 scopesToApprove.add(requestedScope);
  48.             }
  49.         }
  50.  
  51.         model.addAttribute("clientId", clientId);
  52.         model.addAttribute("state", state);
  53.         model.addAttribute("scopes", withDescription(scopesToApprove));
  54.         model.addAttribute("previouslyApprovedScopes", withDescription(previouslyApprovedScopes));
  55.         model.addAttribute("principalName", principal.getName());
  56.  
  57.         return "consent";
  58.     }
  59.  
  60.     private static Set<ScopeWithDescription> withDescription(Set<String> scopes) {
  61.         Set<ScopeWithDescription> scopeWithDescriptions = new HashSet<>();
  62.         for (String scope : scopes) {
  63.             scopeWithDescriptions.add(new ScopeWithDescription(scope));
  64.  
  65.         }
  66.         return scopeWithDescriptions;
  67.     }
  68.  
  69.     public static class ScopeWithDescription {
  70.         private static final String DEFAULT_DESCRIPTION = "UNKNOWN SCOPE - We cannot provide information about this permission, use caution when granting this.";
  71.         private static final Map<String, String> scopeDescriptions = new HashMap<>();
  72.         static {
  73.             scopeDescriptions.put(
  74.                     "message.read",
  75.                     "This application will be able to read your message."
  76.             );
  77.             scopeDescriptions.put(
  78.                     "message.write",
  79.                     "This application will be able to add new messages. It will also be able to edit and delete existing messages."
  80.             );
  81.             scopeDescriptions.put(
  82.                     "other.scope",
  83.                     "This is another scope example of a scope description."
  84.             );
  85.         }
  86.  
  87.         public final String scope;
  88.         public final String description;
  89.  
  90.         ScopeWithDescription(String scope) {
  91.             this.scope = scope;
  92.             this.description = scopeDescriptions.getOrDefault(scope, DEFAULT_DESCRIPTION);
  93.         }
  94.     }
  95.  
  96. }

        新建 UserController，User，UserService等标准的自定义用户业务，此处仅放出UserServiceImpl

  1. @RequiredArgsConstructor
  2. @Slf4j
  3. @Component
  4. class UserServiceImpl implements UserService {
  5.     private final UserMapper userMapper;
  6.  
  7.     @Override
  8.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  9.         User user = userMapper.selectOne(new LambdaQueryWrapper<User>().eq(User::getUsername,username));
  10.         return new org.springframework.security.core.userdetails.User(username, user.getPassword(), new ArrayList<>());
  11.     }
  12. }

        启动项目，如下图

        认证服务器整体结构图

----------------------------------------------------------------------------------------------------------------------------------------------------------

        资源服务器相关配置

        pom.xml引入资源服务器相关依赖

  1. <!-- resource-server资源服务器 -->
  2. <dependency>
  3.     <groupId>org.springframework.boot</groupId>
  4.     <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
  5. </dependency>
  6.  
  7. <!-- security -->
  8. <dependency>
  9.     <groupId>org.springframework.boot</groupId>
  10.     <artifactId>spring-boot-starter-security</artifactId>
  11. </dependency>

        新增配置文件 application.yaml

  1. server:
  2.   port: 9003
  3. spring:
  4.   application:
  5.     name: resource
  6.   security:
  7.     oauth2:
  8.       resourceserver:
  9.         jwt:
  10.           issuer-uri: http://127.0.0.1:9000
  11. feign:
  12.   client:
  13.     config:
  14.       default: #配置超时时间
  15.         connect-timeout: 10000
  16.         read-timeout: 10000

        新增资源服务器配置文件 ResourceServerConfiguration

  1. @Configuration
  2. @EnableWebSecurity(debug = true)
  3. @EnableGlobalMethodSecurity(prePostEnabled = true) //开启鉴权服务
  4. public class ResourceServerConfiguration {
  5.  
  6.     @Bean
  7.     public SecurityFilterChain httpSecurityFilterChain(HttpSecurity httpSecurity) throws Exception {
  8.         // 所有请求都进行拦截
  9.         httpSecurity.authorizeRequests().anyRequest().authenticated();
  10.         // 关闭session
  11.         httpSecurity.sessionManagement().disable();
  12.         // 配置资源服务器的无权限，无认证拦截器等 以及JWT验证
  13.         httpSecurity.oauth2ResourceServer()
  14.                 .accessDeniedHandler(new SimpleAccessDeniedHandler())
  15.                 .authenticationEntryPoint(new SimpleAuthenticationEntryPoint())
  16.                 .jwt();
  17.         return httpSecurity.build();
  18.     }
  19.  
  20. }

        新增相关无认证无权限统一拦截回复 SimpleAccessDeniedHandler 和 SimpleAuthenticationEntryPoint

  1. /**
  2.  * 携带了token 而且token合法 但是权限不足以访问其请求的资源 403
  3.  * @author zxg
  4.  */
  5. public class SimpleAccessDeniedHandler implements AccessDeniedHandler {
  6.  
  7.     @Override
  8.     public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
  9.         response.setStatus(HttpServletResponse.SC_FORBIDDEN);
  10.         response.setCharacterEncoding("utf-8");
  11.         response.setContentType(MediaType.APPLICATION_JSON_VALUE);
  12.         ObjectMapper objectMapper = new ObjectMapper();
  13.         String resBody = objectMapper.writeValueAsString(SingleResultBundle.failed("无权访问"));
  14.         PrintWriter printWriter = response.getWriter();
  15.         printWriter.print(resBody);
  16.         printWriter.flush();
  17.         printWriter.close();
  18.     }
  19. }
  20.  
  21.  
  22. /**
  23.  * 在资源服务器中 不携带token 或者token无效  401
  24.  * @author zxg
  25.  */
  26. @Slf4j
  27. public class SimpleAuthenticationEntryPoint implements AuthenticationEntryPoint {
  28.     @Override
  29.     public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
  30.         if (response.isCommitted()){
  31.             return;
  32.         }
  33.  
  34.         Throwable throwable = authException.fillInStackTrace();
  35.  
  36.         String errorMessage = "认证失败";
  37.  
  38.         if (throwable instanceof BadCredentialsException){
  39.             errorMessage = "错误的客户端信息";
  40.         }else {
  41.             Throwable cause = authException.getCause();
  42.  
  43.             if (cause instanceof JwtValidationException) {
  44.                 log.warn("JWT Token 过期，具体内容:" + cause.getMessage());
  45.                 errorMessage = "无效的token信息";
  46.             } else if (cause instanceof BadJwtException){
  47.                 log.warn("JWT 签名异常，具体内容：" + cause.getMessage());
  48.                 errorMessage = "无效的token信息";
  49.             } else if (cause instanceof AccountExpiredException){
  50.                 errorMessage = "账户已过期";
  51.             } else if (cause instanceof LockedException){
  52.                 errorMessage = "账户已被锁定";
  53. //            } else if (cause instanceof InvalidClientException || cause instanceof BadClientCredentialsException){
  54. //                response.getWriter().write(JSON.toJSONString(SingleResultBundle.failed(401,"无效的客户端")));
  55. //            } else if (cause instanceof InvalidGrantException || cause instanceof RedirectMismatchException){
  56. //                response.getWriter().write(JSON.toJSONString(SingleResultBundle.failed("无效的类型")));
  57. //            } else if (cause instanceof UnauthorizedClientException) {
  58. //                response.getWriter().write(JSON.toJSONString(SingleResultBundle.failed("未经授权的客户端")));
  59.             } else if (throwable instanceof InsufficientAuthenticationException) {
  60.                 String message = throwable.getMessage();
  61.                 if (message.contains("Invalid token does not contain resource id")){
  62.                     errorMessage = "未经授权的资源服务器";
  63.                 }else if (message.contains("Full authentication is required to access this resource")){
  64.                     errorMessage = "缺少验证信息";
  65.                 }
  66.             }else {
  67.                 errorMessage = "验证异常";
  68.             }
  69.         }
  70.  
  71.         response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
  72.         response.setCharacterEncoding("utf-8");
  73.         response.setContentType(MediaType.APPLICATION_JSON_VALUE);
  74.         ObjectMapper objectMapper = new ObjectMapper();
  75.         String resBody = objectMapper.writeValueAsString(SingleResultBundle.failed(errorMessage));
  76.         PrintWriter printWriter = response.getWriter();
  77.         printWriter.print(resBody);
  78.         printWriter.flush();
  79.         printWriter.close();
  80.     }
  81. }

        新增 ResourceController 进行接口测试

  1. @Slf4j
  2. @RestController
  3. public class ResourceController {
  4.  
  5.     /**
  6.      * 测试Spring Authorization Server，测试权限
  7.      */
  8.     @PreAuthorize("hasAuthority('SCOPE_message.read')")
  9.     @GetMapping("/getTest")
  10.     public String getTest(){
  11.         return "getTest";
  12.     }
  13.  
  14.     /**
  15.      * 默认登录成功跳转页为 /  防止404状态
  16.      *
  17.      * @return the map
  18.      */
  19.     @GetMapping("/")
  20.     public Map<String, String> index() {
  21.         return Collections.singletonMap("msg", "login success!");
  22.     }
  23.  
  24.     @GetMapping("/getResourceTest")
  25.     public SingleResultBundle<String> getResourceTest(){
  26.         return SingleResultBundle.success("这是resource的测试方法 getResourceTest()");
  27.     }
  28. }

        启动项目，效果如下

        项目总体结构如下

        测试认证鉴权

  1. #调用 /oauth2/authorize ，获取code
  2. http://127.0.0.1:9000/oauth2/authorize?client_id=zxg&response_type=code&scope=message.read&redirect_uri=http://www.baidu.com
  3. #会判断是否登录，若没有，则跳转到登录页面，如下图1
  4. #登录完成后，会提示是否授权，若没有，则跳转到授权界面，如下图2
  5. #授权成功后，跳转到回调地址，并带上code，如图3

        打开postman，进行获取access_token

  1. #访问 /oauth2/token 地址
  2. #在Authorization中选择Basic Auth模式，填入对应客户端，其会在header中生成Authorization，如下图右侧

        返回结果如下

        调用ResourceController中的接口，测试token是否生效

源码下载地址

应多位网友反应，上传源码，部分地方与上文代码有所出入

总结

至此，spring-authorization-server的基础使用已完成，总体上和原Spring Security OAuth大差不差，个别配置项不同。期间在网上搜寻了很多资料，然后进行整合，因此文中存在与其他网上教程相同代码，如有争议，请联系我删除改正，谢谢。由于不太会写文章，我就直接贴出代码，代码中我有加上注释，所以上述文章中，没有很具体的描述，基本就是个人开发流程，若文中有那里写不对，欢迎指教，不喜勿喷。

关于部分，请查看后续相关文章

网站建设定制开发 软件系统开发定制 定制软件开发 软件开发定制 定制app开发 app开发定制 app开发定制公司 电商商城定制开发 定制小程序开发 定制开发小程序 客户管理系统开发定制 定制网站 定制开发 crm开发定制 开发公司 小程序开发定制 定制软件 收款定制开发 企业网站定制开发 定制化开发 android系统定制开发 定制小程序开发费用 定制设计 专注app软件定制开发 软件开发定制定制 知名网站建设定制 软件定制开发供应商 应用系统定制开发 软件系统定制开发 企业管理系统定制开发 系统定制开发