获取token（/oauth/token）

川长思鸟来 2024-02-19 12:10 35阅读 0赞

1、入口方法（spring-security-oauth2-2.0.14.RELEASE-sources.jar）

@FrameworkEndpoint
    public class TokenEndpoint extends AbstractEndpoint {
    
        @RequestMapping(value = "/oauth/token", method=RequestMethod.POST)
        public ResponseEntity<OAuth2AccessToken> postAccessToken(Principal principal, @RequestParam Map<String, String> parameters) throws HttpRequestMethodNotSupportedException{
            if (!(principal instanceof Authentication)) {
                throw new InsufficientAuthenticationException("There is no client authentication. Try adding an appropriate authentication filter.");
            }
    
            String clientId = getClientId(principal);
            ClientDetails authenticatedClient = getClientDetailsService().loadClientByClientId(clientId);
    
            TokenRequest tokenRequest = getOAuth2RequestFactory().createTokenRequest(parameters, authenticatedClient);
    
            if (clientId != null && !clientId.equals("")) {
                // Only validate the client details if a client authenticated during this
                // request.
                if (!clientId.equals(tokenRequest.getClientId())) {
                    // double check to make sure that the client ID in the token request is the same as that in the
                    // authenticated client
                    throw new InvalidClientException("Given client ID does not match authenticated client");
                }
            }
            if (authenticatedClient != null) {
                oAuth2RequestValidator.validateScope(tokenRequest, authenticatedClient);
            }
            if (!StringUtils.hasText(tokenRequest.getGrantType())) {
                throw new InvalidRequestException("Missing grant type");
            }
            if (tokenRequest.getGrantType().equals("implicit")) {
                throw new InvalidGrantException("Implicit grant type not supported from token endpoint");
            }
    
            if (isAuthCodeRequest(parameters)) {
                // The scope was requested or determined during the authorization step
                if (!tokenRequest.getScope().isEmpty()) {
                    logger.debug("Clearing scope of incoming token request");
                    tokenRequest.setScope(Collections.<String> emptySet());
                }
            }
    
            if (isRefreshTokenRequest(parameters)) {
                // A refresh token has its own default scopes, so we should ignore any added by the factory here.
                tokenRequest.setScope(OAuth2Utils.parseParameterList(parameters.get(OAuth2Utils.SCOPE)));
            }
    
            OAuth2AccessToken token = getTokenGranter().grant(tokenRequest.getGrantType(), tokenRequest);
            if (token == null) {
                throw new UnsupportedGrantTypeException("Unsupported grant type: " + tokenRequest.getGrantType());
            }
    
            return getResponse(token);
        }
    
        /**
    	 * @param principal the currently authentication principal
    	 * @return a client id if there is one in the principal
    	 */
        protected String getClientId(Principal principal) {
            Authentication client = (Authentication) principal;
            if (!client.isAuthenticated()) {
                throw new InsufficientAuthenticationException("The client is not authenticated.");
            }
            String clientId = client.getName();
            if (client instanceof OAuth2Authentication) {
                // Might be a client and user combined authentication
                clientId = ((OAuth2Authentication) client).getOAuth2Request().getClientId();
            }
            return clientId;
        }
    
    }

public interface Principal{...}
    
    public interface Authentication extends Principal, Serializable {...}
    
    public abstract class AbstractAuthenticationToken implements Authentication,
    		CredentialsContainer {
        public String getName() {
            if (this.getPrincipal() instanceof UserDetails) {
                return ((UserDetails) this.getPrincipal()).getUsername();
            }
    
            if (getPrincipal() instanceof Principal) {
                return ((Principal) getPrincipal()).getName();
            }
    
            return (this.getPrincipal() == null) ? "" : this.getPrincipal().toString();
        }
    }

![70][]

2、

public abstract class AbstractTokenGranter implements TokenGranter {
    	public OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest) {
    
            if (!this.grantType.equals(grantType)) {
                return null;
            }
    		
            String clientId = tokenRequest.getClientId();
            ClientDetails client = clientDetailsService.loadClientByClientId(clientId);
            validateGrantType(grantType, client);
    		
            logger.debug("Getting access token for: " + clientId);
    
            return getAccessToken(client, tokenRequest);
    
    	}
    
        protected OAuth2AccessToken getAccessToken(ClientDetails client, TokenRequest tokenRequest) {
            return tokenServices.createAccessToken(getOAuth2Authentication(client, tokenRequest));
        }
    }

3、

public interface AuthorizationServerTokenServices {
        OAuth2AccessToken createAccessToken(OAuth2Authentication authentication) throws AuthenticationException;
    }

public class DefaultTokenServices implements AuthorizationServerTokenServices, ResourceServerTokenServices, ConsumerTokenServices, InitializingBean {
    
    }

4、

public class WeafTokenServices extends DefaultTokenServices {
        @Transactional
        public OAuth2AccessToken createAccessToken(OAuth2Authentication authentication) throws AuthenticationException {
            OAuth2AccessToken existingAccessToken = this.tokenStore.getAccessToken(authentication);
            OAuth2RefreshToken refreshToken = null;
            if(existingAccessToken != null) {
                String clientId = authentication.getOAuth2Request().getClientId();
                Boolean kickUser = null;
                for (WeafSecurityProperties.SecurityClient securityClient : weafSecurityProperties.getClients()) {
                    if (securityClient.getClientId().equals(clientId)) {
                        kickUser = securityClient.getKickUser();
                        break;
                    }
                }
                //当前客户端支持踢人模式，则直接将该人员的远token全部删除
                if (kickUser) {
                    if(existingAccessToken.getRefreshToken() != null) {
                        refreshToken = existingAccessToken.getRefreshToken();
                        this.tokenStore.removeRefreshToken(refreshToken);
                    }
                    this.tokenStore.removeAccessToken(existingAccessToken);
                } else {
                    //该客户端不是踢人模式，所以如果原token存在，则获取原token,如果远token过期则重新生成.
                    if (existingAccessToken.isExpired()) {
                        if (existingAccessToken.getRefreshToken() != null) {
                            refreshToken = existingAccessToken.getRefreshToken();
                            // The token store could remove the refresh token when the
                            // access token is removed, but we want to
                            // be sure...
                            tokenStore.removeRefreshToken(refreshToken);
                        }
                        tokenStore.removeAccessToken(existingAccessToken);
                    }
                    else {
                        // Re-store the access token in case the authentication has changed
                        tokenStore.storeAccessToken(existingAccessToken, authentication);
                        return existingAccessToken;
                    }
                }
            }
    
            if(refreshToken == null) {
                refreshToken = this.createRefreshToken(authentication);
            } else if(refreshToken instanceof ExpiringOAuth2RefreshToken) {
                ExpiringOAuth2RefreshToken expiring = (ExpiringOAuth2RefreshToken)refreshToken;
                if(System.currentTimeMillis() > expiring.getExpiration().getTime()) {
                    refreshToken = this.createRefreshToken(authentication);
                }
            }
            OAuth2AccessToken accessToken = this.createAccessToken(authentication, refreshToken);
            this.tokenStore.storeAccessToken(accessToken, authentication);
            refreshToken = accessToken.getRefreshToken();
            if(refreshToken != null) {
                this.tokenStore.storeRefreshToken(refreshToken, authentication);
            }
    
            return accessToken;
        }
    
        private OAuth2AccessToken createAccessToken(OAuth2Authentication authentication, OAuth2RefreshToken refreshToken) {
            DefaultOAuth2AccessToken token = new DefaultOAuth2AccessToken(UUID.randomUUID().toString());
            int validitySeconds = this.getAccessTokenValiditySeconds(authentication.getOAuth2Request());
            if(validitySeconds > 0) {
                token.setExpiration(new Date(System.currentTimeMillis() + (long)validitySeconds * 1000L));
            }
    
            token.setRefreshToken(refreshToken);
            token.setScope(authentication.getOAuth2Request().getScope());
            if (token.getAdditionalInformation() == null) {
                Map<String, Object> additionInformation = new HashMap<>();
                additionInformation.put(WeafConstants.Security.CLIENT_ID, authentication.getOAuth2Request().getClientId());
                token.setAdditionalInformation(Collections.unmodifiableMap(additionInformation));
            } else {
                Map<String, Object> tempMap = new HashMap<>();
                tempMap.putAll(token.getAdditionalInformation());
                tempMap.put(ACCESS_TOKEN_ADDITION_CLIENT_ID, authentication.getOAuth2Request().getClientId());
                token.setAdditionalInformation(Collections.unmodifiableMap(tempMap));
            }
            return (OAuth2AccessToken)(this.accessTokenEnhancer != null?this.accessTokenEnhancer.enhance(token, authentication):token);
        }
    
        private OAuth2RefreshToken createRefreshToken(OAuth2Authentication authentication) {
            if(!this.isSupportRefreshToken(authentication.getOAuth2Request())) {
                return null;
            } else {
                int validitySeconds = this.getRefreshTokenValiditySeconds(authentication.getOAuth2Request());
                String value = UUID.randomUUID().toString();
                return (OAuth2RefreshToken)(validitySeconds > 0?new DefaultExpiringOAuth2RefreshToken(value, new Date(System.currentTimeMillis() + (long)validitySeconds * 1000L)):new DefaultOAuth2RefreshToken(value));
            }
        }
    
    }

[70]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/ce9bedddce7340f9ad1bcd73f9df6c56.png