引入

@EnableOAuth2Client
@EnableConfigurationProperties(OAuth2SsoProperties.class)
@Import({ OAuth2SsoDefaultConfiguration.class, OAuth2SsoCustomConfiguration.class,ResourceServerTokenServicesConfiguration.class })
public @interface EnableOAuth2Sso {}

EnableOAuth2Sso注解引入了3个配置类：OAuth2SsoDefaultConfiguration，OAuth2SsoCustomConfiguration，ResourceServerTokenServicesConfiguration和一个属性类OAuth2SsoProperties。

OAuth2SsoProperties

OAuth2SsoProperties 主要用于设置单点登录login path。

@ConfigurationProperties(prefix = "security.oauth2.sso")
public class OAuth2SsoProperties {public static final String DEFAULT_LOGIN_PATH = "/login";
}

ResourceServerTokenServicesConfiguration

ResourceServerTokenServicesConfiguration用于引入资源服务，token服务的配置信息。

OAuth2SsoDefaultConfiguration

OAuth2SsoDefaultConfiguration实现WebSecurityConfigurerAdapter。所有资源都需要验证。

同时引入了配置SsoSecurityConfigurer。

 @Overrideprotected void configure(HttpSecurity http) throws Exception {http.antMatcher("/**").authorizeRequests().anyRequest().authenticated();new SsoSecurityConfigurer(this.applicationContext).configure(http);}

SsoSecurityConfigurer

SsoSecurityConfigurer引入了OAuth2ClientAuthenticationProcessingFilter 。

     @Overridepublic void configure(HttpSecurity builder) throws Exception {OAuth2ClientAuthenticationProcessingFilter ssoFilter = this.filter;ssoFilter.setSessionAuthenticationStrategy(builder.getSharedObject(SessionAuthenticationStrategy.class));builder.addFilterAfter(ssoFilter, AbstractPreAuthenticatedProcessingFilter.class);}

OAuth2ClientAuthenticationProcessingFilter

OAuth2ClientAuthenticationProcessingFilter过滤器其要完成的工作就是通过获取到的code码调用授权服务 /oauth/token 接口获取 token 信息，并将获取到的token 信息解析成 OAuth2Authentication 认证对象。

 @Overridepublic Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)throws AuthenticationException, IOException, ServletException {OAuth2AccessToken accessToken;try {accessToken = restTemplate.getAccessToken();} catch (OAuth2Exception e) {BadCredentialsException bad = new BadCredentialsException("Could not obtain access token", e);publish(new OAuth2AuthenticationFailureEvent(bad));throw bad;           }try {OAuth2Authentication result = tokenServices.loadAuthentication(accessToken.getValue());if (authenticationDetailsSource!=null) {request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_VALUE, accessToken.getValue());request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_TYPE, accessToken.getTokenType());result.setDetails(authenticationDetailsSource.buildDetails(request));}publish(new AuthenticationSuccessEvent(result));return result;}catch (InvalidTokenException e) {BadCredentialsException bad = new BadCredentialsException("Could not obtain user details from token", e);publish(new OAuth2AuthenticationFailureEvent(bad));throw bad;         }}

OAuth2SsoCustomConfiguration

OAuth2SsoCustomConfiguration用于给ProxyFactory增加AOP

public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {if (this.configType.isAssignableFrom(bean.getClass()) && bean instanceof WebSecurityConfigurerAdapter) {ProxyFactory factory = new ProxyFactory();factory.setTarget(bean);factory.addAdvice(new SsoSecurityAdapter(this.applicationContext));bean = factory.getProxy();}return bean;}

private static class SsoSecurityAdapter implements MethodInterceptor {private SsoSecurityConfigurer configurer;SsoSecurityAdapter(ApplicationContext applicationContext) {this.configurer = new SsoSecurityConfigurer(applicationContext);}@Overridepublic Object invoke(MethodInvocation invocation) throws Throwable {if (invocation.getMethod().getName().equals("init")) {Method method = ReflectionUtils.findMethod(WebSecurityConfigurerAdapter.class, "getHttp");ReflectionUtils.makeAccessible(method);HttpSecurity http = (HttpSecurity) ReflectionUtils.invokeMethod(method, invocation.getThis());this.configurer.configure(http);}return invocation.proceed();}}

Spring Security OAuth2源码解析（三）——单点登录。相关推荐

Spring Security OAuth2源码解析（一）
目录引入 AuthorizationServerEndpointsConfiguration 属性 AuthorizationEndpoint OAuth2RequestFactory Defaul ...
Spring Security OAuth2源码解析（二）
鉴权服务器对客户端鉴权之后,会生成token,客户端使用token,就可以去资源服务器获取资源. @EnableResourceServer @Import(ResourceServerConfig ...
Spring Security Oauth2 授权码模式下自定义登录、授权页面
主要说明:基于若依springcloud微服务框架的2.1版本嫌弃缩进不舒服的,直接访问我的博客站点: http://binarydance.top//aticle_view.html?aticle ...
JWT实战 Spring Security Oauth2整合JWT 整合SSO单点登录
文章目录一.JWT 1.1 什么是JWT 1.2 JWT组成头部(header) 载荷(payload) 签名(signature) 如何应用 1.3 JJWT 快速开始创建token toke ...
单点登录 cas 设置回调地址_cas客户端流程详解（源码解析）单点登录
博主之前一直使用了cas客户端进行用户的单点登录操作,决定进行源码分析来看cas的整个流程,以便以后出现了问题还不知道是什么原因导致的 cas主要的形式就是通过过滤器的形式来实现的,来,贴上示例配置: ...
Spring 之 @Cacheable 源码解析（下）
CacheInterceptor 缓存切面处理逻辑接着上篇 Spring 之 @Cacheable 源码解析(上) 说起,代理对象已经创建成功,接着分析调用流程.那么应该从哪里入手呢?当然是去看 A ...
spring aop 注入源码解析
spring aop 注入源码解析 aop启动 AbstractApplicationContext.java @Overridepublic void refresh() throws BeansE ...
spring aop 注入源码解析 1
spring aop 注入源码解析 aop启动 AbstractApplicationContext.java @Overridepublic void refresh() throws BeansE ...
Spring 之 @Cacheable 源码解析（上）
一.@EnableCaching 源码解析当要使用 @Cacheable 注解时需要引入 @EnableCaching 注解开启缓存功能.为什么呢?现在就来看看为什么要加入 @EnableCachi ...

Spring Security OAuth2源码解析（三）——单点登录。

引入