spring security oauth2 gitee 授权登录

太过爱你忘了你带给我的痛 2023-03-14 05:47 3阅读 0赞

--------------------

### spring security oauth2 gitee 授权登录 ###

**官网：[https://gitee.com/api/v5/oauth\_doc\#/][https_gitee.com_api_v5_oauth_doc]**

### \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ###

**相关类及接口**

**OAuth2AccessTokenResponseClient：使用授权码code获取accessToken**

@FunctionalInterface
    public interface OAuth2AccessTokenResponseClient<T extends AbstractOAuth2AuthorizationGrantRequest> {
        OAuth2AccessTokenResponse getTokenResponse(T var1);
    }

**DefaultOAuth2AccessTokenResponseClient：默认可获取github、facebook、google、okta的acessToken，其他需自定义实现方法**

public final class DefaultAuthorizationCodeTokenResponseClient implements OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> {
        private static final String INVALID_TOKEN_RESPONSE_ERROR_CODE = "invalid_token_response";
        private Converter<OAuth2AuthorizationCodeGrantRequest, RequestEntity<?>> requestEntityConverter = new OAuth2AuthorizationCodeGrantRequestEntityConverter();
        private RestOperations restOperations;
    
        public DefaultAuthorizationCodeTokenResponseClient() {
            RestTemplate restTemplate = new RestTemplate(Arrays.asList(new FormHttpMessageConverter(), new OAuth2AccessTokenResponseHttpMessageConverter()));
            restTemplate.setErrorHandler(new OAuth2ErrorResponseErrorHandler());
            this.restOperations = restTemplate;
        }
    
        public OAuth2AccessTokenResponse getTokenResponse(OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest) {
            Assert.notNull(authorizationCodeGrantRequest, "authorizationCodeGrantRequest cannot be null");
            RequestEntity request = (RequestEntity)this.requestEntityConverter.convert(authorizationCodeGrantRequest);
    
            ResponseEntity response;
            try {
                response = this.restOperations.exchange(request, OAuth2AccessTokenResponse.class);
            } catch (RestClientException var6) {
                OAuth2Error oauth2Error = new OAuth2Error("invalid_token_response", "An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: " + var6.getMessage(), (String)null);
                throw new OAuth2AuthorizationException(oauth2Error, var6);
            }
    
            OAuth2AccessTokenResponse tokenResponse = (OAuth2AccessTokenResponse)response.getBody();
            if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
                tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse).scopes(authorizationCodeGrantRequest.getClientRegistration().getScopes()).build();
            }
    
            return tokenResponse;
        }
    
        public void setRequestEntityConverter(Converter<OAuth2AuthorizationCodeGrantRequest, RequestEntity<?>> requestEntityConverter) {
            Assert.notNull(requestEntityConverter, "requestEntityConverter cannot be null");
            this.requestEntityConverter = requestEntityConverter;
        }
    
        public void setRestOperations(RestOperations restOperations) {
            Assert.notNull(restOperations, "restOperations cannot be null");
            this.restOperations = restOperations;
        }
    }

**OAuth2UserService：获取用户接口**

@FunctionalInterface
    public interface OAuth2UserService<R extends OAuth2UserRequest, U extends OAuth2User> {
        U loadUser(R var1) throws OAuth2AuthenticationException;
    }

**DefaultOAuth2UserService：默认可加载github、google、facebook、okta，其他需自定义实现**

public class DefaultOAuth2UserService implements OAuth2UserService<OAuth2UserRequest, OAuth2User> {
        private static final String MISSING_USER_INFO_URI_ERROR_CODE = "missing_user_info_uri";
        private static final String MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE = "missing_user_name_attribute";
        private static final String INVALID_USER_INFO_RESPONSE_ERROR_CODE = "invalid_user_info_response";
        private static final ParameterizedTypeReference<Map<String, Object>> PARAMETERIZED_RESPONSE_TYPE = new ParameterizedTypeReference<Map<String, Object>>() {
        };
        private Converter<OAuth2UserRequest, RequestEntity<?>> requestEntityConverter = new OAuth2UserRequestEntityConverter();
        private RestOperations restOperations;
    
        public DefaultOAuth2UserService() {
            RestTemplate restTemplate = new RestTemplate();
            restTemplate.setErrorHandler(new OAuth2ErrorResponseErrorHandler());
            this.restOperations = restTemplate;
        }
    
        public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
            Assert.notNull(userRequest, "userRequest cannot be null");
            if (!StringUtils.hasText(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri())) {
                OAuth2Error oauth2Error = new OAuth2Error("missing_user_info_uri", "Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: " + userRequest.getClientRegistration().getRegistrationId(), (String)null);
                throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
            } else {
                String userNameAttributeName = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName();
                if (!StringUtils.hasText(userNameAttributeName)) {
                    OAuth2Error oauth2Error = new OAuth2Error("missing_user_name_attribute", "Missing required \"user name\" attribute name in UserInfoEndpoint for Client Registration: " + userRequest.getClientRegistration().getRegistrationId(), (String)null);
                    throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
                } else {
                    RequestEntity request = (RequestEntity)this.requestEntityConverter.convert(userRequest);
    
                    ResponseEntity response;
                    OAuth2Error oauth2Error;
                    try {
                        response = this.restOperations.exchange(request, PARAMETERIZED_RESPONSE_TYPE);
                    } catch (OAuth2AuthorizationException var10) {
                        oauth2Error = var10.getError();
                        StringBuilder errorDetails = new StringBuilder();
                        errorDetails.append("Error details: [");
                        errorDetails.append("UserInfo Uri: ").append(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri());
                        errorDetails.append(", Error Code: ").append(oauth2Error.getErrorCode());
                        if (oauth2Error.getDescription() != null) {
                            errorDetails.append(", Error Description: ").append(oauth2Error.getDescription());
                        }
    
                        errorDetails.append("]");
                        oauth2Error = new OAuth2Error("invalid_user_info_response", "An error occurred while attempting to retrieve the UserInfo Resource: " + errorDetails.toString(), (String)null);
                        throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), var10);
                    } catch (RestClientException var11) {
                        oauth2Error = new OAuth2Error("invalid_user_info_response", "An error occurred while attempting to retrieve the UserInfo Resource: " + var11.getMessage(), (String)null);
                        throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), var11);
                    }
    
                    Map<String, Object> userAttributes = (Map)response.getBody();
                    Set<GrantedAuthority> authorities = new LinkedHashSet();
                    authorities.add(new OAuth2UserAuthority(userAttributes));
                    OAuth2AccessToken token = userRequest.getAccessToken();
                    Iterator var8 = token.getScopes().iterator();
    
                    while(var8.hasNext()) {
                        String authority = (String)var8.next();
                        authorities.add(new SimpleGrantedAuthority("SCOPE_" + authority));
                    }
    
                    return new DefaultOAuth2User(authorities, userAttributes, userNameAttributeName);
                }
            }
        }
    
        public final void setRequestEntityConverter(Converter<OAuth2UserRequest, RequestEntity<?>> requestEntityConverter) {
            Assert.notNull(requestEntityConverter, "requestEntityConverter cannot be null");
            this.requestEntityConverter = requestEntityConverter;
        }
    
        public final void setRestOperations(RestOperations restOperations) {
            Assert.notNull(restOperations, "restOperations cannot be null");
            this.restOperations = restOperations;
        }
    }

### \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ###

**示例**

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**配置文件**

**application.yml**

spring:
      security:
        oauth2:
          client:
            registration:
              gitee:
                provider: gitee
                client-id: ******
                client-secret: ******
                authorization-grant-type: "authorization_code"
                redirect-uri: "{baseUrl}/{action}/oauth2/code/{registrationId}"
                client-name: gitee
                scope: user_info
            provider:
              gitee:
                authorization-uri: https://gitee.com/oauth/authorize
                token-uri: https://gitee.com/oauth/token
                user-info-uri: https://gitee.com/api/v5/user
                user-name-attribute: "name"

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**service 层**

**GiteeOAuth2User：自定义gitee用户**

public class GiteeOAuth2User implements OAuth2User {
    
        private String id;
        private String name;
        private String email;
    
        private List<GrantedAuthority> authorities= AuthorityUtils.createAuthorityList("ROLE_USER");
        private Map<String,Object> attributes;
    
        public String getId() {
            return id;
        }
    
        public void setId(String id) {
            this.id = id;
        }
    
        public void setName(String name) {
            this.name = name;
        }
    
        public String getEmail() {
            return email;
        }
    
        public void setEmail(String email) {
            this.email = email;
        }
    
        @Override
        public String getName() {
            return this.name;
        }
    
        @Override
        public Collection<? extends GrantedAuthority> getAuthorities() {
            return this.authorities;
        }
    
        @Override
        public Map<String, Object> getAttributes() {
            if (attributes==null){
                attributes=new HashMap<>();
    
                attributes.put("id",this.getId());
                attributes.put("name",this.getName());
                attributes.put("email",this.getEmail());
            }
    
            return attributes;
        }
    }

**GiteeOAuth2AccessTokenResponseClient**

@Component
    public class GiteeOAuth2AccessTokenResponseClient implements OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> {
    
        @Resource
        private RestTemplate restTemplate;
    
        @Override
        public OAuth2AccessTokenResponse getTokenResponse(OAuth2AuthorizationCodeGrantRequest oAuth2AuthorizationCodeGrantRequest) {
            ClientRegistration clientRegistration=oAuth2AuthorizationCodeGrantRequest.getClientRegistration();
            OAuth2AuthorizationExchange oAuth2AuthorizationExchange=oAuth2AuthorizationCodeGrantRequest.getAuthorizationExchange();
    
            Map<String,String> params=new HashMap<>();
            params.put("client_id",clientRegistration.getClientId());
            params.put("client_secret",clientRegistration.getClientSecret());
            params.put("grant_type",clientRegistration.getAuthorizationGrantType().getValue());
            params.put("code",oAuth2AuthorizationExchange.getAuthorizationResponse().getCode());
            params.put("redirect_uri",oAuth2AuthorizationExchange.getAuthorizationResponse().getRedirectUri());
    
            HttpHeaders httpHeaders=new HttpHeaders();
            httpHeaders.add("User-Agent","Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36");
    
            HttpEntity<Map<String,String>> entity=new HttpEntity<>(params,httpHeaders);
    
            String accessTokenResponse=restTemplate.postForObject(clientRegistration.getProviderDetails().getTokenUri(), entity,String.class);
    
            JSONObject object= JSONObject.parseObject(accessTokenResponse);
            String accessToken=object.getString("access_token");
            String refresh_token=object.getString("refresh_token");
            String expires_in=object.getString("expires_in");
    
            return OAuth2AccessTokenResponse.withToken(accessToken)
                    .refreshToken(refresh_token)
                    .expiresIn(Long.parseLong(expires_in))
                    .tokenType(OAuth2AccessToken.TokenType.BEARER)
                    .scopes(oAuth2AuthorizationExchange.getAuthorizationRequest().getScopes())
                    .build();
        }
    }

**GiteeOAuth2UserService**

@Service
    public class GiteeOAuth2UserService implements OAuth2UserService<OAuth2UserRequest, OAuth2User> {
    
        @Resource
        private RestTemplate restTemplate;
    
        @Override
        public OAuth2User loadUser(OAuth2UserRequest oAuth2UserRequest) throws OAuth2AuthenticationException {
            String access_token=oAuth2UserRequest.getAccessToken().getTokenValue();
            System.out.println(access_token);
    
            Map<String,String> params=new HashMap<>();
            params.put("access_token",access_token);
    
            HttpHeaders httpHeaders=new HttpHeaders();
            httpHeaders.add("User-Agent","Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36");
    
            HttpEntity<Object> entity=new HttpEntity<>(httpHeaders);
    
            String url=oAuth2UserRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri()+
                    "?access_token={access_token}";
    
            return restTemplate.exchange(url, HttpMethod.GET,entity, GiteeOAuth2User.class,params).getBody();
        }
    }

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**config 层**

**WebConfig**

@Configuration
    public class WebConfig implements WebMvcConfigurer {
    
        @Override
        public void addViewControllers(ViewControllerRegistry registry) {
            registry.addViewController("/login/gitee").setViewName("login.html");
        }
    
        @Bean
        public RestTemplate initRestTemplate(){
            return new RestTemplate();
        }
    }

**WebSecurityConfig**

@Configuration
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Resource
        private UserService userService;
    
        @Resource
        private GiteeOAuth2AccessTokenResponseClient accessTokenResponseClient;
    
        @Resource
        private GiteeOAuth2UserService oAuth2UserService;
    
        @Bean
        public PasswordEncoder initPasswordEncoder(){
            return new BCryptPasswordEncoder();
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.formLogin().loginPage("/login/gitee").loginProcessingUrl("/login/form")
                    .and()
                    .authorizeRequests()
                    .antMatchers("/hello").hasAnyAuthority("ROLE_USER")
                    .antMatchers("/**").permitAll()
                    .and()
                    .logout().deleteCookies("JSESSIONID")
                    .logoutSuccessUrl("/").permitAll();
    
            http.oauth2Login().loginPage("/login/gitee")
                    .tokenEndpoint().accessTokenResponseClient(accessTokenResponseClient)
                    .and()
                    .userInfoEndpoint().customUserType(GiteeOAuth2User.class,"gitee")
                    .userService(oAuth2UserService);
        }
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userService).passwordEncoder(initPasswordEncoder());
        }
    
    }

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**controller 层**

**HelloController**

@RestController
    public class HelloController {
    
        @RequestMapping("/hello")
        public String hello(Principal principal){
            System.out.println(principal.toString());
    
            return "hello "+principal.getName();
        }
    
        @RequestMapping("/")
        public String redirect(){
            return "redirect";
        }
    }

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**前端页面**

<!DOCTYPE html>
    <html lang="en" xmlns="http://www.w3.org/1999/xhtml"
          xmlns:th="http://www.thymeleaf.org" xmlns:sec="https://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
    <head>
        <meta charset="UTF-8">
        <title>Title</title>
    </head>
    <body>
    <form th:action="@{/login/form}" th:align="center" method="post">
        username:<input th:type="text" name="username"><br>
        password:<input th:type="text" name="password"><br>
        <button>提交</button>
    </form>
    
    <div th:align="center">
        <a th:href="@{/oauth2/authorization/gitee}">gitee</a>
    </div>
    </body>
    </html>

### \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ###

**使用测试**

**localhost:8080/hello**

![20200520192623455.png][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70][]

**同意授权后，输出：hello lihu12344**

[https_gitee.com_api_v5_oauth_doc]: https://gitee.com/api/v5/oauth_doc#/
[20200520192623455.png]: /images/20230312/67e5d471732e459283e19fa7614ef634.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70]: /images/20230312/5a2db4c45d9c42859166ba6369a5fa77.png