spring cloud oauth2 授权码认证

分手后的思念是犯贱 2023-07-03 07:27 22阅读 0赞

--------------------

### spring cloud oauth2 授权码认证 ###

### \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ###

**认证服务器：authorization-server**

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**配置文件**

spring:
      application:
        name: authorization-server
    
    server:
      port: 8081

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**service 层**

@Service
    public class UserService implements UserDetailsService {
    
        @Resource
        private PasswordEncoder passwordEncoder;
    
        @Override
        public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
            String name="gtlx";
            String password=passwordEncoder.encode("123456");
            String role="admin";
    
            List<SimpleGrantedAuthority> list=new ArrayList<>();
            list.add(new SimpleGrantedAuthority(role));
    
            return new User(name,password,list);
        }
    }

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**config 层**

**WebSecurityConfig：web安全配置**

@Configuration
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Bean
        public PasswordEncoder initPasswordEncoder(){
            return new BCryptPasswordEncoder();
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.formLogin().and().authorizeRequests()
                    .antMatchers("/**").permitAll();
        }
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication()
                    .withUser("gtlx")
                    .password(initPasswordEncoder().encode("123456"))
                    .authorities("admin");
        }
    }

**OAuth2AuthorizationServerConfig：****认证服务器配置**

@Configuration
    @EnableAuthorizationServer
    public class OAuth2AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    
        @Resource
        private UserService userService;
    
        @Resource
        private PasswordEncoder passwordEncoder;
    
        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.userDetailsService(userService);
        }
    
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory().withClient("user")
                    .secret(passwordEncoder.encode("123456"))
                    .authorizedGrantTypes("authorization_code","refresh_token")
                    .redirectUris("http://localhost:8082/redirect")
                    .accessTokenValiditySeconds(3000)
                    .refreshTokenValiditySeconds(3000)
                    .autoApprove(true)
                    .scopes("user");
        }
    
        @Override
        public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
            security.allowFormAuthenticationForClients()
                    .tokenKeyAccess("permitAll()")
                    .checkTokenAccess("isAuthenticated()");
        }
    }

### \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ###

**资源服务器：resource-server**

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**配置文件**

spring:
      application:
        name: resource-server
    server:
      port: 8082
    
    security:
      oauth2:
        client:
          client-id: user
          client-secret: 123456
          user-authorization-uri: http://localhost:8081/oauth/authorize
          access-token-uri: http://localhost:8081/oauth/token
        resource:
          id: user
          token-info-uri: http://localhost:8081/oauth/check_token

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**config 层**

@Configuration
    @EnableResourceServer
    public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests().antMatchers("/hello").hasAuthority("admin")
                    .antMatchers("/hello2").hasAuthority("user")
                    .antMatchers("/redirect").permitAll();
        }
    }

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**controller 层**

@RestController
    public class HelloController {
    
        @Value("${security.oauth2.client.access-token-uri}")
        private String accessTokenUri;
    
        @RequestMapping("/hello")
        public String hello(){
            return "hello world";
        }
    
        @RequestMapping("/hello2")
        public String hello2(){
            return  "hello 瓜田李下";
        }
    
        @RequestMapping("/redirect") //获取授权码时的回调地址，使用获得的授权码获取access_token
        public Map get(@RequestParam(value = "code") String code){
            OkHttpClient httpClient=new OkHttpClient();
    
            RequestBody requestBody=new FormBody.Builder()
                    .add("grant_type","authorization_code")
                    .add("client","user")
                    .add("redirect_uri","http://localhost:8082/redirect")
                    .add("code",code)
                    .build();
    
            Request request=new Request.Builder()
                    .url(accessTokenUri)
                    .post(requestBody)
                    .addHeader("Authorization","Basic dXNlcjoxMjM0NTY=")
                    .build();
    
            Map result=null;
    
            try {
                Response response=httpClient.newCall(request).execute();
                System.out.println(response);
    
                ObjectMapper objectMapper=new ObjectMapper();
                result=objectMapper.readValue(Objects.requireNonNull(response.body()).string(),Map.class);
    
                System.out.println("access_token："+result.get("access_token"));
                System.out.println("token_type："+result.get("token_type"));
                System.out.println("refresh_token："+result.get("refresh_token"));
                System.out.println("expires_in："+result.get("expires_in"));
                System.out.println("scope："+result.get("scope"));
            }catch (Exception e){
                System.out.println(e.getMessage());
            }
    
            return result;
        }
    }

**说明：获取授权码后需要设置redirect\_uri，且需要与获取授权码时的redirect\_uri地址一致，否则会报错**

"error": "invalid_grant","error_description": "Redirect URI mismatch."

### \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ###

**使用测试**

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**获取授权码**

**localhost:8081/oauth/authorize?client\_id=user&response\_type=code&redirect\_uri=http//localhost:8082/redirect**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70][]

**client的属性****autoApprove**：**false**手动授权，**true**自动授权

![20200205165918690.png][]

**获取授权后跳转到回调地址：http://localhost:8082/redirect**

![20200205171004978.png][]

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**refresh token操作**

**localhost:8081/oauth/token**

**查询参数：grant\_type=refresh\_token&refresh\_token=86ba104c-7d96-4f0b-bcde-161cb12dbb4e**

**header：key：Authorization，value：Basic dXNlcjoxMjM0NTY=**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70 1][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70 2][]

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**获取数据**

**localhsot:8082/hello**

**header：key：Authorization，value：bearer 36c6a366-bfa1-462d-bf27-8c88c0893c45**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70 3][]

**localhost:8082/hello2**

**header：key：Authorization，value：bearer 36c6a366-bfa1-462d-bf27-8c88c0893c45**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70 4][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200205165906192.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ==,size_16,color_FFFFFF,t_70
[20200205165918690.png]: https://img-blog.csdnimg.cn/20200205165918690.png
[20200205171004978.png]: https://img-blog.csdnimg.cn/20200205171004978.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200205171205749.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200205171232596.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200205171409192.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/2020020517180559.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzkzMTYyNQ==,size_16,color_FFFFFF,t_70