增加 password 授权模式下，基于 jdbc token store

lab-02/pom.xml

@@ -17,6 +17,8 @@
         <module>implicit-server</module>
         <module>client-credentials-server</module>
         <module>resource-owner-password-credentials-server-with-refresh-token</module>
+        <module>resource-owner-password-credentials-server-with-revoke-token</module>
+        <module>resource-owner-password-credentials-server-by-jdbc-token-store</module>
     </modules>
 
 

lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/pom.xml

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>1.5.16.RELEASE</version>
+        <relativePath /> <!-- lookup parent from repository -->
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>resource-owner-password-credentials-server-by-jdbc-token-store</artifactId>
+
+    <dependencies>
+        <!-- for Spring MVC -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <!-- for Spring Security -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+
+        <!-- for OAuth 2.0 -->
+        <dependency>
+            <groupId>org.springframework.security.oauth</groupId>
+            <artifactId>spring-security-oauth2</artifactId>
+        </dependency>
+
+        <!-- jdbc token store -->
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-jdbc</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>mysql</groupId>
+            <artifactId>mysql-connector-java</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+
+
+    </dependencies>
+
+</project>

lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/Application.java

@@ -0,0 +1,13 @@
+package lab02;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class Application {
+
+    public static void main(String[] args) {
+        SpringApplication.run(Application.class, args);
+    }
+
+}

lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/authorization/OAuth2AuthorizationServer.java

@@ -0,0 +1,64 @@
+package lab02.authorization;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.env.Environment;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
+import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
+import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
+import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
+import org.springframework.security.oauth2.provider.token.TokenStore;
+import org.springframework.security.oauth2.provider.token.store.JdbcTokenStore;
+
+import javax.sql.DataSource;
+
+// 授权服务器配置
+@Configuration
+@EnableAuthorizationServer
+public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdapter {
+
+    @Autowired
+    private Environment env;
+
+    // 用户认证
+    @Autowired
+    private AuthenticationManager authenticationManager;
+
+    @Override
+    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
+        endpoints.tokenStore(tokenStore()) // 设置 tokenStore
+                .authenticationManager(authenticationManager); // 设置 authenticationManager
+    }
+
+    @Override
+    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
+//        clients.inMemory()
+//                .withClient("clientapp").secret("112233") // Client 账号、密码。
+//                .authorizedGrantTypes("password") // 密码模式
+//                .scopes("read_userinfo", "read_contacts") // 可授权的 Scope
+////                .and().withClient() // 可以继续配置新的 Client
+//                ;
+
+        // 加载 ClientDetails
+        clients.jdbc(dataSource());
+    }
+
+    @Bean
+    public DataSource dataSource() {
+        final DriverManagerDataSource dataSource = new DriverManagerDataSource();
+        dataSource.setDriverClassName(env.getProperty("jdbc.driverClassName"));
+        dataSource.setUrl(env.getProperty("jdbc.url"));
+        dataSource.setUsername(env.getProperty("jdbc.user"));
+        dataSource.setPassword(env.getProperty("jdbc.pass"));
+        return dataSource;
+    }
+
+    @Bean
+    public TokenStore tokenStore() {
+        return new JdbcTokenStore(dataSource());
+    }
+
+}

lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/OAuth2ResourceServer.java

@@ -0,0 +1,27 @@
+package lab02.resource;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
+import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
+
+// 资源服务配置
+@Configuration
+@EnableResourceServer
+public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter {
+
+    @Override
+    public void configure(HttpSecurity http) throws Exception {
+        http.authorizeRequests()
+                // 对 "/api/**" 开启认证
+                .anyRequest()
+                .authenticated()
+                .and()
+                .requestMatchers()
+                .antMatchers("/api/**");
+    }
+
+}
+
+// 实际，OAuth2ResourceServer 不是和 OAuth2AuthorizationServer 一起。
+// 主要考虑，简化 demo ，所以改成这样。

lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/api/ExampleController.java

@@ -0,0 +1,18 @@
+package lab02.resource.api;
+
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * 示例模块 Controller
+ */
+@RestController
+@RequestMapping("/api/example")
+public class ExampleController {
+
+    @RequestMapping("/hello")
+    public String hello() {
+        return "world";
+    }
+
+}

lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/application.properties

@@ -0,0 +1,9 @@
+# Spring Security Setting
+security.user.name=yunai
+security.user.password=1024
+
+##################### MySQL #####################
+jdbc.driverClassName=com.mysql.jdbc.Driver
+jdbc.url=jdbc:mysql://127.0.0.1:33061/oauth2
+jdbc.user=root
+jdbc.pass=123456

lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/data.sql

@@ -0,0 +1,21 @@
+INSERT INTO oauth_client_details
+	(client_id, client_secret, scope, authorized_grant_types,
+	web_server_redirect_uri, authorities, access_token_validity,
+	refresh_token_validity, additional_information, autoapprove)
+VALUES
+	('fooClientIdPassword', 'secret', 'foo,read,write',
+	'password,authorization_code,refresh_token', null, null, 36000, 36000, null, true);
+INSERT INTO oauth_client_details
+	(client_id, client_secret, scope, authorized_grant_types,
+	web_server_redirect_uri, authorities, access_token_validity,
+	refresh_token_validity, additional_information, autoapprove)
+VALUES
+	('sampleClientId', 'secret', 'read,write,foo,bar',
+	'implicit', null, null, 36000, 36000, null, false);
+INSERT INTO oauth_client_details
+	(client_id, client_secret, scope, authorized_grant_types,
+	web_server_redirect_uri, authorities, access_token_validity,
+	refresh_token_validity, additional_information, autoapprove)
+VALUES
+	('barClientIdPassword', 'secret', 'bar,read,write',
+	'password,authorization_code,refresh_token', null, null, 36000, 36000, null, true);

lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/schema.sql

@@ -0,0 +1,66 @@
+--------------- MySQL ---------------
+drop table if exists oauth_client_details;
+create table oauth_client_details (
+  client_id VARCHAR(255) PRIMARY KEY,
+  resource_ids VARCHAR(255),
+  client_secret VARCHAR(255),
+  scope VARCHAR(255),
+  authorized_grant_types VARCHAR(255),
+  web_server_redirect_uri VARCHAR(255),
+  authorities VARCHAR(255),
+  access_token_validity INTEGER,
+  refresh_token_validity INTEGER,
+  additional_information VARCHAR(4096),
+  autoapprove VARCHAR(255)
+);
+
+create table if not exists oauth_client_token (
+  token_id VARCHAR(255),
+  token LONG VARBINARY,
+  authentication_id VARCHAR(255) PRIMARY KEY,
+  user_name VARCHAR(255),
+  client_id VARCHAR(255)
+);
+
+create table if not exists oauth_access_token (
+  token_id VARCHAR(255),
+  token LONG VARBINARY,
+  authentication_id VARCHAR(255) PRIMARY KEY,
+  user_name VARCHAR(255),
+  client_id VARCHAR(255),
+  authentication LONG VARBINARY,
+  refresh_token VARCHAR(255)
+);
+
+create table if not exists oauth_refresh_token (
+  token_id VARCHAR(255),
+  token LONG VARBINARY,
+  authentication LONG VARBINARY
+);
+
+create table if not exists oauth_code (
+  code VARCHAR(255), authentication LONG VARBINARY
+);
+
+create table if not exists oauth_approvals (
+	userId VARCHAR(255),
+	clientId VARCHAR(255),
+	scope VARCHAR(255),
+	status VARCHAR(10),
+	expiresAt TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+	lastModifiedAt TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+);
+
+create table if not exists ClientDetails (
+  appId VARCHAR(255) PRIMARY KEY,
+  resourceIds VARCHAR(255),
+  appSecret VARCHAR(255),
+  scope VARCHAR(255),
+  grantTypes VARCHAR(255),
+  redirectUrl VARCHAR(255),
+  authorities VARCHAR(255),
+  access_token_validity INTEGER,
+  refresh_token_validity INTEGER,
+  additionalInformation VARCHAR(4096),
+  autoApproveScopes VARCHAR(255)
+);

lab-02/resource-owner-password-credentials-server-with-refresh-token/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java

@@ -28,6 +28,7 @@ public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdap
                 .withClient("clientapp").secret("112233") // Client 账号、密码。
                 .authorizedGrantTypes("password", "refresh_token") // 密码模式
                 .scopes("read_userinfo", "read_contacts") // 可授权的 Scope
+                .refreshTokenValiditySeconds(1200) // 1200 秒过期
 //                .and().withClient() // 可以继续配置新的 Client
                 ;
     }

lab-02/resource-owner-password-credentials-server-with-revoke-token/pom.xml

@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>1.5.16.RELEASE</version>
+        <relativePath /> <!-- lookup parent from repository -->
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>resource-owner-password-credentials-server-with-revoke-token</artifactId>
+
+    <dependencies>
+        <!-- for Spring MVC -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <!-- for Spring Security -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+
+        <!-- for OAuth 2.0 -->
+        <dependency>
+            <groupId>org.springframework.security.oauth</groupId>
+            <artifactId>spring-security-oauth2</artifactId>
+        </dependency>
+
+    </dependencies>
+
+</project>

lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/Application.java

@@ -0,0 +1,13 @@
+package lab2;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class Application {
+
+    public static void main(String[] args) {
+        SpringApplication.run(Application.class, args);
+    }
+
+}

lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/OAuth2AuthorizationServer.java

@@ -0,0 +1,36 @@
+package lab2.authorization;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
+import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
+import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
+import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
+
+// 授权服务器配置
+@Configuration
+@EnableAuthorizationServer
+public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdapter {
+
+    // 用户认证
+    @Autowired
+    private AuthenticationManager authenticationManager;
+
+    @Override
+    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
+        endpoints.authenticationManager(authenticationManager);
+    }
+
+    @Override
+    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
+        clients.inMemory()
+                .withClient("clientapp").secret("112233") // Client 账号、密码。
+                .authorizedGrantTypes("password", "refresh_token") // 密码模式
+                .scopes("read_userinfo", "read_contacts") // 可授权的 Scope
+                .refreshTokenValiditySeconds(1200) // 1200 秒过期
+//                .and().withClient() // 可以继续配置新的 Client
+                ;
+    }
+
+}

lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/token/TokenController.java

@@ -0,0 +1,32 @@
+package lab2.authorization.token;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.oauth2.common.DefaultOAuth2RefreshToken;
+import org.springframework.security.oauth2.provider.token.ConsumerTokenServices;
+import org.springframework.security.oauth2.provider.token.TokenStore;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class TokenController {
+
+    @Autowired
+    private ConsumerTokenServices tokenServices;
+    @Autowired(required = false)
+    private TokenStore tokenStore;
+
+    @RequestMapping(method = RequestMethod.POST, value = "api/access_token/revoke")
+    public String revokeToken(@RequestParam("token") String token) {
+        tokenServices.revokeToken(token);
+        return token;
+    }
+
+    @RequestMapping(method = RequestMethod.POST, value = "api/refresh_token/revoke")
+    public String revokeRefreshToken(@RequestParam("token") String token) {
+        tokenStore.removeRefreshToken(new DefaultOAuth2RefreshToken(token));
+        return token;
+    }
+
+}

lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/OAuth2ResourceServer.java

@@ -0,0 +1,27 @@
+package lab2.resource;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
+import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
+
+// 资源服务配置
+@Configuration
+@EnableResourceServer
+public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter {
+
+    @Override
+    public void configure(HttpSecurity http) throws Exception {
+        http.authorizeRequests()
+                // 对 "/api/**" 开启认证
+                .anyRequest()
+                .authenticated()
+                .and()
+                .requestMatchers()
+                .antMatchers("/api/**");
+    }
+
+}
+
+// 实际，OAuth2ResourceServer 不是和 OAuth2AuthorizationServer 一起。
+// 主要考虑，简化 demo ，所以改成这样。

lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/api/ExampleController.java

@@ -0,0 +1,18 @@
+package lab2.resource.api;
+
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * 示例模块 Controller
+ */
+@RestController
+@RequestMapping("/api/example")
+public class ExampleController {
+
+    @RequestMapping("/hello")
+    public String hello() {
+        return "world";
+    }
+
+}

lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/resources/application.properties

@@ -0,0 +1,3 @@
+# Spring Security Setting
+security.user.name=yunai
+security.user.password=1024