Spring Security OAuth2认证/授权服务器的前世今生

心已赠人 2023-10-03 12:37 19阅读 0赞

> 小贴士：OAuth2中有几个概念：Authorization Server、Resource Server、Client…

原有的**授权服务器**（`Authorization Server`） 由 `Spring Security OAuth` 项目提供，通过SpringBoot和@EnableAuthorizationServer 注解可以很便捷的搭建一个Authorization Server。  
其maven依赖如下：

<dependency>
        <groupId>org.springframework.security.oauth.boot</groupId>
        <artifactId>spring-security-oauth2-autoconfigure</artifactId>
        <version>${spring-boot.version}</version>
    </dependency>

目前 `Spring Security OAuth` 项目已经宣布不在维护。而Spring团队宣布重新实现对`OAuth2`的支持，将相关的功能集成到 `Spring Security` 中。官方说明：[Next Generation OAuth 2.0 Support with Spring Security][]

Spring团队原计划只提供 OAuth2 中的 Client 和 Resource Server功能。  
无奈广大人民强烈请求提供Authorization Server 功能，所以Spring团队便单独启动了一个项目做支持，名为`Spring Authorization Server`。官方说明：[Announcing the Spring Authorization Server][]

Spring Authorization Server 主页为：[https://spring.io/projects/spring-authorization-server][https_spring.io_projects_spring-authorization-server]

其maven依赖为：

<dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-oauth2-authorization-server</artifactId>
        <version>0.3.1</version>
    </dependency>

[Next Generation OAuth 2.0 Support with Spring Security]: https://spring.io/blog/2018/01/30/next-generation-oauth-2-0-support-with-spring-security
[Announcing the Spring Authorization Server]: https://spring.io/blog/2020/04/15/announcing-the-spring-authorization-server
[https_spring.io_projects_spring-authorization-server]: https://spring.io/projects/spring-authorization-server