OAuth2.0 实践 Spring Authorization Server 搭建授权服务器 + Resource + Client

迷南。 2023-09-25 14:58 52阅读 0赞

--------------------

title: OAuth2.0 实践 Spring Authorization Server 搭建授权服务器 + Resource + Client  
date: 2023-03-27 01:41:26  
tags:

*  OAuth2.0
 *  Spring Authorization Server  
    categories:
 *  开发实践  
    cover: https://cover.png  
    feature: false

--------------------

## 1. 授权服务器 ##

目前 Spring 生态中的 OAuth2 授权服务器是 **Spring Authorization Server**，原先的 **Spring Security OAuth** 已经停止更新

### 1.1 引入依赖 ###

这里的 `spring-security-oauth2-authorization-server` 用的是 0.4.0 版本，适配 JDK 1.8，Spring Boot 版本为 2.7.7

<dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-oauth2-authorization-server</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-thymeleaf</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-jdbc</artifactId>
            </dependency>
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
            </dependency>
    </dependencies>

### 1.2 配置类 ###

**可以参考官方的 Samples：[spring-authorization-server/samples][spring-authorization-server_samples]**

#### 1.2.1 最小配置 ####

**官网最小配置 Demo 地址：[Getting Started][]**

官网最小配置如下，通过添加该配置类，启动项目，这就能够完成 OAuth2 的授权

@Configuration
    public class SecurityConfig {
        
    
    	@Bean 
    	@Order(1)
    	public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
    			throws Exception {
        
    		OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
    		http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
    			.oidc(Customizer.withDefaults());	// Enable OpenID Connect 1.0
    		http
    			// Redirect to the login page when not authenticated from the
    			// authorization endpoint
    			.exceptionHandling((exceptions) -> exceptions
    				.authenticationEntryPoint(
    					new LoginUrlAuthenticationEntryPoint("/login"))
    			)
    			// Accept access tokens for User Info and/or Client Registration
    			.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
    
    		return http.build();
    	}
    
    	@Bean 
    	@Order(2)
    	public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http)
    			throws Exception {
        
    		http
    			.authorizeHttpRequests((authorize) -> authorize
    				.anyRequest().authenticated()
    			)
    			// Form login handles the redirect to the login page from the
    			// authorization server filter chain
    			.formLogin(Customizer.withDefaults());
    
    		return http.build();
    	}
    
    	@Bean 
    	public UserDetailsService userDetailsService() {
        
    		UserDetails userDetails = User.withDefaultPasswordEncoder()
    				.username("user")
    				.password("password")
    				.roles("USER")
    				.build();
    
    		return new InMemoryUserDetailsManager(userDetails);
    	}
    
    	@Bean 
    	public RegisteredClientRepository registeredClientRepository() {
        
    		RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
    				.clientId("messaging-client")
    				.clientSecret("{noop}secret")
    				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
    				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
    				.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
    				.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
    				.redirectUri("http://127.0.0.1:8080/login/oauth2/code/messaging-client-oidc")
    				.redirectUri("http://127.0.0.1:8080/authorized")
    				.scope(OidcScopes.OPENID)
    				.scope(OidcScopes.PROFILE)
    				.scope("message.read")
    				.scope("message.write")
    				.clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
    				.build();
    
    		return new InMemoryRegisteredClientRepository(registeredClient);
    	}
    
    	@Bean 
    	public JWKSource<SecurityContext> jwkSource() {
        
    		KeyPair keyPair = generateRsaKey();
    		RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
    		RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
    		RSAKey rsaKey = new RSAKey.Builder(publicKey)
    				.privateKey(privateKey)
    				.keyID(UUID.randomUUID().toString())
    				.build();
    		JWKSet jwkSet = new JWKSet(rsaKey);
    		return new ImmutableJWKSet<>(jwkSet);
    	}
    
    	private static KeyPair generateRsaKey() {
         
    		KeyPair keyPair;
    		try {
        
    			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
    			keyPairGenerator.initialize(2048);
    			keyPair = keyPairGenerator.generateKeyPair();
    		}
    		catch (Exception ex) {
        
    			throw new IllegalStateException(ex);
    		}
    		return keyPair;
    	}
    
    	@Bean 
    	public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
        
    		return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
    	}
    
    	@Bean 
    	public AuthorizationServerSettings authorizationServerSettings() {
        
    		return AuthorizationServerSettings.builder().build();
    	}
    
    }

在上面的 Demo 里，将所有配置都写在了一个配置类 SecurityConfig 里，实际上 Spring Authorization Server 还提供了一种实现最小配置的默认配置形式，就是通过 `OAuth2AuthorizationServerConfiguration` 这个类，源码如下：

@Configuration(proxyBeanMethods = false)
    public class OAuth2AuthorizationServerConfiguration {
        
    
    	@Bean
    	@Order(Ordered.HIGHEST_PRECEDENCE)
    	public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
        
    		applyDefaultSecurity(http);
    		return http.build();
    	}
    
    	// @formatter:off
    	public static void applyDefaultSecurity(HttpSecurity http) throws Exception {
        
    		OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
    				new OAuth2AuthorizationServerConfigurer();
    		RequestMatcher endpointsMatcher = authorizationServerConfigurer
    				.getEndpointsMatcher();
    
    		http
    			.requestMatcher(endpointsMatcher)
    			.authorizeRequests(authorizeRequests ->
    				authorizeRequests.anyRequest().authenticated()
    			)
    			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
    			.apply(authorizationServerConfigurer);
    	}
    	// @formatter:on
    
    	public static JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
        
    		Set<JWSAlgorithm> jwsAlgs = new HashSet<>();
    		jwsAlgs.addAll(JWSAlgorithm.Family.RSA);
    		jwsAlgs.addAll(JWSAlgorithm.Family.EC);
    		jwsAlgs.addAll(JWSAlgorithm.Family.HMAC_SHA);
    		ConfigurableJWTProcessor<SecurityContext> jwtProcessor = new DefaultJWTProcessor<>();
    		JWSKeySelector<SecurityContext> jwsKeySelector =
    				new JWSVerificationKeySelector<>(jwsAlgs, jwkSource);
    		jwtProcessor.setJWSKeySelector(jwsKeySelector);
    		// Override the default Nimbus claims set verifier as NimbusJwtDecoder handles it instead
    		jwtProcessor.setJWTClaimsSetVerifier((claims, context) -> {
        
    		});
    		return new NimbusJwtDecoder(jwtProcessor);
    	}
    
    	@Bean
    	RegisterMissingBeanPostProcessor registerMissingBeanPostProcessor() {
        
    		RegisterMissingBeanPostProcessor postProcessor = new RegisterMissingBeanPostProcessor();
    		postProcessor.addBeanDefinition(AuthorizationServerSettings.class, () -> AuthorizationServerSettings.builder().build());
    		return postProcessor;
    	}
    
    }

这里注入一个叫做 `authorizationServerSecurityFilterChain` 的 bean，其实对比一下可以看出，这和最小配置的实现基本是相同的。有了这个 bean，就会支持如下协议端点：

*  [OAuth2 Authorization endpoint][]
 *  [OAuth2 Token endpoint][]
 *  [OAuth2 Token Introspection endpoint][]
 *  [OAuth2 Token Revocation endpoint][]
 *  [OAuth2 Authorization Server Metadata endpoint][]
 *  [JWK Set endpoint][]
 *  [OpenID Connect 1.0 Provider Configuration endpoint][]
 *  [OpenID Connect 1.0 UserInfo endpoint][]

接下来使用 `OAuth2AuthorizationServerConfiguration` 这个类来实现一个 Authorization Server，将 Spring Security 和 Authorization Server 的配置分开，Spring Security 使用 `SecurityConfig` 类，创建一个新的Authorization Server 配置类 `AuthorizationServerConfig`

![15a04ca238dc54d95918befdfbeab9fd.png][]

#### 1.2.2 ServerSecurityConfig ####

@EnableWebSecurity
    @Configuration(proxyBeanMethods = false)
    public class ServerSecurityConfig {
        
    
        @Resource
        private DataSource dataSource;
    
        /**
         * Spring Security 的过滤器链，用于 Spring Security 的身份认证
         */
        @Bean
        SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
        
            http.authorizeHttpRequests(authorize -> authorize
                            // 配置放行的请求
                            .antMatchers("/api/**", "/login").permitAll()
                            // 其他任何请求都需要认证
                            .anyRequest().authenticated()
                    )
                    // 设置登录表单页面
                    .formLogin(formLoginConfigurer -> formLoginConfigurer.loginPage("/login"));
    
            return http.build();
        }
      
    //    @Bean
    //    public UserDetailsService userDetailsService() {
        
    //        return new JdbcUserDetailsManager(dataSource);
    //    }
    
        @Bean
        UserDetailsManager userDetailsManager() {
        
            return new JdbcUserDetailsManager(dataSource);
        }
    }

Spring Authorization Server 默认是支持内存和 JDBC 两种存储模式的，内存模式只适合简单的测试，所以这里使用 JDBC 存储模式。在 1.2.1 最小配置那节里注入 `UserDetailsService` 这个 Bean 使用的是 `InMemoryUserDetailsManager`，表示内存模式，这里使用 `JdbcUserDetailsManager` 表示 JDBC 模式

而这两个类都属于 `UserDetailsManager` 接口的实现类，并且后续我们需要使用到 `userDetailsManager.createUser(userDetails)` 方法来添加用户，因此这里需要注入 `UserDetailsManager` 这个 Bean，由于返回的都是 JdbcUserDetailsManager，因此可以注释掉 `UserDetailsService` 这个 Bean 的注入

![3061979941b5a2470997851b048b9069.png][]

#### 1.2.3 AuthorizationServerConfig ####

该类部分配置可以参照前面提到的 `OAuth2AuthorizationServerConfiguration` 类来配置，同样使用 JDBC 存储模式

@Configuration(proxyBeanMethods = false)
    public class AuthorizationServerConfig {
        
        private static final String CUSTOM_CONSENT_PAGE_URI = "/oauth2/consent";
    
        @Bean
        @Order(Ordered.HIGHEST_PRECEDENCE)
        public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
        
            // 定义授权服务配置器
            OAuth2AuthorizationServerConfigurer configurer = new OAuth2AuthorizationServerConfigurer();
            configurer
                    // 自定义授权页面
                    .authorizationEndpoint(authorizationEndpoint -> authorizationEndpoint.consentPage(CUSTOM_CONSENT_PAGE_URI))
                    // Enable OpenID Connect 1.0, 启用 OIDC 1.0
                    .oidc(Customizer.withDefaults());
    
            // 获取授权服务器相关的请求端点
            RequestMatcher endpointsMatcher = configurer.getEndpointsMatcher();
    
            http
                    // 拦截对授权服务器相关端点的请求
                    .requestMatcher(endpointsMatcher)
                    // 拦载到的请求需要认证
                    .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated())
                    // 忽略掉相关端点的 CSRF(跨站请求): 对授权端点的访问可以是跨站的
                    .csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
                    .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
                    // 访问端点时表单登录
                    .formLogin()
                    .and()
                    // 应用授权服务器的配置
                    .apply(configurer);
    
            return http.build();
        }
    
        /**
         * 注册客户端应用, 对应 oauth2_registered_client 表
         */
        @Bean
        public RegisteredClientRepository registeredClientRepository(JdbcTemplate jdbcTemplate) {
        
            return new JdbcRegisteredClientRepository(jdbcTemplate);
        }
    
        /**
         * 令牌的发放记录, 对应 oauth2_authorization 表
         */
        @Bean
        public OAuth2AuthorizationService authorizationService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) {
        
            return new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository);
        }
    
        /**
         * 把资源拥有者授权确认操作保存到数据库, 对应 oauth2_authorization_consent 表
         */
        @Bean
        public OAuth2AuthorizationConsentService authorizationConsentService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) {
        
            return new JdbcOAuth2AuthorizationConsentService(jdbcTemplate, registeredClientRepository);
        }
    
        /**
         * 加载 JWT 资源, 用于生成令牌
         */
        @Bean
        public JWKSource<SecurityContext> jwkSource() {
        
            KeyPair keyPair;
            try {
        
                KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
                keyPairGenerator.initialize(2048);
                keyPair = keyPairGenerator.generateKeyPair();
            } catch (Exception ex) {
        
                throw new IllegalStateException(ex);
            }
    
            RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
            RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
            RSAKey rsaKey = new RSAKey.Builder(publicKey)
                    .privateKey(privateKey)
                    .keyID(UUID.randomUUID().toString())
                    .build();
    
            JWKSet jwkSet = new JWKSet(rsaKey);
            return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
        }
    
        /**
         * JWT 解码
         */
        @Bean
        public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
        
            return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
        }
    
        /**
         * AuthorizationServerS 的相关配置
         */
        @Bean
        public AuthorizationServerSettings authorizationServerSettings() {
        
            return AuthorizationServerSettings.builder().build();
        }
    }

### 1.3 创建数据库表 ###

一共包括 5 个表，其中 Spring Security 相关的有 2 个表，user 和 authorities，用户表和权限表，该表的建表 SQL 在

> org\\springframework\\security\\core\\userdetails\\jdbc\\users.ddl

SQL 可能会有一些问题，根据自己使用的数据库进行更改

create table users(username varchar_ignorecase(50) not null primary key,password varchar_ignorecase(500) not null,enabled boolean not null);
    create table authorities (username varchar_ignorecase(50) not null,authority varchar_ignorecase(50) not null,constraint fk_authorities_users foreign key(username) references users(username));
    create unique index ix_auth_username on authorities (username,authority);

Spring authorization Server 有 3 个表，建表 SQL 在：

> org\\springframework\\security\\oauth2\\server\\authorization\\oauth2-authorization-consent-schema.sql
> 
> org\\springframework\\security\\oauth2\\server\\authorization\\oauth2-authorization-schema.sql
> 
> org\\springframework\\security\\oauth2\\server\\authorization\\client\\oauth2-registered-client-schema.sql

CREATE TABLE oauth2_authorization_consent (
        registered_client_id varchar(100) NOT NULL,
        principal_name varchar(200) NOT NULL,
        authorities varchar(1000) NOT NULL,
        PRIMARY KEY (registered_client_id, principal_name)
    );

/*
    IMPORTANT:
        If using PostgreSQL, update ALL columns defined with 'blob' to 'text',
        as PostgreSQL does not support the 'blob' data type.
    */
    CREATE TABLE oauth2_authorization (
        id varchar(100) NOT NULL,
        registered_client_id varchar(100) NOT NULL,
        principal_name varchar(200) NOT NULL,
        authorization_grant_type varchar(100) NOT NULL,
        authorized_scopes varchar(1000) DEFAULT NULL,
        attributes blob DEFAULT NULL,
        state varchar(500) DEFAULT NULL,
        authorization_code_value blob DEFAULT NULL,
        authorization_code_issued_at timestamp DEFAULT NULL,
        authorization_code_expires_at timestamp DEFAULT NULL,
        authorization_code_metadata blob DEFAULT NULL,
        access_token_value blob DEFAULT NULL,
        access_token_issued_at timestamp DEFAULT NULL,
        access_token_expires_at timestamp DEFAULT NULL,
        access_token_metadata blob DEFAULT NULL,
        access_token_type varchar(100) DEFAULT NULL,
        access_token_scopes varchar(1000) DEFAULT NULL,
        oidc_id_token_value blob DEFAULT NULL,
        oidc_id_token_issued_at timestamp DEFAULT NULL,
        oidc_id_token_expires_at timestamp DEFAULT NULL,
        oidc_id_token_metadata blob DEFAULT NULL,
        refresh_token_value blob DEFAULT NULL,
        refresh_token_issued_at timestamp DEFAULT NULL,
        refresh_token_expires_at timestamp DEFAULT NULL,
        refresh_token_metadata blob DEFAULT NULL,
        PRIMARY KEY (id)
    );

CREATE TABLE oauth2_registered_client (
        id varchar(100) NOT NULL,
        client_id varchar(100) NOT NULL,
        client_id_issued_at timestamp DEFAULT CURRENT_TIMESTAMP NOT NULL,
        client_secret varchar(200) DEFAULT NULL,
        client_secret_expires_at timestamp DEFAULT NULL,
        client_name varchar(200) NOT NULL,
        client_authentication_methods varchar(1000) NOT NULL,
        authorization_grant_types varchar(1000) NOT NULL,
        redirect_uris varchar(1000) DEFAULT NULL,
        scopes varchar(1000) NOT NULL,
        client_settings varchar(2000) NOT NULL,
        token_settings varchar(2000) NOT NULL,
        PRIMARY KEY (id)
    );

创建完成后的数据库表如下：

![279c3af59907da81ad8e9d5af625e28a.png][]

### 1.4 自定义登录和授权页面 ###

在项目 resource 目录下创建一个 templates 文件夹，然后创建 login.html 和 consent.html，登录页面的配置在 1.2.2 中配置好了，授权页面的配置在 1.2.3 中配置好了

![ea10c38cd20f4e6e4b3ae7ce8dd276e3.png][]

**登录页面 login.html**

<!DOCTYPE html>
    <html lang="en"
          xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org">
    <head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
        <title>Spring Security Example</title>
        <link href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M" crossorigin="anonymous">
        <link href="https://getbootstrap.com/docs/4.0/examples/signin/signin.css" rel="stylesheet" crossorigin="anonymous"/>
    </head>
    <body>
    <div class="container">
        <form class="form-signin" method="post" th:action="@{/login}">
            <div th:if="${param.error}" class="alert alert-danger" role="alert">
                用户名或密码无效
            </div>
            <div th:if="${param.logout}" class="alert alert-success" role="alert">
                您已注销
            </div>
            <h2 class="form-signin-heading">登录</h2>
            <p>
                <label for="username" class="sr-only">用户名</label>
                <input type="text" id="username" name="username" class="form-control" placeholder="用户名" required autofocus>
            </p>
            <p>
                <label for="password" class="sr-only">密 码</label>
                <input type="password" id="password" name="password" class="form-control" placeholder="密 码" required>
            </p>
            <button class="btn btn-lg btn-primary btn-block" type="submit">登录</button>
            <a class="btn btn-light btn-block bg-white" href="/oauth2/authorization/github-idp" role="link" style="text-transform: none;">
                <img width="24" style="margin-right: 5px;" alt="Sign in with GitHub" src="https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png" />
                使用Github登录
            </a>
        </form>
    </div>
    </body>
    </html>

创建 LoginConroller，用于跳转到 login.html 页面

@Controller
    public class LoginController {
        
    
    	@GetMapping("/login")
    	public String login() {
        
    		return "login";
    	}
    }

**授权页面 consent.html**

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
        <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css"
              integrity="sha384-JcKb8q3iqJ61gNV9KGb8thSsNjpSL0n8PARn9HuZOnIxN0hoP+VmmDGMN5t9UJ0Z" crossorigin="anonymous">
        <title>Custom consent page - Consent required</title>
        <style>
            body {
          
                background-color: aliceblue;
            }
        </style>
    	<script>
    		function cancelConsent() {
          
    			document.consent_form.reset();
    			document.consent_form.submit();
    		}
    	</script>
    </head>
    <body>
    <div class="container">
        <div class="py-5">
            <h1 class="text-center text-primary">应用程序权限</h1>
        </div>
        <div class="row">
            <div class="col text-center">
                <p>
                    应用程序
                    <span class="font-weight-bold text-primary" th:text="${clientId}"></span>
                    想要访问您的帐户
                    <span class="font-weight-bold" th:text="${principalName}"></span>
                </p>
            </div>
        </div>
        <div class="row pb-3">
            <div class="col text-center"><p>上述应用程序请求以下权限<br>如果您批准，请查看这些并同意</p></div>
        </div>
        <div class="row">
            <div class="col text-center">
                <form name="consent_form" method="post" th:action="@{/oauth2/authorize}">
                    <input type="hidden" name="client_id" th:value="${clientId}">
                    <input type="hidden" name="state" th:value="${state}">
    
                    <div th:each="scope: ${scopes}" class="form-group form-check py-1">
                        <input class="form-check-input"
                               type="checkbox"
                               name="scope"
                               th:value="${scope.scope}"
                               th:id="${scope.scope}">
                        <label class="form-check-label font-weight-bold" th:for="${scope.scope}" th:text="${scope.scope}"></label>
                        <p class="text-primary" th:text="${scope.description}"></p>
                    </div>
    
                    <p th:if="${not #lists.isEmpty(previouslyApprovedScopes)}">您已向上述应用授予以下权限:</p>
                    <div th:each="scope: ${previouslyApprovedScopes}" class="form-group form-check py-1">
                        <input class="form-check-input"
                               type="checkbox"
                               th:id="${scope.scope}"
                               disabled
                               checked>
                        <label class="form-check-label font-weight-bold" th:for="${scope.scope}" th:text="${scope.scope}"></label>
                        <p class="text-primary" th:text="${scope.description}"></p>
                    </div>
    
                    <div class="form-group pt-3">
                        <button class="btn btn-primary btn-lg" type="submit" id="submit-consent">
                            提交授权
                        </button>
                    </div>
                    <div class="form-group">
                        <button class="btn btn-link regular" type="button" id="cancel-consent" onclick="cancelConsent();">
                            取消
                        </button>
                    </div>
                </form>
            </div>
        </div>
        <div class="row pt-4">
            <div class="col text-center">
                <p>
                    <small>
                        Your consent to provide access is required.
                        <br/>If you do not approve, click Cancel, in which case no information will be shared with the app.
                    </small>
                </p>
            </div>
        </div>
    </div>
    </body>
    </html>

创建 AuthorizationConsentController，用于跳转到 consent.html 页面

@Controller
    public class AuthorizationConsentController {
        
    	private final RegisteredClientRepository registeredClientRepository;
    	private final OAuth2AuthorizationConsentService authorizationConsentService;
    
    	public AuthorizationConsentController(RegisteredClientRepository registeredClientRepository,
    			OAuth2AuthorizationConsentService authorizationConsentService) {
        
    		this.registeredClientRepository = registeredClientRepository;
    		this.authorizationConsentService = authorizationConsentService;
    	}
    
    	@GetMapping(value = "/oauth2/consent")
    	public String consent(Principal principal, Model model,
    			@RequestParam(OAuth2ParameterNames.CLIENT_ID) String clientId,
    			@RequestParam(OAuth2ParameterNames.SCOPE) String scope,
    			@RequestParam(OAuth2ParameterNames.STATE) String state) {
        
    
    		// 要批准的范围和以前批准的范围
    		Set<String> scopesToApprove = new HashSet<>();
    		Set<String> previouslyApprovedScopes = new HashSet<>();
    		// 查询 clientId 是否存在
    		RegisteredClient registeredClient = this.registeredClientRepository.findByClientId(clientId);
    		// 查询当前的授权许可
    		OAuth2AuthorizationConsent currentAuthorizationConsent =
    				this.authorizationConsentService.findById(registeredClient.getId(), principal.getName());
    
    		// 已授权范围
    		Set<String> authorizedScopes;
    		if (currentAuthorizationConsent != null) {
        
    			authorizedScopes = currentAuthorizationConsent.getScopes();
    		} else {
        
    			authorizedScopes = Collections.emptySet();
    		}
    		for (String requestedScope : StringUtils.delimitedListToStringArray(scope, " ")) {
        
    			if (OidcScopes.OPENID.equals(requestedScope)) {
        
    				continue;
    			}
    			// 如果已授权范围包含了请求范围，则添加到以前批准的范围的 Set, 否则添加到要批准的范围
    			if (authorizedScopes.contains(requestedScope)) {
        
    				previouslyApprovedScopes.add(requestedScope);
    			} else {
        
    				scopesToApprove.add(requestedScope);
    			}
    		}
    
    		model.addAttribute("clientId", clientId);
    		model.addAttribute("state", state);
    		model.addAttribute("scopes", withDescription(scopesToApprove));
    		model.addAttribute("previouslyApprovedScopes", withDescription(previouslyApprovedScopes));
    		model.addAttribute("principalName", principal.getName());
    
    		return "consent";
    	}
    
    	private static Set<ScopeWithDescription> withDescription(Set<String> scopes) {
        
    		Set<ScopeWithDescription> scopeWithDescriptions = new HashSet<>();
    		for (String scope : scopes) {
        
    			scopeWithDescriptions.add(new ScopeWithDescription(scope));
    		}
    		return scopeWithDescriptions;
    	}
    
    	public static class ScopeWithDescription {
        
    		private static final String DEFAULT_DESCRIPTION = "未知范围 - 我们无法提供有关此权限的信息, 请在授予此权限时谨慎";
    		private static final Map<String, String> scopeDescriptions = new HashMap<>();
    		static {
        
    			scopeDescriptions.put(
    					OidcScopes.PROFILE,
    					"此应用程序将能够读取您的个人资料信息"
    			);
    			scopeDescriptions.put(
    					"message.read",
    					"此应用程序将能够读取您的信息"
    			);
    			scopeDescriptions.put(
    					"message.write",
    					"此应用程序将能够添加新信息, 它还可以编辑和删除现有信息"
    			);
    			scopeDescriptions.put(
    					"other.scope",
    					"这是范围描述的另一个范围示例"
    			);
    		}
    
    		public final String scope;
    		public final String description;
    
    		ScopeWithDescription(String scope) {
        
    			this.scope = scope;
    			this.description = scopeDescriptions.getOrDefault(scope, DEFAULT_DESCRIPTION);
    		}
    	}
    }

### 1.5 ServerController ###

用于添加用户信息和客户端信息，这里的 passwordEncoder 使用 BCryptPasswordEncoder 进行加解密，\{bcrypt\} 表示加密，\{noop\} 表示明文

@RestController
    public class ServerController {
        
    
        @Resource
        private UserDetailsManager userDetailsManager;
    
        @GetMapping("/api/addUser")
        public String addUser() {
        
            UserDetails userDetails = User.builder().passwordEncoder(s -> "{bcrypt}" + new BCryptPasswordEncoder().encode(s))
                    .username("fan")
                    .password("fan")
                    .roles("ADMIN")
                    .build();
    
            userDetailsManager.createUser(userDetails);
            return "添加用户成功";
        }
    
        @Resource
        private RegisteredClientRepository registeredClientRepository;
    
        @GetMapping("/api/addClient")
        public String addClient() {
        
            // JWT（Json Web Token）的配置项：TTL、是否复用refreshToken等等
            TokenSettings tokenSettings = TokenSettings.builder()
                    // 令牌存活时间：2小时
                    .accessTokenTimeToLive(Duration.ofHours(2))
                    // 令牌可以刷新，重新获取
                    .reuseRefreshTokens(true)
                    // 刷新时间：30天（30天内当令牌过期时，可以用刷新令牌重新申请新令牌，不需要再认证）
                    .refreshTokenTimeToLive(Duration.ofDays(30))
                    .build();
            // 客户端相关配置
            ClientSettings clientSettings = ClientSettings.builder()
                    // 是否需要用户授权确认
                    .requireAuthorizationConsent(true)
                    .build();
    
            RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
                    // 客户端ID和密码
                    .clientId("messaging-client")
    //                .clientSecret("{bcrypt}" + new BCryptPasswordEncoder().encode("secret"))
                    .clientSecret("{noop}secret")
                    // 授权方法
                    .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
                    // 授权模式（授权码模式）
                    .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                    // 刷新令牌（授权码模式）
                    .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
                    .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
                    // 回调地址：授权服务器向当前客户端响应时调用下面地址, 不在此列的地址将被拒绝, 只能使用IP或域名，不能使用 localhost
                    .redirectUri("http://127.0.0.1:8000/login/oauth2/code/messaging-client-oidc")
                    // OIDC 支持
                    .scope(OidcScopes.OPENID)
                    .scope(OidcScopes.PROFILE)
                    // 授权范围（当前客户端的授权范围）
                    .scope("message.read")
                    .scope("message.write")
                    // JWT（Json Web Token）配置项
                    .tokenSettings(tokenSettings)
                    // 客户端配置项
                    .clientSettings(clientSettings)
                    .build();
    
            registeredClientRepository.save(registeredClient);
            return "添加客户端信息成功";
        }
    }

### 1.6 YAML 配置 ###

配置数据库连接信息

server:
      port: 9000
    
    spring:
      datasource:
        url: jdbc:mysql://localhost:3306/unified_certification?useSSL=false&useUnicode=true&characterEncoding=utf-8&serverTimezone=UTC
        driver-class-name: com.mysql.cj.jdbc.Driver
        username: root
        password: root

### 1.7 测试 ###

完整目录结构如下：

![5c7546f6157d509093e645d9d023faa5.png][]

#### 1.7.1 添加用户和客户端信息 ####

启动项目，访问 `http://127.0.0.1:9000/api/addUser`

![3312f5a60f7e251a49ccd630a973ce37.png][]

查询数据库 users 和 authorities 表，已有用户和权限信息

![ae49f227f5610ce6883504e0d546a86b.png][]

![331938cd7596f400989163dd9120c97e.png][]

访问 `http://127.0.0.1:9000/api/addClient`

![07adada06c89580a44917170f431ed03.png][]

查询数据库 oauth2\_registered\_client 表，已有客户端信息

![6a73e2b37e1adfc663642f1816bf7950.png][]

#### 1.7.2 授权码模式获取令牌 ####

**有关 OAuth2.0 的相关知识可见：[OAuth2.0 实战总结\_凡 223 的博客][OAuth2.0 _ 223]**

访问 `http://127.0.0.1:9000/oauth2/authorize?response_type=code&client_id=messaging-client&scope=message.read&redirect_uri=http://127.0.0.1:8000/login/oauth2/code/messaging-client-oidc`，这里的 127.0.0.1:8000 其实为客户端地址，后面讲到客户端时，客户端的地址就为 8000

*  response\_type：授权类型，code 为授权码模式
 *  client\_id：客户端 ID，即前面注册客户端的时候定义的
 *  scope：请求的权限范围
 *  redirect\_uri：回调地址，也是前面注册客户端的时候定义的

未登录，会跳转到登录页面

![9205775c0df7dd3726353783e5ed9271.png][]

输入前面添加的用户信息，用户名和密码，然后会跳转到授权页面

![00e99e42763fda47e9897e7390528db4.png][]

选择是否授予权限，这里勾选后，点击提交，会跳转到回调地址，即 127.0.0.1:8000/login/oauth2/code/messaging-client-oidc，由于这个地址还没有对应的服务，无法访问，但我们暂时需要的是地址栏的 code

> http://127.0.0.1:8000/login/oauth2/code/messaging-client-oidc?code=z\_3O1lEdxVsd2fn8\_uKA481pO9caGd0N4x\_Vbt0deuMA77sDis6fhMJkf2\_9uM4KGYzLzv7ujbXZ2JAdg0ACyMapR38jnJruG2iz2XBgptKrru-IJobGVa6NTicgvCZ7

![8fef1f85d074340da7a53c13ef9cc711.png][]

打开接口测试工具，这里我使用的是 Apifox，使用表单格式，包含三个参数

*  grant\_type：授权类型，authorization\_code 表示授权码模式
 *  code：即授权码，上面地址栏里返回给我们的 code 部分，复制到这里，code 使用一次就会失效
 *  redirect\_uri：回调地址，与前面的一致。图中的地址忘记修改了，注意和前面请求 code 时写的回调地址一致，即 http://127.0.0.1:8000/login/oauth2/code/messaging-client-oidc，后面有类似问题同样修改

![2d70c85faf29154a0b3d41d0c5862c7d.png][]

然后设置 Auth，Postman 里是 Authorization，选择 Basic Auth 类型，用户名密码则为注册客户端时的 client\_id 和 clientSecret，客户端 ID 和密钥

![6936019b685190168698c0cc4a12a801.png][]

保存，发送后，会给我们返回 access\_token 和 refresh\_token

![1263acc4c762488cae8f1f44af0b0a63.png][]

将 access\_token 复制到 [JSON Web Tokens - jwt.io][] 网站，解析后可以看到 JWT 的信息，包括客户端 ID，权限范围，服务器地址等

![00b8c74a08d70fd4195e924cbff01e0e.png][]

#### 1.7.3 授权码模式刷新令牌 ####

在前面返回了 access\_token 和 refresh\_token，access\_token 包含了授权信息，refresh\_token 则是用来重新获取 access\_token，同样是表单类型，包含两个参数

*  grant\_type：refresh\_token 表示刷新令牌
 *  refresh\_token：即前面获取到的 refresh\_token 的值

![a56a5fdec760a1f8f1b2d66804ebfc0c.png][]

Auth 信息与前面一致

![e41c9b1219dad2373a2aac90be9fab18.png][]

保存，发送后，会给我们返回新的 access\_token 和 refresh\_token，refresh\_token 使用一次就会失效

![c970bf85190c2b7f1911073a6d2decf3.png][]

#### 1.7.4 客户端模式 ####

同样使用表单格式，grant\_type 值为 client\_credentials

![27b393611563f6ff16bc92ab4e6302ca.png][]

Auth 与前面一致

![566ee45e7543e2e55b3c9c0c3e164318.png][]

保存，发送后，会给我们返回 access\_token，没有 refresh\_token。因为在授权码模式中的 access\_token 是我们通过授权码 code 换来的，而授权码 code 是我们请求后授权得到的，为了不用每次获取 access\_token 都需要重新请求授权，所以使用 refresh\_token 来重新获取 access\_token，refresh\_token 和 access\_token 都有过期时间，refresh\_token 过期时间比 access\_token 长

而客户端模式可以直接获取 access\_token，所以也就不需要 refresh\_token 了

![e02807169a876d9668ed993622c8eb39.png][]

#### 1.7.5 OIDC ####

**有关 OIDC 的相关知识同样可见：[OAuth2.0 实战总结\_凡 223 的博客][OAuth2.0 _ 223]**

在前面 1.2.3 的配置和 1.5 的注册客户端时，已经支持了 OIDC，这里直接访问：`http://127.0.0.1:9000/oauth2/authorize?response_type=code&client_id=messaging-client&scope=openid&redirect_uri=http://127.0.0.1:8000/login/oauth2/code/messaging-client-oidc`

这里的 scope 必须包含 openid

得到授权码 code

> http://127.0.0.1:8000/login/oauth2/code/messaging-client-oidc?code=NjvT1z3msYRsjvPPM4LP4EmlyBUixsKes\_J6osSB3VAugXEKmyUappvtrmTWp7s\_iQzoJsD8xOE3gUXawhMixL0fu2HC6UJv8CeZyCB-d2oiu4NnCO9uJcK1MXOm4poU

然后通过授权码 code 换取令牌，可以看到除了 access\_token 和 refresh\_token 外，还返回了一个 id\_token

![4c616c6797c5d5f46434fdd362b836ea.png][]

解析这个 id\_token，信息如下，是我们的身份认证信息

![2f22ee5532ed39d7be4aea41ce1febfb.png][]

再通过 refresh\_token 重新获取令牌，同样也给我们返回了 id\_token

![32f53c3212f21ee52625335ec1288b78.png][]

通过 access\_token，获取 OIDC 的用户端点

![a38254e42062858dfe1b4fc042023301.png][]

这里的 sub 就是用户的标志。在 1.2.3 的配置中，对于 OIDC 使用的是默认配置

![07ffe6a28b5c4bc795db391010ae84f2.png][]

我们也可以增加自定义信息，修改后的配置如下，其他配置不变

重启项目，重新获取到 access\_token，通过 access\_token 访问用户端点，可以看到我们自定义的信息已经被添加了进来

![723eb2d5966f408fa429aa2dba34c5b5.png][]

## 2. 资源服务器 ##

### 2.1 引入依赖 ###

### 2.2 YAML 配置 ###

server:
      port: 8001
    
    spring:
      security:
        oauth2:
          resourceserver:
            jwt:
              issuer-uri: http://localhost:9000

### 2.3 异常处理器 ###

该部分为 Spring Security 相关知识，可见：**[Spring Security 总结\_凡 223 的博客][Spring Security _ 223]**

#### 2.3.1 认证失败处理器 ####

Response 为自定义的统一结果返回类，这里的返回信息自定义即可

public class UnAccessDeniedHandler implements AccessDeniedHandler {
        
    
        @Override
        public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
        
            // 403, 未授权, 禁止访问
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setCharacterEncoding("utf-8");
            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
    
            // 返回响应信息
            ServletOutputStream outputStream = response.getOutputStream();
            Response fail = Response.fail(HttpServletResponse.SC_FORBIDDEN,
                    "UnAccessDeniedHandler-未授权, 不允许访问", "uri-" + request.getRequestURI());
            outputStream.write(JSONUtil.toJsonStr(fail).getBytes(StandardCharsets.UTF_8));
    
            // 关闭流
            outputStream.flush();
            outputStream.close();
        }
    }

#### 2.3.2 鉴权失败处理器 ####

public class UnAuthenticationEntryPoint implements AuthenticationEntryPoint {
        
    
        @Override
        public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        
            if (authException instanceof InvalidBearerTokenException) {
        
                LogUtil.info("Token 登录失效");
            }
    
            if (response.isCommitted()) {
        
                return;
            }
    
            // 401, 未认证
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.setStatus(HttpServletResponse.SC_ACCEPTED);
            response.setCharacterEncoding("utf-8");
            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
    
            // 返回响应信息
            ServletOutputStream outputStream = response.getOutputStream();
    
            Response fail = Response.fail(HttpServletResponse.SC_UNAUTHORIZED,
                    authException.getMessage() + "-UnAuthenticationEntryPoint-认证失败", "uri-" + request.getRequestURI());
            outputStream.write(JSONUtil.toJsonStr(fail).getBytes(StandardCharsets.UTF_8));
            // 关闭流
            outputStream.flush();
            outputStream.close();
        }
    }

### 2.4 配置类 ###

对资源请求配置了读、写、profile 权限

@EnableWebSecurity
    @Configuration(proxyBeanMethods = false)
    public class ResourceServerConfig {
        
    
        /**
         * 资源管理器配置
         *
         * @param http
         * @return {@link SecurityFilterChain}
         * @author Fan
         * @since 2023/2/2 9:30
         */
        @Bean
        SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        
            UnAuthenticationEntryPoint authenticationEntryPoint = new UnAuthenticationEntryPoint();
            UnAccessDeniedHandler accessDeniedHandler = new UnAccessDeniedHandler();
    
            http
                    // security的session生成策略改为security不主动创建session, 即STALELESS
                    // 资源服务不涉及用户登录, 仅靠token访问, 不需要seesion
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                    .authorizeHttpRequests(authorize -> authorize
                            // 对 /resource1 的请求，需要 SCOPE_message.read 权限
                            .antMatchers("/resource1").hasAuthority("SCOPE_message.read")
                            // 对 /resource2 的请求，需要 SCOPE_message.write 权限
                            .antMatchers("/resource2").hasAuthority("SCOPE_message.write")
                            // 对 /resource3 的请求，需要 SCOPE_profile 权限
                            .antMatchers("/resource3").hasAuthority("SCOPE_profile")
                            // 放行请求
                            .antMatchers("/api/**").permitAll()
                            // 其他任何请求都需要认证
                            .anyRequest().authenticated())
                    // 异常处理器
                    .exceptionHandling(exceptionConfigurer -> exceptionConfigurer
                            // 认证失败
                            .authenticationEntryPoint(authenticationEntryPoint)
                            // 鉴权失败
                            .accessDeniedHandler(accessDeniedHandler)
                    )
                    // 资源服务
                    .oauth2ResourceServer(resourceServer -> resourceServer
                            .authenticationEntryPoint(authenticationEntryPoint)
                            .accessDeniedHandler(accessDeniedHandler)
                            .jwt());
    
            return http.build();
        }
    }

### 2.5 Controller ###

@RestController
    public class MessagesController {
        
    
    	@GetMapping("/resource1")
    	public Response getResource1(){
        
    		return Response.success("服务A -> 资源1 -> 读权限");
    	}
    
    	@GetMapping("/resource2")
    	public Response getResource2(){
        
    		return Response.success("服务A -> 资源2 -> 写权限");
    	}
    
    	@GetMapping("/resource3")
    	public Response resource3(){
        
    		return Response.success("服务A -> 资源3 -> profile 权限");
    	}
    
    	@GetMapping("/api/publicResource")
    	public Response publicResource() {
        
    		return Response.success("服务A -> 公共资源");
    	}
    }

### 2.6 测试 ###

完整目录结构如下：

![b0243be93e396a690b2dcdea1a101d63.png][]

启动项目，打开 Apifox，直接请求时，会提示我们认证失败，即上面认证失败处理器的响应结果

![3d0cd97307a3f9c6d84227e0c1755500.png][]

添加 Auth，类型选择 Bearer Token，Token 的值即为前面获取到的 access\_token 的值

![24125bc0181fb54f23928e6819932117.png][]

保存，发送后，即可获取资源 resource1

![05fce83ff673d88227670384223982bc.png][]

再获取资源 resource2，提示没有权限，这里返回的信息即为鉴权失败处理器的响应信息。因为在我们申请权限的时候只申请了 message.read 权限，同时也只授权了 message.read 权限，而 resource2 需要 message.write 权限，因此鉴权失败，无法访问

![63321b4d3cc78cc28fc33d0db2984415.png][]

## 3. 客户端 ##

### 3.1 引入依赖 ###

<dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-thymeleaf</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-oauth2-client</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-webflux</artifactId>
            </dependency>
            <dependency>
                <groupId>cn.hutool</groupId>
                <artifactId>hutool-all</artifactId>
            </dependency>
    </dependencies>

### 3.2 YAML 配置 ###

server:
      port: 8000
    
    spring:
      application:
        name: messages-client
      security:
        oauth2:
          client:
            registration:
              messaging-client-oidc:
                provider: authorization-server
                client-id: messaging-client
                client-secret: secret
                authorization-grant-type: authorization_code
    #            redirect-uri: "127.0.0.1:8000/login/oauth2/code/messaging-client-oidc"
                redirect-uri: "{baseUrl}/{action}/oauth2/code/{registrationId}"
                scope: openid,message.read,message.write
                client-name: messaging-client-oidc
            provider:
              # 服务提供地址
              authorization-server:
                # issuer-uri 可以简化下面的配置
                issuer-uri: http://localhost:9000
                # 请求授权码地址
    #            authorization-uri: http://localhost:9000/oauth2/authorize
                # 请求令牌地址
    #            token-uri: http://localhost:9000/oauth2/token
                # 用户资源地址
    #            user-info-uri: http://localhost:9000/oauth2/user
                # 用户资源返回中的一个属性名
    #            user-name-attribute: name
    #            user-info-authentication-method: GET

这里的配置要和注册客户端时的配置对应上，同一颜色对应，这里使用的是 OIDC，scope 加上了 openid

![a35324f5ea7336375277092acc14d197.png][]

注意：使用 OIDC 是为了使用默认的用户端点，假如不使用 OIDC 需要自定义用户端点接口，否则会报如下错误

> \[invalid\_user\_info\_response\] An error occurred while attempting to retrieve the UserInfo Resource: 403 : “\{“error”:“insufficient\_scope”\}”

### 3.3 配置类 ###

@EnableWebSecurity
    @Configuration(proxyBeanMethods = false)
    public class ClientSecurityConfig {
        
    
        /**
         * 安全配置
         */
        @Bean
        SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        
            http.authorizeHttpRequests(authorize ->
                            // 任何请求都需要认证
                            authorize.anyRequest().authenticated()
                    )
                    // 登录
    //                .oauth2Login(oauth2Login -> oauth2Login.loginPage("/oauth2/authorization/messaging-client-oidc"))
                    .oauth2Login(Customizer.withDefaults())
                    .oauth2Client(Customizer.withDefaults());
    
            return http.build();
        }
    }

### 3.4 index.html ###

<!DOCTYPE html>
    <html lang="en" xmlns:th="http://www.thymeleaf.org">
    <head>
        <meta charset="UTF-8">
        <title>Title</title>
    </head>
    <body>
    登录用户：<span th:text="${user}"></span>
    <hr/>
    <ul>
        <li><a href="./server/a/resource1">服务A —— 资源1</a></li>
        <li><a href="./server/a/resource2">服务A —— 资源2</a></li>
        <li><a href="./server/a/resource3">服务A —— 资源3</a></li>
        <li><a href="./server/a/publicResource">服务A —— 公共资源</a></li>
    </ul>
    </body>
    </html>

创建 IndexController，跳转到 index.html

@Controller
    public class IndexController {
        
    
    	@GetMapping("/")
    	public String root() {
        
    		return "redirect:/index";
    	}
    
    	@GetMapping("/index")
    	public String index(Model model) {
        
    		Map<String, Object> map = MapUtil.map(false);
    
    		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    		map.put("name", auth.getName());
    
    		Collection<? extends GrantedAuthority> authorities = auth.getAuthorities();
    		List<? extends GrantedAuthority> authoritiesList = authorities.stream().collect(Collectors.toList());
    		map.put("authorities", authoritiesList);
    
    		model.addAttribute("user", JSONUtil.toJsonStr(map));
    		return "index";
    	}
    }

### 3.5 ResourceController ###

@RestController
    public class ResourceController {
        
    
        @GetMapping("/server/a/resource1")
        public String getServerARes1(@RegisteredOAuth2AuthorizedClient OAuth2AuthorizedClient oAuth2AuthorizedClient) {
        
            return getServer("http://127.0.0.1:8001/resource1", oAuth2AuthorizedClient);
        }
    
        @GetMapping("/server/a/resource2")
        public String getServerARes2(@RegisteredOAuth2AuthorizedClient OAuth2AuthorizedClient oAuth2AuthorizedClient) {
        
            return getServer("http://127.0.0.1:8001/resource2", oAuth2AuthorizedClient);
        }
    
        @GetMapping("/server/a/resource3")
        public String getServerBRes1(@RegisteredOAuth2AuthorizedClient OAuth2AuthorizedClient oAuth2AuthorizedClient) {
        
            return getServer("http://127.0.0.1:8001/resource3", oAuth2AuthorizedClient);
        }
    
        @GetMapping("/server/a/publicResource")
        public String getServerBRes2(@RegisteredOAuth2AuthorizedClient OAuth2AuthorizedClient oAuth2AuthorizedClient) {
        
            return getServer("http://127.0.0.1:8001/api/publicResource", oAuth2AuthorizedClient);
        }
    
        /**
         * 绑定token，请求微服务
         */
        private String getServer(String url, OAuth2AuthorizedClient oAuth2AuthorizedClient) {
        
            LogUtil.info("getServer");
            // 获取 access_token
            String tokenValue = oAuth2AuthorizedClient.getAccessToken().getTokenValue();
    
            // 发起请求
            Mono<String> stringMono = WebClient.builder()
                    .defaultHeader("Authorization", "Bearer " + tokenValue)
                    .build()
                    .get()
                    .uri(url)
                    .retrieve()
                    .bodyToMono(String.class);
    
            return stringMono.block();
        }
    }

### 3.6 测试 ###

完整目录结构如下：

![9dfa56e933798635c5fb2045ebe444db.png][]

启动项目，访问 `127.0.0.1:8000`，未登录会直接跳转到登录页面

![3d959c7453b329d1afd0a6b0e2e60d6e.png][]

输入用户名密码，登录后进入授权页面

![f617ddd2142127ae30e587fea910fae5.png][]

选择想要授予的权限，这里勾选 read 权限，点击提交，跳转到我们的首页 index.html

![6cdbd0d29d65b1071f120abb3b88d686.png][]

将上面 user 的 JSON 信息格式化一下如下，可以看到就是我们的认证和权限信息

![148f307d101f21af45982fb60b1486af.png][]

点击访问 服务A -> 资源1

![4f667baa0aacb655106f74fd349317f5.png][]

点击访问 服务A -> 资源2，无法访问

![6a7e02bec1264b0ddaf1760b332e86a7.png][]

这是因为之前授权时只给了 read 权限，而资源 2 需要 write 权限，可以看到报了 403 异常，这里可以定义一个异常处理类，来返回对应的信息，而不是白页

![76dc4b96d98296822f43fb50d61729ce.png][]

我们关闭当前页面新开一个页面，再次访问 `127.0.0.1:8000` 可以发现直接进入了 index.html，无需再次登录

![7863ea75cc58c9602f0cc23bec0d1ab3.png][]

可以发现我们访问时是带了一个 JESSEIONID 的，用户登录后，会在认证服务器和客户端都保存 session 信息

![6fd2ddda9092ca7c0b67ea71dd3ccef0.png][]

[spring-authorization-server_samples]: https://github.com/spring-projects/spring-authorization-server/tree/main/samples
[Getting Started]: https://docs.spring.io/spring-authorization-server/docs/0.4.0/reference/html/getting-started.html
[OAuth2 Authorization endpoint]: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/protocol-endpoints.html#oauth2-authorization-endpoint
[OAuth2 Token endpoint]: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/protocol-endpoints.html#oauth2-token-endpoint
[OAuth2 Token Introspection endpoint]: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/protocol-endpoints.html#oauth2-token-introspection-endpoint
[OAuth2 Token Revocation endpoint]: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/protocol-endpoints.html#oauth2-token-revocation-endpoint
[OAuth2 Authorization Server Metadata endpoint]: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/protocol-endpoints.html#oauth2-authorization-server-metadata-endpoint
[JWK Set endpoint]: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/protocol-endpoints.html#jwk-set-endpoint
[OpenID Connect 1.0 Provider Configuration endpoint]: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/protocol-endpoints.html#oidc-provider-configuration-endpoint
[OpenID Connect 1.0 UserInfo endpoint]: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/protocol-endpoints.html#oidc-user-info-endpoint
[15a04ca238dc54d95918befdfbeab9fd.png]: https://img-blog.csdnimg.cn/img_convert/15a04ca238dc54d95918befdfbeab9fd.png
[3061979941b5a2470997851b048b9069.png]: https://img-blog.csdnimg.cn/img_convert/3061979941b5a2470997851b048b9069.png
[279c3af59907da81ad8e9d5af625e28a.png]: https://img-blog.csdnimg.cn/img_convert/279c3af59907da81ad8e9d5af625e28a.png
[ea10c38cd20f4e6e4b3ae7ce8dd276e3.png]: https://img-blog.csdnimg.cn/img_convert/ea10c38cd20f4e6e4b3ae7ce8dd276e3.png
[5c7546f6157d509093e645d9d023faa5.png]: https://img-blog.csdnimg.cn/img_convert/5c7546f6157d509093e645d9d023faa5.png
[3312f5a60f7e251a49ccd630a973ce37.png]: https://img-blog.csdnimg.cn/img_convert/3312f5a60f7e251a49ccd630a973ce37.png
[ae49f227f5610ce6883504e0d546a86b.png]: https://img-blog.csdnimg.cn/img_convert/ae49f227f5610ce6883504e0d546a86b.png
[331938cd7596f400989163dd9120c97e.png]: https://img-blog.csdnimg.cn/img_convert/331938cd7596f400989163dd9120c97e.png
[07adada06c89580a44917170f431ed03.png]: https://img-blog.csdnimg.cn/img_convert/07adada06c89580a44917170f431ed03.png
[6a73e2b37e1adfc663642f1816bf7950.png]: https://img-blog.csdnimg.cn/img_convert/6a73e2b37e1adfc663642f1816bf7950.png
[OAuth2.0 _ 223]: https://blog.csdn.net/ACE_U_005A/article/details/128779217
[9205775c0df7dd3726353783e5ed9271.png]: https://img-blog.csdnimg.cn/img_convert/9205775c0df7dd3726353783e5ed9271.png
[00e99e42763fda47e9897e7390528db4.png]: https://img-blog.csdnimg.cn/img_convert/00e99e42763fda47e9897e7390528db4.png
[8fef1f85d074340da7a53c13ef9cc711.png]: https://img-blog.csdnimg.cn/img_convert/8fef1f85d074340da7a53c13ef9cc711.png
[2d70c85faf29154a0b3d41d0c5862c7d.png]: https://img-blog.csdnimg.cn/img_convert/2d70c85faf29154a0b3d41d0c5862c7d.png
[6936019b685190168698c0cc4a12a801.png]: https://img-blog.csdnimg.cn/img_convert/6936019b685190168698c0cc4a12a801.png
[1263acc4c762488cae8f1f44af0b0a63.png]: https://img-blog.csdnimg.cn/img_convert/1263acc4c762488cae8f1f44af0b0a63.png
[JSON Web Tokens - jwt.io]: https://jwt.io/
[00b8c74a08d70fd4195e924cbff01e0e.png]: https://img-blog.csdnimg.cn/img_convert/00b8c74a08d70fd4195e924cbff01e0e.png
[a56a5fdec760a1f8f1b2d66804ebfc0c.png]: https://img-blog.csdnimg.cn/img_convert/a56a5fdec760a1f8f1b2d66804ebfc0c.png
[e41c9b1219dad2373a2aac90be9fab18.png]: https://img-blog.csdnimg.cn/img_convert/e41c9b1219dad2373a2aac90be9fab18.png
[c970bf85190c2b7f1911073a6d2decf3.png]: https://img-blog.csdnimg.cn/img_convert/c970bf85190c2b7f1911073a6d2decf3.png
[27b393611563f6ff16bc92ab4e6302ca.png]: https://img-blog.csdnimg.cn/img_convert/27b393611563f6ff16bc92ab4e6302ca.png
[566ee45e7543e2e55b3c9c0c3e164318.png]: https://img-blog.csdnimg.cn/img_convert/566ee45e7543e2e55b3c9c0c3e164318.png
[e02807169a876d9668ed993622c8eb39.png]: https://img-blog.csdnimg.cn/img_convert/e02807169a876d9668ed993622c8eb39.png
[4c616c6797c5d5f46434fdd362b836ea.png]: https://img-blog.csdnimg.cn/img_convert/4c616c6797c5d5f46434fdd362b836ea.png
[2f22ee5532ed39d7be4aea41ce1febfb.png]: https://img-blog.csdnimg.cn/img_convert/2f22ee5532ed39d7be4aea41ce1febfb.png
[32f53c3212f21ee52625335ec1288b78.png]: https://img-blog.csdnimg.cn/img_convert/32f53c3212f21ee52625335ec1288b78.png
[a38254e42062858dfe1b4fc042023301.png]: https://img-blog.csdnimg.cn/img_convert/a38254e42062858dfe1b4fc042023301.png
[07ffe6a28b5c4bc795db391010ae84f2.png]: https://img-blog.csdnimg.cn/img_convert/07ffe6a28b5c4bc795db391010ae84f2.png
[723eb2d5966f408fa429aa2dba34c5b5.png]: https://img-blog.csdnimg.cn/img_convert/723eb2d5966f408fa429aa2dba34c5b5.png
[Spring Security _ 223]: https://blog.csdn.net/ACE_U_005A/article/details/123482893
[b0243be93e396a690b2dcdea1a101d63.png]: https://img-blog.csdnimg.cn/img_convert/b0243be93e396a690b2dcdea1a101d63.png
[3d0cd97307a3f9c6d84227e0c1755500.png]: https://img-blog.csdnimg.cn/img_convert/3d0cd97307a3f9c6d84227e0c1755500.png
[24125bc0181fb54f23928e6819932117.png]: https://img-blog.csdnimg.cn/img_convert/24125bc0181fb54f23928e6819932117.png
[05fce83ff673d88227670384223982bc.png]: https://img-blog.csdnimg.cn/img_convert/05fce83ff673d88227670384223982bc.png
[63321b4d3cc78cc28fc33d0db2984415.png]: https://img-blog.csdnimg.cn/img_convert/63321b4d3cc78cc28fc33d0db2984415.png
[a35324f5ea7336375277092acc14d197.png]: https://img-blog.csdnimg.cn/img_convert/a35324f5ea7336375277092acc14d197.png
[9dfa56e933798635c5fb2045ebe444db.png]: https://img-blog.csdnimg.cn/img_convert/9dfa56e933798635c5fb2045ebe444db.png
[3d959c7453b329d1afd0a6b0e2e60d6e.png]: https://img-blog.csdnimg.cn/img_convert/3d959c7453b329d1afd0a6b0e2e60d6e.png
[f617ddd2142127ae30e587fea910fae5.png]: https://img-blog.csdnimg.cn/img_convert/f617ddd2142127ae30e587fea910fae5.png
[6cdbd0d29d65b1071f120abb3b88d686.png]: https://img-blog.csdnimg.cn/img_convert/6cdbd0d29d65b1071f120abb3b88d686.png
[148f307d101f21af45982fb60b1486af.png]: https://img-blog.csdnimg.cn/img_convert/148f307d101f21af45982fb60b1486af.png
[4f667baa0aacb655106f74fd349317f5.png]: https://img-blog.csdnimg.cn/img_convert/4f667baa0aacb655106f74fd349317f5.png
[6a7e02bec1264b0ddaf1760b332e86a7.png]: https://img-blog.csdnimg.cn/img_convert/6a7e02bec1264b0ddaf1760b332e86a7.png
[76dc4b96d98296822f43fb50d61729ce.png]: https://img-blog.csdnimg.cn/img_convert/76dc4b96d98296822f43fb50d61729ce.png
[7863ea75cc58c9602f0cc23bec0d1ab3.png]: https://img-blog.csdnimg.cn/img_convert/7863ea75cc58c9602f0cc23bec0d1ab3.png
[6fd2ddda9092ca7c0b67ea71dd3ccef0.png]: https://img-blog.csdnimg.cn/img_convert/6fd2ddda9092ca7c0b67ea71dd3ccef0.png