<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId>
</dependency>
​
<dependency><groupId>org.springframework.security.oauth.boot</groupId><artifactId>spring-security-oauth2-autoconfigure</artifactId><version>2.2.5.RELEASE</version>
</dependency>

@Slf4j
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, jsr250Enabled = true, securedEnabled = true)
public class MooseWebSecurityConfiguration extends WebSecurityConfigurerAdapter {​@Bean@Overridepublic UserDetailsService userDetailsServiceBean() throws Exception {return new UserDetailsServiceImpl();}
​@Overrideprotected void configure(AuthenticationManagerBuilder auth) throws Exception {auth.userDetailsService(userDetailsServiceBean());}
​/*** 用于支持 password 模式 密码模式需要 AuthenticationManager 支持* password 模式一点要加上这个* @throws Exception*/@Bean@Overridepublic AuthenticationManager authenticationManagerBean() throws Exception {return super.authenticationManagerBean();}
}

/*** 资源认证配置* <p>* Description:* </p>** @author taohua* @version v1.0.0* @see com.moose.operator.web.security.configure* <p>* [/oauth/authorize] [/oauth/token] [/oauth/check_token]* [/oauth/confirm_access] [/oauth/token_key] [/oauth/error]*/
@Configuration
@EnableAuthorizationServer
public class MooseAuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {​/*** 注入用于支持 password 模式*/@Resourceprivate AuthenticationManager authenticationManager;
​@Resourceprivate AccountService accountService;
​/*** 需要加上，避免循环依赖问题*/@Lazy@Resource(name = "userDetailsServiceBean")private UserDetailsService userDetailsService;
​@Resourceprivate DataSource dataSource;
​@Resourceprivate WebResponseExceptionTranslator customOAuth2ResponseExceptionTranslator;
​/*** 设置用户密码的加密方式*/@Beanpublic BCryptPasswordEncoder passwordEncoder() {return new BCryptPasswordEncoder();}
​/*** Token 持久化** @return TokenStore*/@Beanpublic TokenStore tokenStore() {// 基于 JDBC 实现，令牌保存到数据库return new JdbcTokenStore(dataSource);}
​/*** A service that provides the details about an OAuth2 client.** @return ClientDetailsService* <p>* 基于 JDBC 实现，需要事先在数据库配置客户端信息*/@Beanpublic ClientDetailsService jdbcClientDetailsService() {return new JdbcClientDetailsService(dataSource);}
​/*** Authorization Server endpoints.** @throws Exception*/@Overridepublic void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {endpoints.tokenStore(tokenStore()).exceptionTranslator(customOAuth2ResponseExceptionTranslator);
​// 用于支持密码模式endpoints.authenticationManager(authenticationManager);}
​/*** 授权服务安全配置** @throws Exception*/@Overridepublic void configure(AuthorizationServerSecurityConfigurer oauthServer)throws Exception {oauthServer.passwordEncoder(passwordEncoder());
​/*** 对于端点可以匿名访问* [/oauth/authorize] [/oauth/token] [/oauth/check_token]* [/oauth/confirm_access] [/oauth/token_key] [/oauth/error]*/oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("permitAll()").allowFormAuthenticationForClients();}
​/*** 授权客户端配置** @throws Exception*/@Overridepublic void configure(ClientDetailsServiceConfigurer clients) throws Exception {// 客户端配置clients.withClientDetails(jdbcClientDetailsService());}
}

@Configuration
@EnableResourceServer
public class MooseResourceServerConfiguration extends ResourceServerConfigurerAdapter {​/*** 保存匿名访问的 url，表示可以不需要权限直接可以访问*/private final List<String> anonymousAntPatterns = new ArrayList<>();
​@Resourceprivate MooseAuthenticationFailureHandler mooseAuthenticationFailureHandler;
​@Resourceprivate MooseAccessDeniedHandler mooseAccessDeniedHandler;
​@Resourceprivate MooseAuthenticationEntryPoint mooseAuthenticationEntryPoint;
​/*** 需要加上，避免循环依赖问题*/@Lazy@Resourceprivate TokenStore tokenStore;
​@Overridepublic void configure(HttpSecurity http) throws Exception {​http.authorizeRequests().antMatchers(HttpMethod.OPTIONS, "/**").permitAll();
​// 对登录注册要允许匿名访问for (String pattern : anonymousAntPatterns) {http.authorizeRequests().antMatchers(pattern).permitAll();}
​// 禁用 sessionhttp.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().authorizeRequests().anyRequest().authenticated().and().cors().and().csrf().disable();}
​@Overridepublic void configure(ResourceServerSecurityConfigurer resources) throws Exception {// 配置资源 ID，需要在 oauth_client_details 表中添加，详细查看数据库脚本resources.resourceId("app-resources").stateless(true);resources.accessDeniedHandler(mooseAccessDeniedHandler);resources.authenticationEntryPoint(mooseAuthenticationEntryPoint);}
}

public class UserDetailsServiceImpl implements UserDetailsService {​@Resourceprivate AccountServiceImpl accountService;
​@Resourceprivate PasswordServiceImpl passwordService;
​/*** Spring Security** @param accountName 账号* @return 是否成功* @throws UsernameNotFoundException 用户名密码异常*/@Overridepublic UserDetails loadUserByUsername(String accountName)throws UsernameNotFoundException {​if (StringUtils.isEmpty(accountName)) {throw new BusinessException(ResultCode.ACCOUNT_IS_EMPTY);}
​AccountDTO accountDTO = accountService.getByAccountName(accountName);if (ObjectUtils.isEmpty(accountDTO)) {throw new BusinessException(ResultCode.ACCOUNT_OR_PASSWORD_ERROR);}
​// TODO: 禁用账号如何防止多次请求，访问数据库 ？？？
​PasswordDTO passwordDTO = passwordService.getByAccountId(accountDTO.getAccountId());if (ObjectUtils.isEmpty(passwordDTO)) {throw new BusinessException(ResultCode.ACCOUNT_OR_PASSWORD_ERROR);}
​// TODO: 角色、权限集合List<GrantedAuthority> grantedAuthorities = new ArrayList();grantedAuthorities.add(new SimpleGrantedAuthority("USER"));return new MooseUserDetails(accountDTO, passwordDTO, grantedAuthorities);}
}

# t_account 表
insert  into `t_account`(`account_id`,`account_name`,`status`,`phone`,`create_time`,`update_time`) values ('785919644115668992','江景','1','1537031501','2020-12-08 17:24:04','2020-12-08 17:24:04');
​
# t_password 表
insert  into `t_password`(`password_id`,`account_id`,`password`,`create_time`,`update_time`) values ('785919644115668993','785919644115668992','$2a$10$Ll17vDGG3DoABuy9L026KeqjAasYknMXR3cHmxiTyfDl9dS8RtGbi','2020-12-08 17:24:04','2020-12-08 17:24:04');