From e375e21ad61340f1cec76d6f4fe8e84db65aff8e Mon Sep 17 00:00:00 2001 From: YunaiV <> Date: Tue, 18 Sep 2018 00:07:30 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=20password=20=E6=8E=88?= =?UTF-8?q?=E6=9D=83=E6=A8=A1=E5=BC=8F=E4=B8=8B=EF=BC=8C=E5=9F=BA=E4=BA=8E?= =?UTF-8?q?=20jdbc=20token=20store?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lab-02/pom.xml | 2 + .../pom.xml | 48 ++++++++++++++ .../src/main/java/lab02/Application.java | 13 ++++ .../OAuth2AuthorizationServer.java | 64 ++++++++++++++++++ .../lab02/resource/OAuth2ResourceServer.java | 27 ++++++++ .../lab02/resource/api/ExampleController.java | 18 +++++ .../src/main/resources/application.properties | 9 +++ .../src/main/resources/data.sql | 21 ++++++ .../src/main/resources/schema.sql | 66 +++++++++++++++++++ .../OAuth2AuthorizationServer.java | 1 + .../pom.xml | 36 ++++++++++ .../src/main/java/lab2/Application.java | 13 ++++ .../OAuth2AuthorizationServer.java | 36 ++++++++++ .../authorization/token/TokenController.java | 32 +++++++++ .../lab2/resource/OAuth2ResourceServer.java | 27 ++++++++ .../lab2/resource/api/ExampleController.java | 18 +++++ .../src/main/resources/application.properties | 3 + 17 files changed, 434 insertions(+) create mode 100644 lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/pom.xml create mode 100644 lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/Application.java create mode 100644 lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/authorization/OAuth2AuthorizationServer.java create mode 100644 lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/OAuth2ResourceServer.java create mode 100644 lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/api/ExampleController.java create mode 100644 lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/application.properties create mode 100644 lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/data.sql create mode 100644 lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/schema.sql create mode 100644 lab-02/resource-owner-password-credentials-server-with-revoke-token/pom.xml create mode 100644 lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/Application.java create mode 100644 lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/OAuth2AuthorizationServer.java create mode 100644 lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/token/TokenController.java create mode 100644 lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/OAuth2ResourceServer.java create mode 100644 lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/api/ExampleController.java create mode 100644 lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/resources/application.properties diff --git a/lab-02/pom.xml b/lab-02/pom.xml index 719f87f2..9912c2c9 100644 --- a/lab-02/pom.xml +++ b/lab-02/pom.xml @@ -17,6 +17,8 @@ implicit-server client-credentials-server resource-owner-password-credentials-server-with-refresh-token + resource-owner-password-credentials-server-with-revoke-token + resource-owner-password-credentials-server-by-jdbc-token-store diff --git a/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/pom.xml b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/pom.xml new file mode 100644 index 00000000..84aff1a8 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/pom.xml @@ -0,0 +1,48 @@ + + + + org.springframework.boot + spring-boot-starter-parent + 1.5.16.RELEASE + + + + 4.0.0 + resource-owner-password-credentials-server-by-jdbc-token-store + + + + + org.springframework.boot + spring-boot-starter-web + + + + + org.springframework.boot + spring-boot-starter-security + + + + + org.springframework.security.oauth + spring-security-oauth2 + + + + + org.springframework + spring-jdbc + + + mysql + mysql-connector-java + runtime + + + + + + \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/Application.java b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/Application.java new file mode 100644 index 00000000..ee431101 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/Application.java @@ -0,0 +1,13 @@ +package lab02; + +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; + +@SpringBootApplication +public class Application { + + public static void main(String[] args) { + SpringApplication.run(Application.class, args); + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/authorization/OAuth2AuthorizationServer.java b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/authorization/OAuth2AuthorizationServer.java new file mode 100644 index 00000000..84fdc6a4 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/authorization/OAuth2AuthorizationServer.java @@ -0,0 +1,64 @@ +package lab02.authorization; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.core.env.Environment; +import org.springframework.jdbc.datasource.DriverManagerDataSource; +import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer; +import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer; +import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer; +import org.springframework.security.oauth2.provider.token.TokenStore; +import org.springframework.security.oauth2.provider.token.store.JdbcTokenStore; + +import javax.sql.DataSource; + +// 授权服务器配置 +@Configuration +@EnableAuthorizationServer +public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdapter { + + @Autowired + private Environment env; + + // 用户认证 + @Autowired + private AuthenticationManager authenticationManager; + + @Override + public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { + endpoints.tokenStore(tokenStore()) // 设置 tokenStore + .authenticationManager(authenticationManager); // 设置 authenticationManager + } + + @Override + public void configure(ClientDetailsServiceConfigurer clients) throws Exception { +// clients.inMemory() +// .withClient("clientapp").secret("112233") // Client 账号、密码。 +// .authorizedGrantTypes("password") // 密码模式 +// .scopes("read_userinfo", "read_contacts") // 可授权的 Scope +//// .and().withClient() // 可以继续配置新的 Client +// ; + + // 加载 ClientDetails + clients.jdbc(dataSource()); + } + + @Bean + public DataSource dataSource() { + final DriverManagerDataSource dataSource = new DriverManagerDataSource(); + dataSource.setDriverClassName(env.getProperty("jdbc.driverClassName")); + dataSource.setUrl(env.getProperty("jdbc.url")); + dataSource.setUsername(env.getProperty("jdbc.user")); + dataSource.setPassword(env.getProperty("jdbc.pass")); + return dataSource; + } + + @Bean + public TokenStore tokenStore() { + return new JdbcTokenStore(dataSource()); + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/OAuth2ResourceServer.java b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/OAuth2ResourceServer.java new file mode 100644 index 00000000..698242fb --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/OAuth2ResourceServer.java @@ -0,0 +1,27 @@ +package lab02.resource; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer; +import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter; + +// 资源服务配置 +@Configuration +@EnableResourceServer +public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter { + + @Override + public void configure(HttpSecurity http) throws Exception { + http.authorizeRequests() + // 对 "/api/**" 开启认证 + .anyRequest() + .authenticated() + .and() + .requestMatchers() + .antMatchers("/api/**"); + } + +} + +// 实际，OAuth2ResourceServer 不是和 OAuth2AuthorizationServer 一起。 +// 主要考虑，简化 demo ，所以改成这样。 \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/api/ExampleController.java b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/api/ExampleController.java new file mode 100644 index 00000000..a3a5cc20 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/java/lab02/resource/api/ExampleController.java @@ -0,0 +1,18 @@ +package lab02.resource.api; + +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RestController; + +/** + * 示例模块 Controller + */ +@RestController +@RequestMapping("/api/example") +public class ExampleController { + + @RequestMapping("/hello") + public String hello() { + return "world"; + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/application.properties b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/application.properties new file mode 100644 index 00000000..a2fecaa3 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/application.properties @@ -0,0 +1,9 @@ +# Spring Security Setting +security.user.name=yunai +security.user.password=1024 + +##################### MySQL ##################### +jdbc.driverClassName=com.mysql.jdbc.Driver +jdbc.url=jdbc:mysql://127.0.0.1:33061/oauth2 +jdbc.user=root +jdbc.pass=123456 \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/data.sql b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/data.sql new file mode 100644 index 00000000..807bf514 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/data.sql @@ -0,0 +1,21 @@ +INSERT INTO oauth_client_details + (client_id, client_secret, scope, authorized_grant_types, + web_server_redirect_uri, authorities, access_token_validity, + refresh_token_validity, additional_information, autoapprove) +VALUES + ('fooClientIdPassword', 'secret', 'foo,read,write', + 'password,authorization_code,refresh_token', null, null, 36000, 36000, null, true); +INSERT INTO oauth_client_details + (client_id, client_secret, scope, authorized_grant_types, + web_server_redirect_uri, authorities, access_token_validity, + refresh_token_validity, additional_information, autoapprove) +VALUES + ('sampleClientId', 'secret', 'read,write,foo,bar', + 'implicit', null, null, 36000, 36000, null, false); +INSERT INTO oauth_client_details + (client_id, client_secret, scope, authorized_grant_types, + web_server_redirect_uri, authorities, access_token_validity, + refresh_token_validity, additional_information, autoapprove) +VALUES + ('barClientIdPassword', 'secret', 'bar,read,write', + 'password,authorization_code,refresh_token', null, null, 36000, 36000, null, true); \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/schema.sql b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/schema.sql new file mode 100644 index 00000000..945d05d1 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-by-jdbc-token-store/src/main/resources/schema.sql @@ -0,0 +1,66 @@ +--------------- MySQL --------------- +drop table if exists oauth_client_details; +create table oauth_client_details ( + client_id VARCHAR(255) PRIMARY KEY, + resource_ids VARCHAR(255), + client_secret VARCHAR(255), + scope VARCHAR(255), + authorized_grant_types VARCHAR(255), + web_server_redirect_uri VARCHAR(255), + authorities VARCHAR(255), + access_token_validity INTEGER, + refresh_token_validity INTEGER, + additional_information VARCHAR(4096), + autoapprove VARCHAR(255) +); + +create table if not exists oauth_client_token ( + token_id VARCHAR(255), + token LONG VARBINARY, + authentication_id VARCHAR(255) PRIMARY KEY, + user_name VARCHAR(255), + client_id VARCHAR(255) +); + +create table if not exists oauth_access_token ( + token_id VARCHAR(255), + token LONG VARBINARY, + authentication_id VARCHAR(255) PRIMARY KEY, + user_name VARCHAR(255), + client_id VARCHAR(255), + authentication LONG VARBINARY, + refresh_token VARCHAR(255) +); + +create table if not exists oauth_refresh_token ( + token_id VARCHAR(255), + token LONG VARBINARY, + authentication LONG VARBINARY +); + +create table if not exists oauth_code ( + code VARCHAR(255), authentication LONG VARBINARY +); + +create table if not exists oauth_approvals ( + userId VARCHAR(255), + clientId VARCHAR(255), + scope VARCHAR(255), + status VARCHAR(10), + expiresAt TIMESTAMP DEFAULT CURRENT_TIMESTAMP, + lastModifiedAt TIMESTAMP DEFAULT CURRENT_TIMESTAMP +); + +create table if not exists ClientDetails ( + appId VARCHAR(255) PRIMARY KEY, + resourceIds VARCHAR(255), + appSecret VARCHAR(255), + scope VARCHAR(255), + grantTypes VARCHAR(255), + redirectUrl VARCHAR(255), + authorities VARCHAR(255), + access_token_validity INTEGER, + refresh_token_validity INTEGER, + additionalInformation VARCHAR(4096), + autoApproveScopes VARCHAR(255) +); \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-with-refresh-token/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java b/lab-02/resource-owner-password-credentials-server-with-refresh-token/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java index 75feaf99..56ba2c95 100644 --- a/lab-02/resource-owner-password-credentials-server-with-refresh-token/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java +++ b/lab-02/resource-owner-password-credentials-server-with-refresh-token/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java @@ -28,6 +28,7 @@ public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdap .withClient("clientapp").secret("112233") // Client 账号、密码。 .authorizedGrantTypes("password", "refresh_token") // 密码模式 .scopes("read_userinfo", "read_contacts") // 可授权的 Scope + .refreshTokenValiditySeconds(1200) // 1200 秒过期 // .and().withClient() // 可以继续配置新的 Client ; } diff --git a/lab-02/resource-owner-password-credentials-server-with-revoke-token/pom.xml b/lab-02/resource-owner-password-credentials-server-with-revoke-token/pom.xml new file mode 100644 index 00000000..9ede5f15 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-with-revoke-token/pom.xml @@ -0,0 +1,36 @@ + + + + org.springframework.boot + spring-boot-starter-parent + 1.5.16.RELEASE + + + + 4.0.0 + resource-owner-password-credentials-server-with-revoke-token + + + + + org.springframework.boot + spring-boot-starter-web + + + + + org.springframework.boot + spring-boot-starter-security + + + + + org.springframework.security.oauth + spring-security-oauth2 + + + + + \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/Application.java b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/Application.java new file mode 100644 index 00000000..f363b887 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/Application.java @@ -0,0 +1,13 @@ +package lab2; + +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; + +@SpringBootApplication +public class Application { + + public static void main(String[] args) { + SpringApplication.run(Application.class, args); + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/OAuth2AuthorizationServer.java b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/OAuth2AuthorizationServer.java new file mode 100644 index 00000000..552308cf --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/OAuth2AuthorizationServer.java @@ -0,0 +1,36 @@ +package lab2.authorization; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer; +import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer; +import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer; + +// 授权服务器配置 +@Configuration +@EnableAuthorizationServer +public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdapter { + + // 用户认证 + @Autowired + private AuthenticationManager authenticationManager; + + @Override + public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { + endpoints.authenticationManager(authenticationManager); + } + + @Override + public void configure(ClientDetailsServiceConfigurer clients) throws Exception { + clients.inMemory() + .withClient("clientapp").secret("112233") // Client 账号、密码。 + .authorizedGrantTypes("password", "refresh_token") // 密码模式 + .scopes("read_userinfo", "read_contacts") // 可授权的 Scope + .refreshTokenValiditySeconds(1200) // 1200 秒过期 +// .and().withClient() // 可以继续配置新的 Client + ; + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/token/TokenController.java b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/token/TokenController.java new file mode 100644 index 00000000..3ff6d8d4 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/authorization/token/TokenController.java @@ -0,0 +1,32 @@ +package lab2.authorization.token; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.oauth2.common.DefaultOAuth2RefreshToken; +import org.springframework.security.oauth2.provider.token.ConsumerTokenServices; +import org.springframework.security.oauth2.provider.token.TokenStore; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.RestController; + +@RestController +public class TokenController { + + @Autowired + private ConsumerTokenServices tokenServices; + @Autowired(required = false) + private TokenStore tokenStore; + + @RequestMapping(method = RequestMethod.POST, value = "api/access_token/revoke") + public String revokeToken(@RequestParam("token") String token) { + tokenServices.revokeToken(token); + return token; + } + + @RequestMapping(method = RequestMethod.POST, value = "api/refresh_token/revoke") + public String revokeRefreshToken(@RequestParam("token") String token) { + tokenStore.removeRefreshToken(new DefaultOAuth2RefreshToken(token)); + return token; + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/OAuth2ResourceServer.java b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/OAuth2ResourceServer.java new file mode 100644 index 00000000..351e3553 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/OAuth2ResourceServer.java @@ -0,0 +1,27 @@ +package lab2.resource; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer; +import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter; + +// 资源服务配置 +@Configuration +@EnableResourceServer +public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter { + + @Override + public void configure(HttpSecurity http) throws Exception { + http.authorizeRequests() + // 对 "/api/**" 开启认证 + .anyRequest() + .authenticated() + .and() + .requestMatchers() + .antMatchers("/api/**"); + } + +} + +// 实际，OAuth2ResourceServer 不是和 OAuth2AuthorizationServer 一起。 +// 主要考虑，简化 demo ，所以改成这样。 \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/api/ExampleController.java b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/api/ExampleController.java new file mode 100644 index 00000000..0e897221 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/java/lab2/resource/api/ExampleController.java @@ -0,0 +1,18 @@ +package lab2.resource.api; + +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RestController; + +/** + * 示例模块 Controller + */ +@RestController +@RequestMapping("/api/example") +public class ExampleController { + + @RequestMapping("/hello") + public String hello() { + return "world"; + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/resources/application.properties b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/resources/application.properties new file mode 100644 index 00000000..5c6bfc10 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server-with-revoke-token/src/main/resources/application.properties @@ -0,0 +1,3 @@ +# Spring Security Setting +security.user.name=yunai +security.user.password=1024 \ No newline at end of file