springBoot集成spring-security-oauth2实现基于token的登录退出及权限控制

妖狐艹你老母 2022-08-29 05:46 324阅读 0赞

1.  oauth2 分为授权服务 和 资源服务。由授权服务颁布的令牌来访问资源服务
2.  我们通过授权服务的 /oauth/token 获取到token,并将权限用户信息缓存至TokenStore中。
3.  而我们所写的api就属于资源服务里的内容。需要拿到授权服务颁布的令牌access\_token来访问。

### 实战步骤 ###

### 1. 引入开发包 ###

<dependency>
                <groupId>org.springframework.security.oauth</groupId>
                <artifactId>spring-security-oauth2</artifactId>
                <version>2.3.5.RELEASE</version>
            </dependency>

### 2. 配置授权服务 ###

package com.liuzhiqiang.security.confing.oauth;
    
    import com.fasterxml.jackson.databind.ObjectMapper;
    import com.liuzhiqiang.security.vo.AjaxResult;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.HttpStatus;
    import org.springframework.security.authentication.AuthenticationProvider;
    import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
    import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
    import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
    import org.springframework.security.oauth2.provider.token.TokenStore;
    import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
    
    import javax.servlet.http.HttpServletResponse;
    import java.io.PrintWriter;
    
    /** * @author 刘志强 * @title: OAuth2Config * @projectName housekeeper-data-center-back * @description: TODO * @date 2021/7/2919:50 */
    @Configuration
    // 启用授权服务
    @EnableAuthorizationServer
    @Slf4j
    public class OAuth2Config extends AuthorizationServerConfigurerAdapter { 
    
        /** * token 对应权限信息的存储 */
        @Autowired
        private TokenStore tokenStore;
        @Autowired
        private UserDetailsServiceImpl userDetailsService;
        /** * 密码的校验方式 */
        @Autowired
        private PasswordEncoder passwordEncoder;
        @Autowired
        private HttpServletResponse httpServletResponse;
    
        /** * 创建一个 token商店， * InMemoryTokenStore 基于内存，token对应的权限信息会存储到inMemoryTokenStore对象中 * * @return */
        @Bean(name = "tokenStore")
        public TokenStore tokenStore() { 
            InMemoryTokenStore inMemoryTokenStore = new InMemoryTokenStore();
            return inMemoryTokenStore;
        }
    
        /** * 授权服务配置 * tokenStore 登录后 最终将权限信息存入tokenStore。 * authenticationManager 配置 身份验证管理器。登陆时查询用户权限信息，密码加密方式验证 * exceptionTranslator 登录异常时的处理器 * * @param endpoints */
        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) { 
            endpoints.tokenStore(tokenStore)
                    // 自定义 身份验证管理器
                    .authenticationManager(authentication -> { 
                        log.info("authentication:{}", authentication);
                        return authenticationProvider().authenticate(authentication);
                    })
                    .exceptionTranslator(e -> { 
                        httpServletResponse.setContentType("application/json;charset=utf-8");
                        PrintWriter out;
                        out = httpServletResponse.getWriter();
                        out.write(new ObjectMapper().writeValueAsString(AjaxResult.error(HttpStatus.UNAUTHORIZED.value(), e.getMessage())));
                        out.flush();
                        out.close();
                        return null;
                    })
                    // 这里还要配置userDetailsService 是因为刷新token时还需要
                    .userDetailsService(userDetailsService);
        }
    
    
        /** * 配置客户端信息 * 当用户访问/oauth/token 接口时，需要的Authorization 信息，grant_type方式等 * 如: /oauth/token?username=admin&password=1234562&grant_type=password&scope=ALL * Authorization Basic bGl1emhpcWlhbmc6MTIz * bGl1emhpcWlhbmc6MTIz 是 liuzhiqiang 和 123 Basic编码 * * @param clients * @throws Exception */
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
            clients.inMemory()
                    .withClient("liuzhiqiang")
                    .secret(passwordEncoder.encode("123"))
                    .scopes("ALL")
                    .authorizedGrantTypes("refresh_token", "password")
                    .accessTokenValiditySeconds(36000);
        }
    
        /** * 配置权限服务的安全配置 * /oauth/check_token 需要认证访问 * * @param authorizationServer */
        @Override
        public void configure(AuthorizationServerSecurityConfigurer authorizationServer) { 
            authorizationServer
                    .checkTokenAccess("isAuthenticated()");
        }
    
        /** * 密码编码器 * * @return */
        @Bean
        PasswordEncoder passwordEncoder() { 
            return new BCryptPasswordEncoder(10);
        }
    
        /** * 自定义AuthenticationProvider * * @return */
        @Bean(name = "authenticationProvider")
        public AuthenticationProvider authenticationProvider() { 
            DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
            daoAuthenticationProvider.setUserDetailsService(userDetailsService);
            daoAuthenticationProvider.setPasswordEncoder(passwordEncoder);
            return daoAuthenticationProvider;
        }
    
    }

##### 1. 配置客户端信息 #####

public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
            clients.inMemory()
                    .withClient("liuzhiqiang")
                    .secret(passwordEncoder.encode("123"))
                    .scopes("ALL")
                    .authorizedGrantTypes("refresh_token", "password")
                    .accessTokenValiditySeconds(36000)
                    .and()
                    .withClient("wangYan")
                    .secret(passwordEncoder.encode("123"))
                    .scopes("USER")
                    .authorizedGrantTypes("refresh_token", "password")
                    .accessTokenValiditySeconds(36000);
        }

1.  定义声明客户端。是访问 /oauth/token 接口时需要的信息。保护/oauth/token接口.像这样定义两个客户端用户（liuzhiqiang 和 wangYan）liuzhiqiang 的授权范围时ALL，wangYan的授权范围是USER。授权类型都是密码。有效期36000秒
2.  关于scopes，  
    scopes是 OAuth 2.0 中的一种机制，用于限制应用程序对用户帐户的访问。应用程序可以请求一个或多个范围，然后该信息会在同意屏幕中呈现给用户，并且颁发给应用程序的访问令牌将仅限于授予的范围。
    
    OAuth 规范允许授权服务器或用户根据请求修改授予应用程序的范围，尽管在实践中这样做的服务示例并不多。
    
    OAuth 没有为范围定义任何特定值，因为它高度依赖于服务的内部架构和需求。  
    总的来说 需求没必要就用不到

##### 2. 配置授权服务的服务安全 AuthorizationServerSecurityConfigurer #####

public void configure(AuthorizationServerSecurityConfigurer authorizationServer) { 
            authorizationServer
                    .checkTokenAccess("permitAll()");
        }

1.  配置了 check\_token 可以匿名访问，也就是无需携带令牌，此令牌不是/oauth/token接口返回的令牌。是访问授权服务定义的客户端信息（withClient 和 secret 的 Base64加密.示例：“liuzhiqiang 123” 的Base64加密 ）  
    ![在这里插入图片描述][f84aebd073d44cce8f78b599f9371fb0.png_pic_center]

##### 3. 授权服务配置 #####

@Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
            endpoints.tokenStore(tokenStore)
                    // 自定义 身份验证管理器
                    .authenticationManager(authentication -> {
                        log.info("authentication:{}", authentication);
                        return authenticationProvider().authenticate(authentication);
                    })
                    .exceptionTranslator(e -> {
                        httpServletResponse.setContentType("application/json;charset=utf-8");
                        PrintWriter out;
                        out = httpServletResponse.getWriter();
                        out.write(new ObjectMapper().writeValueAsString(AjaxResult.error(HttpStatus.UNAUTHORIZED.value(), e.getMessage())));
                        out.flush();
                        out.close();
                        return null;
                    })
                    // 这里还要配置userDetailsService 是因为刷新token时还需要
                    .userDetailsService(userDetailsService);
        }
        @Bean(name = "tokenStore")
        public TokenStore tokenStore() {
            InMemoryTokenStore inMemoryTokenStore = new InMemoryTokenStore();
            return inMemoryTokenStore;
        }
        
        @Bean(name = "authenticationProvider")
        public AuthenticationProvider authenticationProvider() {
            DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
            daoAuthenticationProvider.setUserDetailsService(userDetailsService);
            daoAuthenticationProvider.setPasswordEncoder(passwordEncoder);
            return daoAuthenticationProvider;
        }

1.  tokenStore(tokenStore) 定义授权服务的数据(用户信息，权限信息等)存储
2.  TokenStore 分为基于redis jwt 和 jvm内存类型，本示例中使用基于内存
3.  authenticationManager 自定义 身份验证管理器。当调用/oauth/token 接口时，会先进入这里执行身份验证程序，身份验证通过会将身份绑定至tokenStore中。
4.  身份验证程序daoAuthenticationProvider 绑定userDetailsService 及 密码验证方式
5.  /oauth/token 对应的类 org.springframework.security.oauth2.provider.endpoint.TokenEndpoint
6.  TokenEndpoint 定义了/oauth/token 接口， 和异常处理，在捕获异常时会调用 return this.getExceptionTranslator().translate(e); 异常转换器转换异常。

@ExceptionHandler({HttpRequestMethodNotSupportedException.class})
        public ResponseEntity<OAuth2Exception> handleHttpRequestMethodNotSupportedException(HttpRequestMethodNotSupportedException e) throws Exception {
            if (this.logger.isInfoEnabled()) {
                this.logger.info("Handling error: " + e.getClass().getSimpleName() + ", " + e.getMessage());
            }
    
            return this.getExceptionTranslator().translate(e);
        }

1.  .exceptionTranslator() 自定义异常转换器

### 3. 配置资源服务 ###

当授权服务启用后，/oauth/token接口就已经可以访问了。返回token并将用户信息存储至TokenStore中

##### 1. 启动资源服务并开启注解模式 #####

// 启用资源服务
    @EnableResourceServer
    // 开启注解形式控制
    @EnableGlobalMethodSecurity(prePostEnabled = true)

##### 2. 配置资源服务的安全 #####

@Override
        public void configure(ResourceServerSecurityConfigurer resourceServerSecurityConfigurer) { 
            resourceServerSecurityConfigurer.tokenStore(tokenStore);
            resourceServerSecurityConfigurer.authenticationEntryPoint(this::commence);
        }

1.  配置资源服务进行认证鉴权时的数据来源，定义鉴权时的异常处理

##### 3. 定义资源服务安全策略 #####

@Override
        public void configure(HttpSecurity httpSecurity) throws Exception {
            httpSecurity
                    // 配置接口访问策略信息
                    .authorizeRequests()
                    // /test3 可以匿名访问
                    .antMatchers("/test3").permitAll()
                    //任何请求都需要身份认证
                    .anyRequest().authenticated()
                    // 配置异常处理器
                    .and()
                    .exceptionHandling()
                    .authenticationEntryPoint(this::commence)
    
                    .and()
                    .csrf()
                    .disable();    //禁用CSRF
        }

### /oauth/token postman 贴图 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center]

### [代码][Link 1] ###

##### 授权服务接口跨域问题,使用过滤器解决 #####

package com.liuzhiqiang.security.confing.oauth;
    
    import org.springframework.context.annotation.Configuration;
    import org.springframework.core.Ordered;
    import org.springframework.core.annotation.Order;
    
    import javax.servlet.*;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    
    /** * @author 24253 */
    @Order(Ordered.HIGHEST_PRECEDENCE)
    @Configuration
    public class CORSFilter implements Filter { 
    
        @Override
        public void init(FilterConfig filterConfig) { 
    
        }
    
        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { 
            HttpServletRequest request = (HttpServletRequest) servletRequest;
            HttpServletResponse response = (HttpServletResponse) servletResponse;
            response.setHeader("Access-Control-Allow-Origin", "*");
            response.setHeader("Access-Control-Allow-Credentials", "true");
            response.setHeader("Access-Control-Allow-Methods", "POST,GET,OPTIONS,PUT,DELETE,PATCH,HEAD");
            response.setHeader("Access-Control-Allow-Max-Age", "3600");
            response.setHeader("Access-Control-Allow-Headers", "*");
            if ("OPTIONS".equalsIgnoreCase(request.getMethod())) { 
                response.setStatus(HttpServletResponse.SC_OK);
            } else { 
                filterChain.doFilter(servletRequest, servletResponse);
            }
        }
    
        @Override
        public void destroy() { 
    
        }
    }

##### 定义 /oauth/token 接口返回的数据格式，使用aop切面，改变响应值 #####

package com.liuzhiqiang.security.confing.aop;
    
    import com.liuzhiqiang.security.vo.AjaxResult;
    import lombok.extern.slf4j.Slf4j;
    import org.aspectj.lang.ProceedingJoinPoint;
    import org.aspectj.lang.annotation.Around;
    import org.aspectj.lang.annotation.Aspect;
    import org.springframework.http.ResponseEntity;
    import org.springframework.stereotype.Component;
    
    /** * @author 刘志强 * @title: AuthTokenAspect * @projectName housekeeper-data-center-back * @description: TODO * @date 2021/7/3122:59 * 切入 /oauth/token方法，改变返回值 */
    
    @Aspect
    @Component
    @Slf4j
    public class AuthTokenAspect { 
    
        @Around("execution(* org.springframework.security.oauth2.provider.endpoint.TokenEndpoint.postAccessToken(..))")
        public Object handleControllerMethod(ProceedingJoinPoint pjp) throws Throwable { 
            Object proceed = pjp.proceed();
            return ResponseEntity.ok(AjaxResult.successData(((ResponseEntity) proceed).getBody()));
        }
    
    }

##### 如何退出 #####

@GetMapping("/exit")
        public String exit() { 
            log.info("当前登录用户：{}", SecurityContextHolder.getContext().getAuthentication());
            String token = httpServletRequest.getHeader("Authorization");
            token = token.replace("Bearer ", "");
            consumerTokenServices.revokeToken(token);
            log.info("当前登录用户：{}", SecurityContextHolder.getContext().getAuthentication());
            return "已退出，token已清除";
        }

##### 如何刷新 #####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center 1]

[f84aebd073d44cce8f78b599f9371fb0.png_pic_center]: /images/20220829/c6ad48dc06c34d138245f0bcc7007754.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center]: /images/20220829/d8fe1ed447a34d56b5706266ad360343.png
[Link 1]: https://gitee.com/lzq199528/springboot
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2x6cTE5OTUyOA_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20220829/e9317baa94944544b3399757c4acec5a.png