Spring Security OAuth2 授权码模式的实现

 <!--Spring Security-->
  <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-security</artifactId>
  </dependency>
  <!--Spring Boot Starter Web 所有demo均使用web-->
  <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-web</artifactId>
  </dependency>
  <!-- Spring Security OAuth2 -->
  <dependency>
   <groupId>org.springframework.security.oauth</groupId>
   <artifactId>spring-security-oauth2</artifactId>
   <version>${spring-security-oauth2.version}</version>
  </dependency>

package com.github.hellxz.oauth2.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

import java.util.Collections;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

 @Bean
 public PasswordEncoder passwordEncoder(){
  return new BCryptPasswordEncoder();
 }

 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  // @formatter: off
  auth.inMemoryAuthentication()
    .withUser("hellxz")
    .password(passwordEncoder().encode("xyz"))
    .authorities(Collections.emptyList());
  // @formatter: on
 }

 @Override
 protected void configure(HttpSecurity http) throws Exception {
  http.authorizeRequests()
    .anyRequest().authenticated() //所有请求都需要通过认证
    .and()
    .httpBasic() //Basic登录
    .and()
    .csrf().disable(); //关跨域保护
 }
}

package com.github.hellxz.oauth2.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;

//授权服务器配置
@Configuration
@EnableAuthorizationServer //开启授权服务
public class AuthorizationConfig extends AuthorizationServerConfigurerAdapter {

 @Autowired
 private PasswordEncoder passwordEncoder;

 @Override
 public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
  //允许表单提交
  security.allowFormAuthenticationForClients()
    .checkTokenAccess("isAuthenticated()");
 }

 @Override
 public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  // @formatter: off
  clients.inMemory()
    .withClient("client-a") //client端唯一标识
     .secret(passwordEncoder.encode("client-a-secret")) //客户端的密码，这里的密码应该是加密后的
     .authorizedGrantTypes("authorization_code") //授权模式标识
     .scopes("read_user_info") //作用域
     .resourceIds("resource1") //资源id
     .redirectUris("http://localhost:9001/callback"); //回调地址
  // @formatter: on
 }
}

{
 "access_token": "99435e13-f9fe-438a-a94e-3b00d549b329", //访问token
 "token_type": "bearer", //token类型，使用时需要拼接在token前并在token前加空格
 "expires_in": 43199, //过期时间
 "scope": "read_user_info" //作用域
}

package com.github.hellxz.oauth2.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.RemoteTokenServices;

@Configuration
@EnableResourceServer
public class ResourceConfig extends ResourceServerConfigurerAdapter {

 @Bean
 public PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder();
 }

 @Primary
 @Bean
 public RemoteTokenServices remoteTokenServices() {
  final RemoteTokenServices tokenServices = new RemoteTokenServices();
  //设置授权服务器check_token端点完整地址
  tokenServices.setCheckTokenEndpointUrl("http://localhost:8080/oauth/check_token");
  //设置客户端id与secret，注意：client_secret值不能使用passwordEncoder加密！
  tokenServices.setClientId("client-a");
  tokenServices.setClientSecret("client-a-secret");
  return tokenServices;
 }

 @Override
 public void configure(HttpSecurity http) throws Exception {
  //设置创建session策略
  http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
  //@formatter:off
  //所有请求必须授权
  http.authorizeRequests()
    .anyRequest().authenticated();
  //@formatter:on
 }

 @Override
 public void configure(ResourceServerSecurityConfigurer resources) {
  resources.resourceId("resource1").stateless(true);
 }
}

package com.github.hellxz.oauth2.web.controller;

import com.github.hellxz.oauth2.web.vo.UserVO;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class ResourceController {

 @GetMapping("/user/{username}")
 public UserVO user(@PathVariable String username){
  return new UserVO(username, username + "@foxmail.com");
 }
}

package com.github.hellxz.oauth2.web.vo;

public class UserVO {
 private String username;
 private String email;

 public UserVO(String username, String email) {
  this.username = username;
  this.email = email;
 }

 public String getUsername() {
  return username;
 }

 public void setUsername(String username) {
  this.username = username;
 }

 public String getEmail() {
  return email;
 }

 public void setEmail(String email) {
  this.email = email;
 }
}