From f8d701cbd9b2a4f2cee3a7f2186148bcdf859895 Mon Sep 17 00:00:00 2001 From: YunaiV <> Date: Thu, 13 Sep 2018 20:14:26 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=20Spring=20Security=20OAuth2?= =?UTF-8?q?=20=E7=9A=84=20=E5=9B=9B=E7=A7=8D=E8=AE=A4=E8=AF=81=E7=B1=BB?= =?UTF-8?q?=E5=9E=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lab-02/authorization-code-server/README.md | 51 ------------------- lab-02/authorization-code-server/pom.xml | 22 +++----- .../OAuth2AuthorizationServer.java | 12 ++--- .../lab01/resource/OAuth2ResourceServer.java | 1 + lab-02/client-credentials-server/pom.xml | 37 ++++++++++++++ .../src/main/java/lab01/Application.java | 13 +++++ .../OAuth2AuthorizationServer.java | 23 +++++++++ .../lab01/resource/OAuth2ResourceServer.java | 27 ++++++++++ .../lab01/resource/api/ExampleController.java | 18 +++++++ lab-02/implicit-server/pom.xml | 36 +++++++++++++ .../src/main/java/lab01/Application.java | 13 +++++ .../OAuth2AuthorizationServer.java | 24 +++++++++ .../lab01/resource/OAuth2ResourceServer.java | 30 +++++++++++ .../lab01/resource/api/ExampleController.java | 19 +++++++ .../src/main/resources/application.properties | 3 ++ lab-02/pom.xml | 3 ++ .../pom.xml | 36 +++++++++++++ .../src/main/java/lab01/Application.java | 13 +++++ .../OAuth2AuthorizationServer.java | 35 +++++++++++++ .../lab01/resource/OAuth2ResourceServer.java | 27 ++++++++++ .../lab01/resource/api/ExampleController.java | 18 +++++++ .../src/main/resources/application.properties | 3 ++ 22 files changed, 392 insertions(+), 72 deletions(-) delete mode 100644 lab-02/authorization-code-server/README.md create mode 100644 lab-02/client-credentials-server/pom.xml create mode 100644 lab-02/client-credentials-server/src/main/java/lab01/Application.java create mode 100644 lab-02/client-credentials-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java create mode 100644 lab-02/client-credentials-server/src/main/java/lab01/resource/OAuth2ResourceServer.java create mode 100644 lab-02/client-credentials-server/src/main/java/lab01/resource/api/ExampleController.java create mode 100644 lab-02/implicit-server/pom.xml create mode 100644 lab-02/implicit-server/src/main/java/lab01/Application.java create mode 100644 lab-02/implicit-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java create mode 100644 lab-02/implicit-server/src/main/java/lab01/resource/OAuth2ResourceServer.java create mode 100644 lab-02/implicit-server/src/main/java/lab01/resource/api/ExampleController.java create mode 100644 lab-02/implicit-server/src/main/resources/application.properties create mode 100644 lab-02/resource-owner-password-credentials-server/pom.xml create mode 100644 lab-02/resource-owner-password-credentials-server/src/main/java/lab01/Application.java create mode 100644 lab-02/resource-owner-password-credentials-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java create mode 100644 lab-02/resource-owner-password-credentials-server/src/main/java/lab01/resource/OAuth2ResourceServer.java create mode 100644 lab-02/resource-owner-password-credentials-server/src/main/java/lab01/resource/api/ExampleController.java create mode 100644 lab-02/resource-owner-password-credentials-server/src/main/resources/application.properties diff --git a/lab-02/authorization-code-server/README.md b/lab-02/authorization-code-server/README.md deleted file mode 100644 index 8b58fdc0..00000000 --- a/lab-02/authorization-code-server/README.md +++ /dev/null @@ -1,51 +0,0 @@ -> 直接饮用 https://github.com/geektime-geekbang/oauth2lab/blob/0e0f380a670718225fcfc86c60ca4cf7cc5c24d4/lab01/authcode-server/README.md -> 作者：杨波 - -基于授权码模式+Spring Security OAuth2的最简授权服务器 -====== - -# 操作方式 - -## 1. 获取授权码 - -浏览器请求： - -http://localhost:8080/oauth/authorize?client_id=clientapp&redirect_uri=http://localhost:9001/callback&response_type=code&scope=read_userinfo - -**注意：state参数暂忽略** - -响应案例： - -http://localhost:9001/callback?code=8uYpdo - -## 2. 获取访问令牌 - -curl -X POST --user clientapp:123456 http://localhost:8080/oauth/token -H -"content-type: application/x-www-form-urlencoded" -d -"code=8uYpdo&grant_type=authorization_code&redirect_uri=http%3A%2F%2Flocalh -ost%3A9001%2Fcallback&scope=read_userinfo" - -案例响应： - -```json -{ - "access_token": "36cded80-b6f5-43b7-bdfc-594788a24530", - "token_type": "bearer", - "expires_in": 43199, - "scope": "read_userinfo" -} -``` - - -## 3. 调用API - -curl -X GET http://localhost:8080/api/userinfo -H "authorization: Bearer 36cded80-b6f5-43b7-bdfc-594788a24530" - -案例响应： - -```json -{ - "name": "bobo", - "email": "bobo@spring2go.com" -} -``` \ No newline at end of file diff --git a/lab-02/authorization-code-server/pom.xml b/lab-02/authorization-code-server/pom.xml index f1d18fce..a1d2287a 100644 --- a/lab-02/authorization-code-server/pom.xml +++ b/lab-02/authorization-code-server/pom.xml @@ -13,32 +13,24 @@ authorization-code-server - - org.springframework.boot - spring-boot-starter-security - + org.springframework.boot spring-boot-starter-web + + + org.springframework.boot + spring-boot-starter-security + + org.springframework.security.oauth spring-security-oauth2 - - - org.springframework.boot - spring-boot-starter-test - test - - - org.springframework.security - spring-security-test - test - \ No newline at end of file diff --git a/lab-02/authorization-code-server/src/main/java/cn/iocoder/springboot/labs/lab01/authorization/OAuth2AuthorizationServer.java b/lab-02/authorization-code-server/src/main/java/cn/iocoder/springboot/labs/lab01/authorization/OAuth2AuthorizationServer.java index 9f701f87..1b5ee84b 100644 --- a/lab-02/authorization-code-server/src/main/java/cn/iocoder/springboot/labs/lab01/authorization/OAuth2AuthorizationServer.java +++ b/lab-02/authorization-code-server/src/main/java/cn/iocoder/springboot/labs/lab01/authorization/OAuth2AuthorizationServer.java @@ -13,12 +13,12 @@ public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdap @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { clients.inMemory() - .withClient("clientapp") -// .secret("112233") // 目前非必须，因为开启的是 authorization_code 模式 - .redirectUris("http://localhost:9001/callback") - // 授权码模式 - .authorizedGrantTypes("authorization_code") - .scopes("read_userinfo", "read_contacts"); // TODO 芋艿，后续优化 + .withClient("clientapp").secret("112233") // Client 账号、密码。 + .redirectUris("http://localhost:9001/callback") // 配置回调地址，选填。 + .authorizedGrantTypes("authorization_code") // 授权码模式 + .scopes("read_userinfo", "read_contacts") // 可授权的 Scope +// .and().withClient() // 可以继续配置新的 Client + ; } } \ No newline at end of file diff --git a/lab-02/authorization-code-server/src/main/java/cn/iocoder/springboot/labs/lab01/resource/OAuth2ResourceServer.java b/lab-02/authorization-code-server/src/main/java/cn/iocoder/springboot/labs/lab01/resource/OAuth2ResourceServer.java index fe1193da..ab9a2e6d 100644 --- a/lab-02/authorization-code-server/src/main/java/cn/iocoder/springboot/labs/lab01/resource/OAuth2ResourceServer.java +++ b/lab-02/authorization-code-server/src/main/java/cn/iocoder/springboot/labs/lab01/resource/OAuth2ResourceServer.java @@ -13,6 +13,7 @@ public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter { @Override public void configure(HttpSecurity http) throws Exception { http.authorizeRequests() + // 对 "/api/**" 开启认证 .anyRequest() .authenticated() .and() diff --git a/lab-02/client-credentials-server/pom.xml b/lab-02/client-credentials-server/pom.xml new file mode 100644 index 00000000..db8eeba0 --- /dev/null +++ b/lab-02/client-credentials-server/pom.xml @@ -0,0 +1,37 @@ + + + + org.springframework.boot + spring-boot-starter-parent + 1.5.16.RELEASE + + + + 4.0.0 + client-credentials-server + + + + + org.springframework.boot + spring-boot-starter-web + + + + + org.springframework.boot + spring-boot-starter-security + + + + + org.springframework.security.oauth + spring-security-oauth2 + + + + + + \ No newline at end of file diff --git a/lab-02/client-credentials-server/src/main/java/lab01/Application.java b/lab-02/client-credentials-server/src/main/java/lab01/Application.java new file mode 100644 index 00000000..1e41c9dd --- /dev/null +++ b/lab-02/client-credentials-server/src/main/java/lab01/Application.java @@ -0,0 +1,13 @@ +package lab01; + +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; + +@SpringBootApplication +public class Application { + + public static void main(String[] args) { + SpringApplication.run(Application.class, args); + } + +} \ No newline at end of file diff --git a/lab-02/client-credentials-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java b/lab-02/client-credentials-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java new file mode 100644 index 00000000..64e3b63d --- /dev/null +++ b/lab-02/client-credentials-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java @@ -0,0 +1,23 @@ +package lab01.authorization; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer; +import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer; + +// 授权服务器配置 +@Configuration +@EnableAuthorizationServer +public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdapter { + + @Override + public void configure(ClientDetailsServiceConfigurer clients) throws Exception { + clients.inMemory() + .withClient("clientapp").secret("112233") // Client 账号、密码。 + .authorizedGrantTypes("client_credentials") // 授权码模式 + .scopes("read_userinfo", "read_contacts") // 可授权的 Scope +// .and().withClient() // 可以继续配置新的 Client + ; + } + +} \ No newline at end of file diff --git a/lab-02/client-credentials-server/src/main/java/lab01/resource/OAuth2ResourceServer.java b/lab-02/client-credentials-server/src/main/java/lab01/resource/OAuth2ResourceServer.java new file mode 100644 index 00000000..4b0e1f70 --- /dev/null +++ b/lab-02/client-credentials-server/src/main/java/lab01/resource/OAuth2ResourceServer.java @@ -0,0 +1,27 @@ +package lab01.resource; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer; +import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter; + +// 资源服务配置 +@Configuration +@EnableResourceServer +public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter { + + @Override + public void configure(HttpSecurity http) throws Exception { + http.authorizeRequests() + // 对 "/api/**" 开启认证 + .anyRequest() + .authenticated() + .and() + .requestMatchers() + .antMatchers("/api/**"); + } + +} + +// 实际，OAuth2ResourceServer 不是和 OAuth2AuthorizationServer 一起。 +// 主要考虑，简化 demo ，所以改成这样。 \ No newline at end of file diff --git a/lab-02/client-credentials-server/src/main/java/lab01/resource/api/ExampleController.java b/lab-02/client-credentials-server/src/main/java/lab01/resource/api/ExampleController.java new file mode 100644 index 00000000..86f13a0c --- /dev/null +++ b/lab-02/client-credentials-server/src/main/java/lab01/resource/api/ExampleController.java @@ -0,0 +1,18 @@ +package lab01.resource.api; + +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RestController; + +/** + * 示例模块 Controller + */ +@RestController +@RequestMapping("/api/example") +public class ExampleController { + + @RequestMapping("/hello") + public String hello() { + return "world"; + } + +} \ No newline at end of file diff --git a/lab-02/implicit-server/pom.xml b/lab-02/implicit-server/pom.xml new file mode 100644 index 00000000..795a9e79 --- /dev/null +++ b/lab-02/implicit-server/pom.xml @@ -0,0 +1,36 @@ + + + + org.springframework.boot + spring-boot-starter-parent + 1.5.16.RELEASE + + + + 4.0.0 + implicit-server + + + + + org.springframework.boot + spring-boot-starter-web + + + + + org.springframework.boot + spring-boot-starter-security + + + + + org.springframework.security.oauth + spring-security-oauth2 + + + + + \ No newline at end of file diff --git a/lab-02/implicit-server/src/main/java/lab01/Application.java b/lab-02/implicit-server/src/main/java/lab01/Application.java new file mode 100644 index 00000000..1e41c9dd --- /dev/null +++ b/lab-02/implicit-server/src/main/java/lab01/Application.java @@ -0,0 +1,13 @@ +package lab01; + +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; + +@SpringBootApplication +public class Application { + + public static void main(String[] args) { + SpringApplication.run(Application.class, args); + } + +} \ No newline at end of file diff --git a/lab-02/implicit-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java b/lab-02/implicit-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java new file mode 100644 index 00000000..5ca13f6f --- /dev/null +++ b/lab-02/implicit-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java @@ -0,0 +1,24 @@ +package lab01.authorization; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer; +import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer; + +// 授权服务器配置 +@Configuration +@EnableAuthorizationServer +public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdapter { + + @Override + public void configure(ClientDetailsServiceConfigurer clients) throws Exception { + clients.inMemory() + .withClient("clientapp").secret("112233") // Client 账号、密码。 + .redirectUris("http://localhost:9001/callback") // 配置回调地址，选填。 + .authorizedGrantTypes("implicit") // 授权码模式 + .scopes("read_userinfo", "read_contacts") // 可授权的 Scope +// .and().withClient() // 可以继续配置新的 Client + ; + } + +} \ No newline at end of file diff --git a/lab-02/implicit-server/src/main/java/lab01/resource/OAuth2ResourceServer.java b/lab-02/implicit-server/src/main/java/lab01/resource/OAuth2ResourceServer.java new file mode 100644 index 00000000..fea95b17 --- /dev/null +++ b/lab-02/implicit-server/src/main/java/lab01/resource/OAuth2ResourceServer.java @@ -0,0 +1,30 @@ +package lab01.resource; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer; +import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter; + +// 资源服务配置 +@Configuration +@EnableResourceServer +public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter { + + @Override + public void configure(HttpSecurity http) throws Exception { + http.authorizeRequests() + // 对 "/api/**" 开启认证 + .anyRequest() + .authenticated() + .and() + .requestMatchers() + .antMatchers("/api/**") +// .and() +// .cors() + ; + } + +} + +// 实际，OAuth2ResourceServer 不是和 OAuth2AuthorizationServer 一起。 +// 主要考虑，简化 demo ，所以改成这样。 \ No newline at end of file diff --git a/lab-02/implicit-server/src/main/java/lab01/resource/api/ExampleController.java b/lab-02/implicit-server/src/main/java/lab01/resource/api/ExampleController.java new file mode 100644 index 00000000..654c4bc3 --- /dev/null +++ b/lab-02/implicit-server/src/main/java/lab01/resource/api/ExampleController.java @@ -0,0 +1,19 @@ +package lab01.resource.api; + +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RestController; + +/** + * 示例模块 Controller + */ +@RestController +@RequestMapping("/api/example") +public class ExampleController { + +// @CrossOrigin + @RequestMapping("/hello") + public String hello() { + return "world"; + } + +} \ No newline at end of file diff --git a/lab-02/implicit-server/src/main/resources/application.properties b/lab-02/implicit-server/src/main/resources/application.properties new file mode 100644 index 00000000..5c6bfc10 --- /dev/null +++ b/lab-02/implicit-server/src/main/resources/application.properties @@ -0,0 +1,3 @@ +# Spring Security Setting +security.user.name=yunai +security.user.password=1024 \ No newline at end of file diff --git a/lab-02/pom.xml b/lab-02/pom.xml index 06396301..1c15e759 100644 --- a/lab-02/pom.xml +++ b/lab-02/pom.xml @@ -13,6 +13,9 @@ pom authorization-code-server + resource-owner-password-credentials-server + implicit-server + client-credentials-server diff --git a/lab-02/resource-owner-password-credentials-server/pom.xml b/lab-02/resource-owner-password-credentials-server/pom.xml new file mode 100644 index 00000000..5035bd61 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server/pom.xml @@ -0,0 +1,36 @@ + + + + org.springframework.boot + spring-boot-starter-parent + 1.5.16.RELEASE + + + + 4.0.0 + resource-owner-password-credentials-server + + + + + org.springframework.boot + spring-boot-starter-web + + + + + org.springframework.boot + spring-boot-starter-security + + + + + org.springframework.security.oauth + spring-security-oauth2 + + + + + \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/Application.java b/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/Application.java new file mode 100644 index 00000000..1e41c9dd --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/Application.java @@ -0,0 +1,13 @@ +package lab01; + +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; + +@SpringBootApplication +public class Application { + + public static void main(String[] args) { + SpringApplication.run(Application.class, args); + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java b/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java new file mode 100644 index 00000000..51889460 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/authorization/OAuth2AuthorizationServer.java @@ -0,0 +1,35 @@ +package lab01.authorization; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer; +import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer; +import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer; + +// 授权服务器配置 +@Configuration +@EnableAuthorizationServer +public class OAuth2AuthorizationServer extends AuthorizationServerConfigurerAdapter { + + // 用户认证 + @Autowired + private AuthenticationManager authenticationManager; + + @Override + public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { + endpoints.authenticationManager(authenticationManager); + } + + @Override + public void configure(ClientDetailsServiceConfigurer clients) throws Exception { + clients.inMemory() + .withClient("clientapp").secret("112233") // Client 账号、密码。 + .authorizedGrantTypes("password") // 密码模式 + .scopes("read_userinfo", "read_contacts") // 可授权的 Scope +// .and().withClient() // 可以继续配置新的 Client + ; + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/resource/OAuth2ResourceServer.java b/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/resource/OAuth2ResourceServer.java new file mode 100644 index 00000000..4b0e1f70 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/resource/OAuth2ResourceServer.java @@ -0,0 +1,27 @@ +package lab01.resource; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer; +import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter; + +// 资源服务配置 +@Configuration +@EnableResourceServer +public class OAuth2ResourceServer extends ResourceServerConfigurerAdapter { + + @Override + public void configure(HttpSecurity http) throws Exception { + http.authorizeRequests() + // 对 "/api/**" 开启认证 + .anyRequest() + .authenticated() + .and() + .requestMatchers() + .antMatchers("/api/**"); + } + +} + +// 实际，OAuth2ResourceServer 不是和 OAuth2AuthorizationServer 一起。 +// 主要考虑，简化 demo ，所以改成这样。 \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/resource/api/ExampleController.java b/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/resource/api/ExampleController.java new file mode 100644 index 00000000..86f13a0c --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server/src/main/java/lab01/resource/api/ExampleController.java @@ -0,0 +1,18 @@ +package lab01.resource.api; + +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RestController; + +/** + * 示例模块 Controller + */ +@RestController +@RequestMapping("/api/example") +public class ExampleController { + + @RequestMapping("/hello") + public String hello() { + return "world"; + } + +} \ No newline at end of file diff --git a/lab-02/resource-owner-password-credentials-server/src/main/resources/application.properties b/lab-02/resource-owner-password-credentials-server/src/main/resources/application.properties new file mode 100644 index 00000000..5c6bfc10 --- /dev/null +++ b/lab-02/resource-owner-password-credentials-server/src/main/resources/application.properties @@ -0,0 +1,3 @@ +# Spring Security Setting +security.user.name=yunai +security.user.password=1024 \ No newline at end of file