Spring Boot 2.0 利用 Spring Security 实现简单的OAuth2.0认证方式1

0. 前言

　　之前帐号认证用过自己写的进行匹配，现在要学会使用标准了。准备了解和使用这个OAuth2.0协议。

1. 配置

1.1 配置pom.xml

　　有些可能会用不到，我把我项目中用到的所有包都贴出来。

 1         <dependency>
 2             <groupId>org.springframework.boot</groupId>
 3             <artifactId>spring-boot-starter-data-redis</artifactId>
 4         </dependency>
 5         <dependency>
 6             <groupId>org.springframework.boot</groupId>
 7             <artifactId>spring-boot-starter-security</artifactId>
 8         </dependency>
 9         <dependency>
10             <groupId>org.springframework.security.oauth</groupId>
11             <artifactId>spring-security-oauth2</artifactId>
12             <version>2.3.3.RELEASE</version>
13         </dependency>
14         <dependency>
15             <groupId>org.springframework.boot</groupId>
16             <artifactId>spring-boot-starter-web</artifactId>
17         </dependency>
18         <dependency>
19             <groupId>org.mybatis.spring.boot</groupId>
20             <artifactId>mybatis-spring-boot-starter</artifactId>
21             <version>1.3.2</version>
22         </dependency>
23         <!-- https://mvnrepository.com/artifact/com.github.pagehelper/pagehelper-spring-boot-starter -->
24         <dependency>
25             <groupId>com.github.pagehelper</groupId>
26             <artifactId>pagehelper-spring-boot-starter</artifactId>
27             <version>1.2.5</version>
28         </dependency>
29         <dependency>
30             <groupId>org.springframework.cloud</groupId>
31             <artifactId>spring-cloud-starter-oauth2</artifactId>
32         </dependency>
33         <dependency>
34             <groupId>org.springframework.cloud</groupId>
35             <artifactId>spring-cloud-starter-security</artifactId>
36         </dependency>
37
38         <dependency>
39             <groupId>org.springframework.boot</groupId>
40             <artifactId>spring-boot-devtools</artifactId>
41             <scope>runtime</scope>
42         </dependency>
43         <dependency>
44             <groupId>org.postgresql</groupId>
45             <artifactId>postgresql</artifactId>
46             <scope>runtime</scope>
47         </dependency>
48         <dependency>
49             <groupId>org.springframework.boot</groupId>
50             <artifactId>spring-boot-starter-test</artifactId>
51             <scope>test</scope>
52         </dependency>
53         <dependency>
54             <groupId>org.springframework.security</groupId>
55             <artifactId>spring-security-test</artifactId>
56             <scope>test</scope>
57         </dependency>

1.2 配置application.properties

 1 #server
 2 server.port=8080
 3 server.servlet.session.timeout=2520000
 4 #redis
 5 spring.redis.database=0
 6 spring.redis.host=172.16.23.203
 7 spring.redis.port=6379
 8 spring.redis.password=
 9 spring.redis.jedis.pool.max-active=8
10 spring.redis.jedis.pool.max-wait=60
11 spring.redis.jedis.pool.max-idle=8
12 spring.redis.jedis.pool.min-idle=0
13 spring.redis.timeout=10000

1.3 资源服务器配置

 1 /**
 2  * OAuth 资源服务器配置
 3  * @author
 4  * @date 2018-05-29
 5  */
 6 @Configuration
 7 @EnableResourceServer
 8 public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
 9
10     private static final String DEMO_RESOURCE_ID = "order";
11
12     @Override
13     public void configure(ResourceServerSecurityConfigurer resources) {
14         resources.resourceId(DEMO_RESOURCE_ID).stateless(true);
15     }
16
17     @Override
18     public void configure(HttpSecurity http) throws Exception {
19         // Since we want the protected resources to be accessible in the UI as well we need
20         // session creation to be allowed (it's disabled by default in 2.0.6)
21         http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
22             .and()
23             .requestMatchers().anyRequest()
24             .and()
25             .anonymous()
26             .and()
27             .authorizeRequests()
28             .antMatchers("/order/**").authenticated();//配置order访问控制，必须认证过后才可以访问
29     }
30 }

1.4 授权服务器配置

 1 /**
 2  * OAuth 授权服务器配置
 3  * @author
 4  * @date 2018-05-29
 5  */
 6 @Configuration
 7 @EnableAuthorizationServer
 8 public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
 9
10     private static final String DEMO_RESOURCE_ID = "order";
11
12     @Autowired
13     AuthenticationManager authenticationManager;
14     @Autowired
15     RedisConnectionFactory redisConnectionFactory;
16
17     @Override
18     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
19         String finalSecret = "{bcrypt}"+new BCryptPasswordEncoder().encode("123456");
20         //配置两个客户端,一个用于password认证一个用于client认证
21         clients.inMemory()
22             .withClient("client_1")
23             .resourceIds(DEMO_RESOURCE_ID)
24             .authorizedGrantTypes("client_credentials", "refresh_token")
25             .scopes("select")
26             .authorities("oauth2")
27             .secret(finalSecret)
28             .and()
29             .withClient("client_2")
30             .resourceIds(DEMO_RESOURCE_ID)
31             .authorizedGrantTypes("password", "refresh_token")
32             .scopes("select")
33             .authorities("oauth2")
34             .secret(finalSecret);
35     }
36
37     @Override
38     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
39         endpoints
40                 .tokenStore(new RedisTokenStore(redisConnectionFactory))
41                 .authenticationManager(authenticationManager)
42                 .allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST);
43     }
44
45     @Override
46     public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
47         //允许表单认证
48         oauthServer.allowFormAuthenticationForClients();
49     }
50 }

1.5 Spring Security配置

 1 /**
 2  * Spring-Security 配置<br>
 3  * 具体参考: https://github.com/lexburner/oauth2-demo
 4  * @author
 5  * @date 2018-05-28
 6  */
 7 @Configuration
 8 @EnableWebSecurity
 9 public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
10
11     @Bean
12     @Override
13     protected UserDetailsService userDetailsService(){
14         InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
15         BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();
16         String finalPassword = "{bcrypt}"+bCryptPasswordEncoder.encode("123456");
17         manager.createUser(User.withUsername("user_1").password(finalPassword).authorities("USER").build());
18         finalPassword = "{noop}123456";
19         manager.createUser(User.withUsername("user_2").password(finalPassword).authorities("USER").build());
20         return manager;
21     }
22
23     @Override
24     protected void configure(HttpSecurity http) throws Exception {
25         http
26             .requestMatchers().anyRequest()
27             .and()
28                 .authorizeRequests()
29                 .antMatchers("/oauth/*").permitAll();
30     }
31
32     /**
33      * Spring Boot 2 配置，这里要bean 注入
34      */
35     @Bean
36     @Override
37     public AuthenticationManager authenticationManagerBean() throws Exception {
38         AuthenticationManager manager = super.authenticationManagerBean();
39         return manager;
40     }
41
42     @Bean
43     PasswordEncoder passwordEncoder() {
44         return PasswordEncoderFactories.createDelegatingPasswordEncoder();
45     }

1.6 定义一个资源点

 1 @RestController
 2 @RequestMapping(value="/")
 3 public class TestController {
 4
 5     @RequestMapping(value="order/demo")
 6     public YYModel getDemo() {
 7         Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 8         System.out.println(auth);
 9         YYModel yy = new YYModel();
10         yy.setYy("中文");
11         yy.setZz(3);
12         return yy;
13     }
14
15     @GetMapping("/test")
16     public String getTest() {
17         YYModel yy = new YYModel();
18         yy.setYy("中文");
19         yy.setZz(3);
20         return yy.toJSONString();
21     }
22 }

2. 工具测试

　　参考: http://blog.didispace.com/spring-security-oauth2-xjf-1/

转载于:https://www.cnblogs.com/wunaozai/p/9106351.html

Spring Boot 2.0 利用 Spring Security 实现简单的OAuth2.0认证方式1相关推荐

spring boot java app_利用spring boot创建java app
利用spring boot创建java app 背景在使用spring框架开发的过程中,随着功能以及业务逻辑的日益复杂,应用伴随着大量的XML配置和复杂的bean依赖关系,特别是在使用mvc的时候各 ...
spring boot 是如何利用jackson进行序列化的？
接上一篇:spring boot 是如何利用jackson进行反序列化的? @RestController public class HelloController {@RequestMapping( ...
Spring Security并没有那么难嗷简单理解OAuth2.0
文章目录 1. 基本概念 1.1 什么是认证 1.2 什么是会话 1.3 什么是授权 1.4 授权的数据模型 1.5 RBAC 1.5.1 基于角色的访问控制 1.5.2 基于资源的访问控制 2. 基 ...
Spring Boot （一）Spring Boot 概述
Spring Boot(一) 一 . Spring Boot 是什么? 首先Spring Boot不是一个框架,它是一种用来轻松创建具有最小或零配置的独立应用程序的方式.这是方法用来开发基于Sprin ...
究竟什么是Spring Boot，和普通Spring项目有什么区别
究竟什么是Spring Boot,和普通Spring项目有什么区别背景最近我们打算重构设计一个公共包,其中涉及到的一个命题就是公共包要不要引入Spring Boot.那么问题来了究竟什么是Spri ...
Spring Boot(十七)：使用Spring Boot上传文件
Spring Boot(十七):使用Spring Boot上传文件环境:Spring Boot最新版本1.5.9.jdk使用1.8.tomcat8.0 一.pom包配置 <parent> ...
spring boot测试_测试Spring Boot有条件的合理方式
spring boot测试如果您或多或少有经验的Spring Boot用户,那么很幸运,在某些时候您可能需要遇到必须有条件地注入特定bean或配置的情况 . 它的机制是很好理解的 ,但有时这样的测试 ...
Spring Boot(十四)：spring boot整合shiro-登录认证和权限管理
Spring Boot(十四):spring boot整合shiro-登录认证和权限管理使用Spring Boot集成Apache Shiro.安全应该是互联网公司的一道生命线,几乎任何的公司都会涉 ...
（转）Spring Boot 2 (八)：Spring Boot 集成 Memcached
http://www.ityouknow.com/springboot/2018/09/01/spring-boot-memcached.html Memcached 介绍 Memcached 是一个 ...

Spring Boot 2.0 利用 Spring Security 实现简单的OAuth2.0认证方式1

Spring Boot 2.0 利用 Spring Security 实现简单的OAuth2.0认证方式1相关推荐

最新文章

热门文章