</dependency>
<!-- Spring cloud starter: Security -->
<!-- Include: web, actuator, security, zuul, etc. -->
<dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-starter-security</artifactId>
</dependency>
<!-- Spring Security OAuth2 Autoconfigure (optional in spring-cloud-security after 2.1) -->
<dependency><groupId>org.springframework.security.oauth.boot</groupId><artifactId>spring-security-oauth2-autoconfigure</artifactId>
</dependency>

package com.mytools.config;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;/*** Spring Security Configuration.*/
@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {@Autowiredprivate UserDetailsService userDetailsService;/*** password encodeer*/@Beanpublic PasswordEncoder passwordEncoder() {return PasswordEncoderFactories.createDelegatingPasswordEncoder();}@Override@Beanpublic AuthenticationManager authenticationManagerBean() throws Exception {return super.authenticationManagerBean();}/* (non-Javadoc)* @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.web.builders.HttpSecurity)*/@Overrideprotected void configure(HttpSecurity http) throws Exception {//@formatter:offhttp.authorizeRequests() // configure authorize request rule.antMatchers("/index").permitAll()// .antMatchers("/url/**").hasRole("ADMIN") // some urls have access ADMIN// .anyRequest().authenticated() // any other request need to authenticate
                .and().formLogin() // login as form.loginPage("/login") // login url (default is login page with framework)// .defaultSuccessUrl("/index") // login success url (default is index).failureUrl("/login-error") // login fail url
                .and()// .logout() // logout config// .logoutUrl("/logout") // logout url (default is logout)// .logoutSuccessUrl("/index") // logout success url (default is login).rememberMe() // Remember me.key("uniqueAndSecret") // generate the contents of the token.tokenValiditySeconds(60 * 60 * 24 * 30) // 30 days.userDetailsService(userDetailsService) // register UserDetailsService for remember me functionality// .and()//.httpBasic() // use HTTP Basic authentication(in header) for an application
        ;//@formatter:on
    }
}

package com.mytools.config;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.ClientDetailsService;/*** OAuth2 Authorization Server Configuration.*/
@Configuration
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {@Autowiredprivate AuthenticationManager authenticationManager;@Autowiredprivate UserDetailsService userDetailsService;@Autowiredprivate ClientDetailsService clientDetailsService;/*** 用来配置令牌端点(Token Endpoint)的安全约束<br>* * @see org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter#configure(org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer)*/@Overridepublic void configure(AuthorizationServerSecurityConfigurer security) throws Exception {// 如果配置这个的话，且url中有client_id和client_secret的会走ClientCredentialsTokenEndpointFilter来保护// 如果没有配置这个，或者配置了这个但是url中没有client_id和client_secret的，走basic认证保护// [IMPORTANT] 这里如果不设置，client app里的clientAuthenticationScheme应该设置为header，反之设置为form// security.allowFormAuthenticationForClients();
    }/*** 用来配置客户端详情服务（ClientDetailsService），客户端详情信息在这里进行初始化<br>* * @see org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter#configure(org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer)*/@Overridepublic void configure(ClientDetailsServiceConfigurer clients) throws Exception {clients.withClientDetails(clientDetailsService);}/* 定义授权和令牌端点以及令牌服务<br>* @see org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter#configure(org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer)*/@Overridepublic void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {endpoints.authenticationManager(authenticationManager) // 使用Spring提供的AuthenticationManager开启密码授权.userDetailsService(userDetailsService) // 注入一个 UserDetailsService，那么刷新令牌授权将包含对用户详细信息的检查，以确保该帐户仍然是活动的.allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST); // 默认只支持POST
    }
}

package com.mytools.config;import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;/*** OAuth2 Resource Server Configuration.*/
@Configuration
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {/*** ResourceId: We can give each of the ResourceServer instance to a resourceId.<br>* Here is the resourceId validation on OAuth2AuthenticationManager#authenticate:<br>* * <pre>* Collection<String> resourceIds = auth.getOAuth2Request().getResourceIds();* if (resourceId != null && resourceIds != null && !resourceIds.isEmpty() && !resourceIds.contains(resourceId)) {*     throw new OAuth2AccessDeniedException("Invalid token does not contain resource id (" + resourceId + ")");* }* </pre>* * @throws Exception*/@Overridepublic void configure(ResourceServerSecurityConfigurer resources) throws Exception {resources.resourceId("server-auth-resource");super.configure(resources);}@Overridepublic void configure(HttpSecurity http) throws Exception {// [IMPORTANT] 为什么要提前加antMatcher? 可以看一下antMatcher()的注释:// Allows configuring the HttpSecurity to only be invoked when matching the provided ant pattern.http.antMatcher("/user").authorizeRequests()// .antMatchers("xxx", "xxx").permitAll()
                .anyRequest().authenticated();}
}

package com.mytools;import java.util.HashMap;
import java.util.Map;import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;@SpringBootApplication
@RestController
@EnableAuthorizationServer
@EnableResourceServer
public class ServerAuthApplication2 {public static void main(String[] args) {SpringApplication.run(ServerAuthApplication2.class, args);}/*** 映射到/user, Resource Server会调用该端点<br>* Resource Server中的@EnableResourceServer会强制执行一个过滤器，<br>* 该拦截器会用传入的token回调[security.oauth2.resource.userInfoUri]中定义的URI来查看令牌是否有效。<br>* 此外，该URI还会从Authorization Server传回一个Map，包含Principal and GrantedAuthority信息。<br>* 这个信息是必须的。详细请看：UserInfoTokenServices.loadAuthentication<br>* * @param user* @return*/@RequestMapping(value = "/user", produces = "application/json")public Map<String, Object> user(OAuth2Authentication user, @RequestParam(required = false) String client) {Map<String, Object> userInfo = new HashMap<>();userInfo.put("user", user.getUserAuthentication().getName());userInfo.put("authorities", AuthorityUtils.authorityListToSet(user.getUserAuthentication().getAuthorities()));return userInfo;}
}

-- Create user
INSERT INTO user (username, password, email, enabled, create_user, create_date_time, update_user, update_date_time)
VALUES ('admin', '{bcrypt}$2a$10$bmixgIna/bd5gU5ORrWng.xUs2sGBh3BRqj927ChKkAvJA8CVGZmm', 'admin@email.com', true, 'admin', '2019-01-01 10:00:00.000', 'admin', '2019-01-01 10:00:00.000');-- Create client
INSERT INTO client (client_id, client_secret, authorized_grant_types_str, registered_redirect_uris_str, enabled, create_user, create_date_time, update_user, update_date_time)
VALUES ('dummy-client', '{bcrypt}$2a$10$nbLJ9DdK/HLlKc.Gm/5S4utfxht9D3mj5M7cm9peFDbBGgTLPEh0u', 'authorization_code,password', 'https://www.google.com', true, 'admin', '2019-01-01 10:00:00.000', 'admin', '2019-01-01 10:00:00.000');-- Create role
INSERT INTO role (rolename, role_level, enabled, create_user, create_date_time, update_user, update_date_time)
VALUES ('ADMIN', 1, true, 'admin', '2019-01-01 10:00:00.000', 'admin', '2019-01-01 10:00:00.000');-- Create user_role_map
INSERT INTO user_role_map (username, rolename)
VALUES ('admin', 'ADMIN');

## Eureka info
eureka:# 如果设置了true并且也设置了eureka.instance.ip-address那么就将此ip地址注册到Eureka中，那么调用的时候，发送的请求目的地就是此Ip地址instance:preferIpAddress: trueipAddress: localhost

## Zuul info
zuul:# Zuul不会将敏感HTTP首部（如Cookie,Set-Cookie,Authorization）转发到下游服务。它是一个黑名单。这里排除了Cookie,Set-Cookie,Authorization为后面的OAuth2服务sensitiveHeaders: