SpringSecurityOAuth开发app认证框架

布满荆棘的人生 2022-01-30 15:57 1216阅读 0赞

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 1]  
**令牌的表现形式就是一个字符串**

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 2]

### 文章目录 ###

*  服务提供商的实现
 *   *  认证服务器
     *   *  demo pom 文件中引入app模块依赖 使正常启动
         *  实现认证服务器
         *   *  WhaleAuthenticationSecurityConfig
             *  授权码模式的请求参数
             *  User must be authenticated with Spring Security before authorization can be completed.
             *  MySecurityConfig
             *  DemoUserDetailsService
             *  期间有出现一个错误This application has no explicit mapping for /error, so you are seeing this as a fallback.
             *  error="invalid\_request", error\_description="At least one redirect\_uri must be registered with the client
             *  授权码授权流程
             *   *  点击授权
                 *  第三方应用应该拿着这个授权码去获取token post 访问 /oauth/token
                 *  /oauth/token的访问
             *  再看密码模式
             *   *  Unsupported grant type: password
     *  资源服务器的实现

实现一个标准的oauth2协议中的provider角色的主要功能  
重构之前的认证方式的代码，使其支持token  
高级特性

# 服务提供商的实现 #

认证服务器  
资源服务器

## 认证服务器 ##

### demo pom 文件中引入app模块依赖 使正常启动 ###

<dependency>
                <groupId>com.whale.security</groupId>
                <artifactId>whale-security-app</artifactId>
                <version>${whale.security.version}</version>
            </dependency>

注释掉session的配置  
重新启动

Message: Error creating bean with name 'validateCodeFilter': Unsatisfied dependency expressed through field 'authenticationFailureHandler'; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type 'org.springframework.security.web.authentication.AuthenticationFailureHandler' available: expected at least 1 bean which qualifies as autowire candidate. Dependency annotations: {@org.springframework.beans.factory.annotation.Autowired(required=true)}
    2019-05-20 13:58:01.564  INFO 11352 --- [           main] o.apache.catalina.core.StandardService   : Stopping service [Tomcat]

没有找到失败处理器  
因为之前的在browser模块里面  
![在这里插入图片描述][20190520161604971.png]  
在app模块里面重新创建失败处理器

先直接把browser里面的这两个失败 成功处理器拷贝到app，并引入相关类  
![在这里插入图片描述][20190520162101390.png]  
重新启动

Error creating bean with name 'myUserDetailsService': Unsatisfied dependency expressed through field 'passwordEncoder';

![在这里插入图片描述][20190520163339364.png]

@Configuration
    @EnableConfigurationProperties(SecurityProperties.class)//使SecurityProperties中的配置生效
    public class SecurityCoreConfig {
    
        @Bean
        public PasswordEncoder passwordEncoder(){
            return new BCryptPasswordEncoder();//也可以自定义 只要实现PasswordEncoder接口
        }
    }

再次重新启动

已经正常启动起来

### 实现认证服务器 ###

![在这里插入图片描述][20190520164223339.png]

#### WhaleAuthenticationSecurityConfig ####

@Configuration
    @EnableAuthorizationServer
    public class WhaleAuthenticationSecurityConfig {
    }

这样就已经实现了一个认证服务器  
可以提供oauth的四种授权模式

重新启动  
控制台有如下几个路径  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 3]  
直接访问报错

#### 授权码模式的请求参数 ####

![在这里插入图片描述][20190520165134335.png]  
这还需要一些参数  
[https://oauth.net/2/][https_oauth.net_2]  
[https://tools.ietf.org/html/rfc6749][https_tools.ietf.org_html_rfc6749]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 4]  
查看授权码模式  
[https://tools.ietf.org/html/rfc6749\#page-24][https_tools.ietf.org_html_rfc6749_page-24]  
它需要如下几个请求参数  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 5]

client\_Id 启动的时候会在控制台打印出来  
![在这里插入图片描述][20190520165910189.png]  
其中client\_id 和 client\_secret 每次启动都会自动变化  
demo application 配置下

security.oauth2.client.client-id=whale
    security.oauth2.client.client-secret=123456

#### User must be authenticated with Spring Security before authorization can be completed. ####

构造请求参数重新请求  
[http://127.0.0.1:8080/oauth/authorize?response\_type=code&client\_id=whale&redirect\_uri=http://example.com&scope=all][http_127.0.0.1_8080_oauth_authorize_response_type_code_client_id_whale_redirect_uri_http_example.com_scope_all]  
报错

org.springframework.security.authentication.InsufficientAuthenticationException: User must be authenticated with Spring Security before authorization can be completed.

根据这个路径找发到这个方法  
![在这里插入图片描述][20190521084334240.png]  
AuthorizationEndpoint

@RequestMapping(value = "/oauth/authorize")
    	public ModelAndView authorize(Map<String, Object> model, @RequestParam Map<String, String> parameters,
    			SessionStatus sessionStatus, Principal principal) {
    
    		// Pull out the authorization request first, using the OAuth2RequestFactory. All further logic should
    		// query off of the authorization request instead of referring back to the parameters map. The contents of the
    		// parameters map will be stored without change in the AuthorizationRequest object once it is created.
    		AuthorizationRequest authorizationRequest = getOAuth2RequestFactory().createAuthorizationRequest(parameters);
    
    		try {
    		·················································
    			if (!(principal instanceof Authentication) || !((Authentication) principal).isAuthenticated()) {
    				throw new InsufficientAuthenticationException(
    						"User must be authenticated with Spring Security before authorization can be completed.");
    			}
    			················································
    		}
    		catch (RuntimeException e) {
    			sessionStatus.setComplete();
    			throw e;
    		}
    
    	}

方法里有个if语句，它是判断我们当前有没有登录，我打断点过去发现principal为null

结合错误提示，是想让我们登录

我随便访问一个地址http://localhost:8080/hello 竟然不需要登录，我百思不得题姐

注释掉`WhaleAuthenticationSecurityConfig` 这个认证服务器的配置类，就又需要登录了

看来原因就是出在这个类上，配置了认证服务器原来的安全认证就失效了吗？

之前项目依赖browser模块时有一个`BrowserSecurityConfig`继承了`WebSecurityConfigurerAdapter`  
现在依赖app了 我在demo下重新写一个`WebSecurityConfigurerAdapter`的实现  
![在这里插入图片描述][20190521125359430.png]

#### MySecurityConfig ####

#### DemoUserDetailsService ####

@Component
    public class DemoUserDetailsService implements UserDetailsService{
        // 这里注入dao 层 用于查询数据库
    
        Logger logger = LoggerFactory.getLogger(getClass());
    
        @Autowired
        private PasswordEncoder passwordEncoder;
    
        @Override
        public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
            //根据用户名从数据库查找用户信息
            logger.info("UserDetails 登录用户名"+ userName);
            String password = passwordEncoder.encode("123456");
    
            return new User(userName, password,
                    AuthorityUtils.commaSeparatedStringToAuthorityList("admin,ROLE_USER"));//第三个参数是做授权的
        }

#### 期间有出现一个错误This application has no explicit mapping for /error, so you are seeing this as a fallback. ####

Whitelabel Error Page
    This application has no explicit mapping for /error, so you are seeing this as a fallback.
    
    There was an unexpected error (type=Forbidden, status=403).
    Access Denied

因为在springboot中所有的类不能和启动类同级

#### error=“invalid\_request”, error\_description="At least one redirect\_uri must be registered with the client ####

再次重新启动访问请求连接又报错 也是醉了

OAuth Error
    error="invalid_request", error_description="At least one redirect_uri must be registered with the client."

打断点  
AuthorizationEndpoint /oauth/authorize里面  
![在这里插入图片描述][20190521125802394.png]  
DefaultRedirectResolver  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 6]  
registeredRedirectUris 为null 所至

解决  
[https://blog.csdn.net/taotaojs/article/details/85126140][https_blog.csdn.net_taotaojs_article_details_85126140] 这个不能解决  
[https://segmentfault.com/q/1010000015995274/a-1020000015998139][https_segmentfault.com_q_1010000015995274_a-1020000015998139] ok

其他  
[https://www.cnblogs.com/cjsblog/p/9296361.html][https_www.cnblogs.com_cjsblog_p_9296361.html]  
[https://alexbilbie.com/guide-to-oauth-2-grants/][https_alexbilbie.com_guide-to-oauth-2-grants]  
[https://docs.spring.io/spring-security-oauth2-boot/docs/current-SNAPSHOT/reference/htmlsingle/][https_docs.spring.io_spring-security-oauth2-boot_docs_current-SNAPSHOT_reference_htmlsingle]  
[https://blog.csdn.net/qq\_36144258/article/details/79413485][https_blog.csdn.net_qq_36144258_article_details_79413485]  
[https://blog.csdn.net/u013815546/article/details/76898524][https_blog.csdn.net_u013815546_article_details_76898524]  
[https://segmentfault.com/a/1190000012260914][https_segmentfault.com_a_1190000012260914]

![20190521130112733.png][]  
在demo application中加入  
security.oauth2.client.registered-redirect-uri=http://example.com

再次启动 重新访问 成功了

#### 授权码授权流程 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 7]

##### 点击授权 #####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 8]

这时已经跳转到第三方应用了

##### 第三方应用应该拿着这个授权码去获取token post 访问 /oauth/token #####

post 访问 /oauth/token  
![在这里插入图片描述][20190521130657163.png]

先修改MySecurityConfig 的登录方式为 httpBasic()  
然后用postman 验证一下  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 9]  
ok  
[https://tools.ietf.org/html/rfc6749\#page-24][https_tools.ietf.org_html_rfc6749_page-24]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 10]  
![在这里插入图片描述][20190521133517562.png]

##### /oauth/token的访问 #####

注意请求参数中的code为我们的授权码  
![在这里插入图片描述][20190521134446561.png]  
安全认证为  
![在这里插入图片描述][20190521134412302.png]  
如下  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 11]

{
      "access_token": "7b4c3f66-d3b4-4035-b46c-41a5f1ff0b26",
      "token_type": "bearer",
      "refresh_token": "9e1a166e-492d-4ad7-b9c2-b4bd36336f2a",
      "expires_in": 43199,
      "scope": "all"
    }

此时 oauth2的授权码流程已经走完

#### 再看密码模式 ####

[https://tools.ietf.org/html/rfc6749\#page-24][https_tools.ietf.org_html_rfc6749_page-24]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 12]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 13]  
其中 basic 的认证还是需要的

还需要服务提供商的用户和密码  
但它不知道你的用户名和密码是怎么来得

发送请求报错Unsupported grant type: password

##### Unsupported grant type: password #####

解决  
[https://segmentfault.com/a/1190000012260914][https_segmentfault.com_a_1190000012260914]  
MySecurityConfig中

@Configuration
    public class MySecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Qualifier("demoUserDetailsService")
        @Autowired
        private UserDetailsService userDetailsService;
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.httpBasic()   //指定身份认证的方式为表单登录
                    .and()
                    .authorizeRequests() //对请求授权
                    .anyRequest()        //任何请求
                    .authenticated()    //安全认证
            .and().userDetailsService(userDetailsService);
        }
    
        /**
         * 需要配置这个支持password模式
         * support password grant type
         * @return
         * @throws Exception
         */
        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }
    }

再次发送请求 成功

{
      "access_token": "6eb99d87-38da-45af-aca5-093628bc6fa0",
      "token_type": "bearer",
      "refresh_token": "829cdf29-06cf-45d4-82ae-789dde24b757",
      "expires_in": 43199,
      "scope": "all"
    }

注意对于已经请求过token的用户在有效期内再次请求时 ，请求的token字符串是一样的

## 资源服务器的实现 ##

![在这里插入图片描述][2019052116025574.png]

@Configuration
    @EnableResourceServer
    public class WhaleResourceServerConfig {
    
    }

此时我们这个服务器既是认证服务器又是资源服务器

启动访问 restlet client 工具访问 [http://127.0.0.1:8080/hello][http_127.0.0.1_8080_hello]  
401错误  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 14]

{"error":"unauthorized","error_description":"Full authentication is required to access this resource"}

么有做身份认证

请求时需要把token带着

重新用密码授权模式获取token

请求头中加入要加入  
“access\_token": “09ed8d75-cfeb-4c84-939c-19bf8559e011”,  
“token\_type”：”bearer“  
请求头如下  
Authorization bearer 09ed8d75-cfeb-4c84-939c-19bf8559e011  
注意token\_type和access\_token之间有一个空格  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 15]

它就是通过这个access\_token来确认身份

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70]: /images/20220130/9f7dc77543084631b18a29acb0d66303.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 1]: /images/20220130/c28288388ba24dd785f534fd0a48c526.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 2]: /images/20220130/dcab448111e74852a0e955d3901c23d0.png
[20190520161604971.png]: /images/20220130/4e3d7b34a7e843dbb8b3d45994270855.png
[20190520162101390.png]: /images/20220130/770cb4cf82f649a896c1e1cf6712fd51.png
[20190520163339364.png]: /images/20220130/34e44f5bd12b4ac7abd4d5baf2879d86.png
[20190520164223339.png]: /images/20220130/e2f70abbfe424d75a581dde2af3bf90d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 3]: /images/20220130/013df19c27984bf8a50be8eba16c8ce3.png
[20190520165134335.png]: /images/20220130/045649e915af4db9a0be016634183e93.png
[https_oauth.net_2]: https://oauth.net/2/
[https_tools.ietf.org_html_rfc6749]: https://tools.ietf.org/html/rfc6749
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 4]: /images/20220130/4059e691b5f64780a8c2686cb76f4c12.png
[https_tools.ietf.org_html_rfc6749_page-24]: https://tools.ietf.org/html/rfc6749#page-24
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 5]: /images/20220130/1644386dd28047e0bfc842b288e2ae5a.png
[20190520165910189.png]: /images/20220130/906f29b0beee4ee8929ce5a4ba4e4f44.png
[http_127.0.0.1_8080_oauth_authorize_response_type_code_client_id_whale_redirect_uri_http_example.com_scope_all]: http://127.0.0.1:8080/oauth/authorize?response_type=code&client_id=whale&redirect_uri=http://example.com&scope=all
[20190521084334240.png]: /images/20220130/976d5d17e0f24e00b220444aa054b285.png
[20190521125359430.png]: /images/20220130/b9e16558290b46ae918b89d275ddbfa3.png
[20190521125802394.png]: /images/20220130/c0000369434d4064898a33709f8b3162.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 6]: /images/20220130/47eafef11b1546cd8d733178fa45066e.png
[https_blog.csdn.net_taotaojs_article_details_85126140]: https://blog.csdn.net/taotaojs/article/details/85126140
[https_segmentfault.com_q_1010000015995274_a-1020000015998139]: https://segmentfault.com/q/1010000015995274/a-1020000015998139
[https_www.cnblogs.com_cjsblog_p_9296361.html]: https://www.cnblogs.com/cjsblog/p/9296361.html
[https_alexbilbie.com_guide-to-oauth-2-grants]: https://alexbilbie.com/guide-to-oauth-2-grants/
[https_docs.spring.io_spring-security-oauth2-boot_docs_current-SNAPSHOT_reference_htmlsingle]: https://docs.spring.io/spring-security-oauth2-boot/docs/current-SNAPSHOT/reference/htmlsingle/
[https_blog.csdn.net_qq_36144258_article_details_79413485]: https://blog.csdn.net/qq_36144258/article/details/79413485
[https_blog.csdn.net_u013815546_article_details_76898524]: https://blog.csdn.net/u013815546/article/details/76898524
[https_segmentfault.com_a_1190000012260914]: https://segmentfault.com/a/1190000012260914
[20190521130112733.png]: /images/20220130/714a1fe609d547c2b400e3d0003fcd29.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 7]: /images/20220130/d3c97d580d37480a8c84958d03f8f05d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 8]: /images/20220130/cec0fcf1636f4df3a2d7032550791543.png
[20190521130657163.png]: /images/20220130/a9a1b544b4be4f62b1a47a3feb24889c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 9]: /images/20220130/feccb043ec1242529560a4c861ce2658.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 10]: /images/20220130/be6f5b44a56e484b8d18d8fd94ba956f.png
[20190521133517562.png]: /images/20220130/87f0533dbff14fb4bb33cd259b89a460.png
[20190521134446561.png]: /images/20220130/7f88d04e38f54612bdcbc2fc42448e6f.png
[20190521134412302.png]: /images/20220130/5f9b4a9d40604c549d43977916a52605.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 11]: /images/20220130/1c8ff69c635342df99b3cfe98258d9a6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 12]: /images/20220130/ee19eda550754c8f970df96a28f28ecf.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 13]: /images/20220130/a077173362f743948ec162556992c048.png
[2019052116025574.png]: /images/20220130/8d794879786a44ccad9a21e9972095ca.png
[http_127.0.0.1_8080_hello]: http://127.0.0.1:8080/hello
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 14]: /images/20220130/5f38d88a76d84583923542b13585cba9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3VvdGFpbA_size_16_color_FFFFFF_t_70 15]: /images/20220130/008a265e7c6a400c9af04e6c6b9f4538.png