spring Security4 和 oauth2整合注解+xml混合使用（基础运行篇）

╰半橙微兮° 2022-06-04 02:15 156阅读 0赞

# Spring Security4 和 oauth2整合 #

最近项目中需要用到oauth2，到网上找了好多资料，全是乱七八糟的，东拼西凑，终于跑出来了一版，xml的方式太乱了，跑不了，还是用注解方式，并把一些关键配置提到xml中。

git地址：[https://gitee.com/ffch/OauthUmp][https_gitee.com_ffch_OauthUmp]

[spring Security4 和 oauth2整合 注解+xml混合使用（基础运行篇）][spring Security4 _ oauth2_ _xml]  
[spring Security4 和 oauth2整合 注解+xml混合使用（进阶篇）][spring Security4 _ oauth2_ _xml 1]  
[spring Security4 和 oauth2整合 注解+xml混合使用（授权码篇）][spring Security4 _ oauth2_ _xml 2]  
[spring Security4 和 oauth2整合 注解+xml混合使用（注意事项篇）][spring Security4 _ oauth2_ _xml 3]  
[spring Security4 和 oauth2整合 注解+xml混合使用（替换6位的授权码）][spring Security4 _ oauth2_ _xml_6]  
[spring Security4 和 oauth2整合 注解+xml混合使用（替换用户名密码认证）][spring Security4 _ oauth2_ _xml 4]  
[spring Security4 和 oauth2整合 注解+xml混合使用（验证码等额外数据验证）][spring Security4 _ oauth2_ _xml 5]

## 网上已有的注解版方案（运行有问题，后面修正） ##

链接：[http://www.yiibai.com/spring-security/secure-spring-rest-api-using-oauth2.html][http_www.yiibai.com_spring-security_secure-spring-rest-api-using-oauth2.html]  
这个链接没说是springmvc或者springboot使用，反正我是用springmvc使用了，可以用，我这里搬过来，同时写上自己的代码。后面会修改。

pom.xml

<properties>
    		<spring.version>4.0.5.RELEASE</spring.version>
    		<jsonlib.version>2.4</jsonlib.version>
    		<spring.security.version>4.0.1.RELEASE</spring.security.version>
    	</properties>
    
    	<dependencies>
    		<dependency>
    			<groupId>junit</groupId>
    			<artifactId>junit</artifactId>
    			<version>4.10</version>
    			<scope>test</scope>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-core</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-aop</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-aspects</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-beans</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context-support</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-expression</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-web</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-webmvc</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context-support</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-orm</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-tx</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-test</artifactId>
    			<version>${spring.version}</version>
    			<scope>test</scope>
    			<exclusions>
    				<exclusion>
    					<groupId>commons-logging</groupId>
    					<artifactId>commons-logging</artifactId>
    				</exclusion>
    			</exclusions>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-core</artifactId>
    			<version>${spring.security.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-web</artifactId>
    			<version>${spring.security.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-config</artifactId>
    			<version>${spring.security.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security.oauth</groupId>
    			<artifactId>spring-security-oauth2</artifactId>
    			<version>2.1.0.RELEASE</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.slf4j</groupId>
    			<artifactId>slf4j-log4j12</artifactId>
    			<version>1.7.5</version>
    		</dependency>
    		<dependency>
    			<groupId>log4j</groupId>
    			<artifactId>log4j</artifactId>
    			<version>1.2.17</version>
    		</dependency>
    		
    
    		
    		<dependency>
    			<groupId>javax.servlet</groupId>
    			<artifactId>jstl</artifactId>
    			<version>1.2</version>
    		</dependency>
    
    		<dependency>
    			<groupId>commons-httpclient</groupId>
    			<artifactId>commons-httpclient</artifactId>
    			<version>3.1</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.codehaus.jackson</groupId>
    			<artifactId>jackson-core-lgpl</artifactId>
    			<version>1.8.1</version>
    		</dependency>
    		<dependency>
    			<groupId>org.codehaus.jackson</groupId>
    			<artifactId>jackson-mapper-lgpl</artifactId>
    			<version>1.8.1</version>
    		</dependency>
    		<dependency>
    			<groupId>net.sf.json-lib</groupId>
    			<artifactId>json-lib</artifactId>
    			<version>${jsonlib.version}</version>
    			<classifier>jdk15</classifier>
    		</dependency>
    		<dependency>
    			<groupId>com.fasterxml.jackson.core</groupId>
    			<artifactId>jackson-annotations</artifactId>
    			<version>2.3.0</version>
    		</dependency>
    		<dependency>
    			<groupId>com.fasterxml.jackson.core</groupId>
    			<artifactId>jackson-core</artifactId>
    			<version>2.3.1</version>
    		</dependency>
    		<dependency>
    			<groupId>com.fasterxml.jackson.core</groupId>
    			<artifactId>jackson-databind</artifactId>
    			<version>2.3.3</version>
    		</dependency>
    		
    
    		
    		<dependency>
    			<groupId>com.thoughtworks.xstream</groupId>
    			<artifactId>xstream</artifactId>
    			<version>1.4.10</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.mybatis</groupId>
    			<artifactId>mybatis</artifactId>
    			<version>3.2.5</version>
    		</dependency>
    		<dependency>
    			<groupId>org.mybatis</groupId>
    			<artifactId>mybatis-spring</artifactId>
    			<version>1.3.0</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>com.alibaba</groupId>
    			<artifactId>druid</artifactId>
    			<version>1.0.20</version>
    		</dependency>
    		<dependency>
    			<groupId>com.oracle</groupId>
    			<artifactId>ojdbc6</artifactId>
    			<version>11.2.2</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>net.sf.ehcache</groupId>
    			<artifactId>ehcache</artifactId>
    			<version>2.10.2</version>
    		</dependency>
    	</dependencies>

### ResourceServer ###

package com.yiibai.springmvc.security;
    
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
    import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
    import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
    import org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler;
    
    @Configuration
    @EnableResourceServer
    public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
    
    	private static final String RESOURCE_ID = "my_rest_api";
    	
    	@Override
    	public void configure(ResourceServerSecurityConfigurer resources) {
    		resources.resourceId(RESOURCE_ID).stateless(false);
    	}
    
    	@Override
    	public void configure(HttpSecurity http) throws Exception {
    		http.
    		anonymous().disable()
    		.requestMatchers().antMatchers("/user/**")
    		.and().authorizeRequests()
    		.antMatchers("/user/**").access("hasRole('ADMIN')")
    		.and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
    	}
    
    }

### AuthorizationServer ###

package com.yiibai.springmvc.security;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Qualifier;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
    import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
    import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
    import org.springframework.security.oauth2.provider.approval.UserApprovalHandler;
    import org.springframework.security.oauth2.provider.token.TokenStore;
    
    @Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
    
    	private static String REALM="MY_OAUTH_REALM";
    	
    	@Autowired
    	private TokenStore tokenStore;
    
    	@Autowired
    	private UserApprovalHandler userApprovalHandler;
    
    	@Autowired
    	@Qualifier("authenticationManagerBean")
    	private AuthenticationManager authenticationManager;
    
    	@Override
    	public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    
    		clients.inMemory()
    	        .withClient("my-trusted-client")
                .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
                .scopes("read", "write", "trust")
                .secret("secret")
                .accessTokenValiditySeconds(120).//Access token is only valid for 2 minutes.
                refreshTokenValiditySeconds(600);//Refresh token is only valid for 10 minutes.
    	}
    
    	@Override
    	public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    		endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
    				.authenticationManager(authenticationManager);
    	}
    
    	@Override
    	public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
    		oauthServer.realm(REALM+"/client");
    	}
    
    }

### OAuth2SecurityConfiguration ###

package com.yiibai.springmvc.security;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.oauth2.provider.ClientDetailsService;
    import org.springframework.security.oauth2.provider.approval.ApprovalStore;
    import org.springframework.security.oauth2.provider.approval.TokenApprovalStore;
    import org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler;
    import org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory;
    import org.springframework.security.oauth2.provider.token.TokenStore;
    import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
    
    @Configuration
    @EnableWebSecurity
    public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    	@Autowired
    	private ClientDetailsService clientDetailsService;
    	
    	@Autowired
        public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication()
            .withUser("bill").password("abc123").roles("ADMIN").and()
            .withUser("bob").password("abc123").roles("USER");
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
    		http
    		.csrf().disable()
    		.anonymous().disable()
    	  	.authorizeRequests()
    	  	.antMatchers("/oauth/token").permitAll();
        }
    
        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }
    
    
    	@Bean
    	public TokenStore tokenStore() {
    		return new InMemoryTokenStore();
    	}
    
    	@Bean
    	@Autowired
    	public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
    		TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
    		handler.setTokenStore(tokenStore);
    		handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
    		handler.setClientDetailsService(clientDetailsService);
    		return handler;
    	}
    	
    	@Bean
    	@Autowired
    	public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
    		TokenApprovalStore store = new TokenApprovalStore();
    		store.setTokenStore(tokenStore);
    		return store;
    	}
    	
    }

### MethodSecurityConfig ###

package com.yiibai.springmvc.security;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
    import org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler;
    
    @Configuration
    @EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
    public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    	@Autowired
    	private OAuth2SecurityConfiguration securityConfig;
    
    	@Override
    	protected MethodSecurityExpressionHandler createExpressionHandler() {
    		return new OAuth2MethodSecurityExpressionHandler();
    	}
    }

### 最后 ###

这样就copy完了，不过springmvc不能用，需要在web.xml加上filter

<filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
      </filter>
      <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
      </filter-mapping>

这样就可以跑起来了，按照http://www.yiibai.com/spring-security/secure-spring-rest-api-using-oauth2.html提供的方法跑，**不过你会发现，总是提示token错误。原因是tokenstore不一致**。这样就不要用@Bean注解了，写在xml里，用@AutoWired就行。

### xml配置tokenstore ###

配置完成后，就可以将OAuth2SecurityConfiguration文件中的tokenstore注掉。

//
    //	@Bean
    //	public TokenStore tokenStore() {
    //		return new InMemoryTokenStore();
    //	}

然后在文件AuthorizationServerConfiguration和ResourceServerConfiguration中的TokenStore @Autowired一下。

@Autowired
    	private TokenStore tokenStore;

### 将clientdetails提到xml中 ###

clientdetails写在代码里，不方便替换，可以写到配置文件中。

<bean id="myClientDetailsService"
    		class="org.springframework.security.oauth2.provider.client.InMemoryClientDetailsService">
    		<property name="clientDetailsStore">
    			<map>
    				<entry key="MwonYjDKBuPtLLlK" value-ref="clientDetails" />
    				<entry key="VJUpAlhdWPbvkpPy" value-ref="clientDetails1" />
    			</map>
    		</property>
    
    	</bean>
    
    	<bean id="clientDetails"
    		class="org.springframework.security.oauth2.provider.client.BaseClientDetails">
    		<property name="clientId" value="MwonYjDKBuPtLLlK" />
    		<property name="clientSecret" value="secret" />
    		<property name="accessTokenValiditySeconds" value="120" />
    		<property name="refreshTokenValiditySeconds" value="600" />
    		<property name="scope">
    			<set>
    				<value>read</value>
    				<value>write</value>
    				<value>trust</value>
    			</set>
    		</property>
    		<property name="authorizedGrantTypes">
    			<set>
    				<value>password</value>
    				<value>authorization_code</value>
    				<value>refresh_token</value>
    				<value>implicit</value>
    			</set>
    		</property>
    		<property name="authorities">
    			<list>
    				<bean
    					class="org.springframework.security.core.authority.SimpleGrantedAuthority">
    					<constructor-arg type="java.lang.String" value="ROLE_CLIENT"></constructor-arg>
    				</bean>
    				<bean
    					class="org.springframework.security.core.authority.SimpleGrantedAuthority">
    					<constructor-arg type="java.lang.String" value="ROLE_TRUSTED_CLIENT"></constructor-arg>
    				</bean>
    			</list>
    		</property>
    	</bean>
    	<bean id="clientDetails1"
    		class="org.springframework.security.oauth2.provider.client.BaseClientDetails">
    		<property name="clientId" value="VJUpAlhdWPbvkpPy" />
    		<property name="clientSecret" value="secret" />
    		<property name="accessTokenValiditySeconds" value="120" />
    		<property name="refreshTokenValiditySeconds" value="600" />
    		<property name="scope">
    			<set>
    				<value>read</value>
    				<value>write</value>
    				<value>trust</value>
    			</set>
    		</property>
    		<property name="authorizedGrantTypes">
    			<set>
    				<value>password</value>
    				<value>authorization_code</value>
    				<value>refresh_token</value>
    				<value>implicit</value>
    			</set>
    		</property>
    		<property name="authorities">
    			<list>
    				<bean
    					class="org.springframework.security.core.authority.SimpleGrantedAuthority">
    					<constructor-arg type="java.lang.String" value="ROLE_CLIENT"></constructor-arg>
    				</bean>
    				<bean
    					class="org.springframework.security.core.authority.SimpleGrantedAuthority">
    					<constructor-arg type="java.lang.String" value="ROLE_TRUSTED_CLIENT"></constructor-arg>
    				</bean>
    			</list>
    		</property>
    	</bean>

下一篇介绍如何替换其他东西和一些页面问题。

[https_gitee.com_ffch_OauthUmp]: https://gitee.com/ffch/OauthUmp
[spring Security4 _ oauth2_ _xml]: http://blog.csdn.net/feiyangtianyao/article/details/78687161
[spring Security4 _ oauth2_ _xml 1]: http://blog.csdn.net/feiyangtianyao/article/details/78687403
[spring Security4 _ oauth2_ _xml 2]: http://blog.csdn.net/feiyangtianyao/article/details/78687569
[spring Security4 _ oauth2_ _xml 3]: http://blog.csdn.net/feiyangtianyao/article/details/78687700
[spring Security4 _ oauth2_ _xml_6]: http://blog.csdn.net/feiyangtianyao/article/details/78721818
[spring Security4 _ oauth2_ _xml 4]: http://blog.csdn.net/feiyangtianyao/article/details/78727949
[spring Security4 _ oauth2_ _xml 5]: http://blog.csdn.net/feiyangtianyao/article/details/78728147
[http_www.yiibai.com_spring-security_secure-spring-rest-api-using-oauth2.html]: http://www.yiibai.com/spring-security/secure-spring-rest-api-using-oauth2.html