<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!-- https://mvnrepository.com/artifact/org.springframework.security.oauth/spring-security-oauth2 --><dependency><groupId>org.springframework.security.oauth</groupId><artifactId>spring-security-oauth2</artifactId><version>2.3.5.RELEASE</version>
</dependency>

/*** 认证服务器配置* @author ltzhang* @time 2019-11-28*/
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {/*** 注入权限验证控制器 来支持 password grant type*/@Autowiredprivate AuthenticationManager authenticationManager;/*** 注入userDetailsService，开启refresh_token需要用到*/@Autowiredprivate MyUserDetailsService userDetailsService;/*** 数据源*/@Autowiredprivate DataSource dataSource;@Autowiredprivate RedisConnectionFactory connectionFactory;@Autowiredprivate MyOAuth2WebResponseExceptionTranslator webResponseExceptionTranslator;@Beanpublic TokenStore tokenStore() {// token 相关信息保存在 redis 中return new RedisTokenStore( connectionFactory );}@Overridepublic void configure(AuthorizationServerSecurityConfigurer security) throws Exception {security.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()").allowFormAuthenticationForClients();}@Overridepublic void configure(ClientDetailsServiceConfigurer clients) throws Exception {// 客户端信息保存在数据库中：表 oauth_client_details// 如果oauth_client_details表中将autoApprove设置为true，// 这样我们就不会重定向和提升为手动批准任何范围clients.jdbc(dataSource);}@Overridepublic void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {//开启密码授权类型endpoints.authenticationManager(authenticationManager);//配置token存储方式endpoints.tokenStore(tokenStore());//自定义登录或者鉴权失败时的返回信息endpoints.exceptionTranslator(webResponseExceptionTranslator);//要使用refresh_token的话，需要额外配置userDetailsServiceendpoints.userDetailsService( userDetailsService );endpoints.allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST);}
}

/*** 资源提供端的配置*/
@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {@Autowiredprivate RestAuthAccessDeniedHandler deniedHandler;@Autowiredprivate MyAuthenticationEntryPoint authenticationEntryPoint;/*** 这里设置需要token验证的url* 可以在WebSecurityConfigurerAdapter中排除掉，* 对于相同的url，如果二者都配置了验证* 则优先进入ResourceServerConfigurerAdapter,进行token验证。而不会进行* WebSecurityConfigurerAdapter 的 basic auth或表单认证。*/@Overridepublic void configure(HttpSecurity http) throws Exception {http.requestMatchers().antMatchers("/user/me").and().authorizeRequests().antMatchers("/user/me").authenticated();//需要的时候创建session，支持从session中获取认证信息，ResourceServerConfiguration中//session创建策略是stateless不使用，这里其覆盖配置可创建sessionhttp.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);}@Overridepublic void configure(ResourceServerSecurityConfigurer resources) {resources.authenticationEntryPoint(authenticationEntryPoint).accessDeniedHandler(deniedHandler);//此处是关键，默认stateless=true，只支持access_token形式，// OAuth2客户端连接需要使用session，所以需要设置成false以支持session授权resources.stateless(false);}
}

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class BrowerSecurityConfig extends WebSecurityConfigurerAdapter {@Autowiredprivate SecurityAuthenticationProvider provider;/*** 如若需从数据库动态判断权限则实现 AccessDecisionManager* @param http* @throws Exception*/@Overrideprotected void configure(HttpSecurity http) throws Exception {http.antMatcher("/**").authorizeRequests().antMatchers("/login", "/oauth/authorize**").permitAll().anyRequest().authenticated().and().formLogin().loginPage("/login").failureUrl("/login?error=true").permitAll().and().logout().invalidateHttpSession(true).clearAuthentication(true).logoutUrl("/logout").and()//配置没有权限的自定义处理类.exceptionHandling().accessDeniedPage("/403"); // 处理异常，拒绝访问就重定向到 403 页面// 设置跨域问题http.cors().and().csrf().disable();http.sessionManagement().invalidSessionUrl("/login");//单用户登录，如果有一个登录了，同一个用户在其他地方不能登录http.sessionManagement().maximumSessions(1).maxSessionsPreventsLogin(true);}@Overridepublic void configure(WebSecurity web) throws Exception {web.ignoring().antMatchers("/assets/**");}/*** 自定义验证逻辑* @param auth* @throws Exception*/@Overrideprotected void configure(AuthenticationManagerBuilder auth){auth.authenticationProvider(provider);}@Override@Beanpublic AuthenticationManager authenticationManagerBean() throws Exception{return super.authenticationManager();}@Beanpublic PasswordEncoder passwordEncoder() {return new BCryptPasswordEncoder();}}

<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency><groupId>org.springframework.security.oauth.boot</groupId><artifactId>spring-security-oauth2-autoconfigure</artifactId><version>2.0.1.RELEASE</version>
</dependency>

@Configuration
@EnableOAuth2Sso
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {@Autowiredprivate RestAuthAccessDeniedHandler deniedHandler;@Overridepublic void configure(HttpSecurity http) throws Exception {http.authorizeRequests().anyRequest().authenticated().and().logout().invalidateHttpSession(true).clearAuthentication(true).logoutSuccessUrl("http://localhost:8081/auth/logout").and()//配置没有权限的自定义处理类.exceptionHandling().accessDeniedHandler(deniedHandler);http.csrf().disable();// security 不开启 登录验证http.httpBasic().disable();}
}

server:port: 8082servlet:context-path: /uisession:cookie:name: UISESSIONsecurity:oauth2:client:clientId: devclientSecret: 11accessTokenUri: http://localhost:8081/auth/oauth/tokenuserAuthorizationUri: http://localhost:8081/auth/oauth/authorizeresource:userInfoUri: http://localhost:8081/auth/user/me