使用SpringSecurity Oauth2.0实现自定义鉴权中心

Oauth2.0是什么不在赘述，本文主要介绍如何使用SpringSecurity Oauth2.0实现自定义的用户校验

1.鉴权中心服务

首先，列举一下我们需要用到的依赖，本文采用的是数据库保存用户信息redis保存token的方式。

pom依赖：

       ---- security依赖
       <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
            <version>2.3.4.RELEASE</version>
        </dependency>
      ---- oauth2.0依赖

        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-oauth2</artifactId>
            <version>2.2.4.RELEASE</version>
        </dependency>
      ----- redis依赖用于存储token

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-redis</artifactId>
            <version>2.3.4.RELEASE</version>
        </dependency>
      ----- mybatisPlus用于操作数据库

        <dependency>
            <groupId>com.baomidou</groupId>
            <artifactId>mybatis-plus-boot-starter</artifactId>
            <version>3.4.0</version>
        </dependency>

      ------mysql 驱动
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>5.1.49</version>
        </dependency>

添加完引用后，我们需要配置Oauth鉴权中的两大服务：鉴权服务和资源服务

一、鉴权服务

鉴权服务中我们需要配置存储token用的redis，用于从DB中拉取Client信息的服务类，用于进行Token生产和维护的服务类，最后还要外露获取token的节点和进行token校验的节点

在开始以前首先我们要搞清SpringSecurity中的一些基本类的作用和概念，这里贴出一篇不错的文章： https://www.cnkirito.moe/spring-security-1/

1.首先我们要定义我们的用户实体类，必须要实现UserDetails接口，我们的实体类中仅仅简单的定义了用户名和密码，剩下的全部实现自UserDetails接口

public class User implements UserDetails {

    @TableId(type = IdType.AUTO)
    private int id;

    private String username;

    private String password;

    private boolean isEnabled;

    public int getId() {
        return id;
    }

    public void setId(int id) {
        this.id = id;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public void setEnabled(boolean enabled) {
        isEnabled = enabled;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }

    @Override
    public String getPassword() {
        return this.password;
    }

    @Override
    public String getUsername() {
        return this.username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return this.isEnabled;
    }
}

数据库脚本：

CREATE TABLE `t_user` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `user_name` varchar(50) NOT NULL,
  `password` varchar(255) NOT NULL,
  `is_account_non_expired` tinyint(4) NOT NULL,
  `is_account_non_locked` tinyint(4) DEFAULT NULL,
  `is_credentials_non_expired` tinyint(4) NOT NULL,
  `is_enabled` tinyint(4) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=16 DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;

2.自定义自己的用户查找服务类，必须集成UserDetaailsService接口且实现loadUserByUsername接口，届时spring框架会通过这个方法内的自定义逻辑找到你想要的用户

public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    private UserMapper userMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user= userMapper.queryUserByUsername(username);
        if (user==null){
            throw new UsernameNotFoundException("user no found");
        }
        return  user;
    }
}

userMapper:就是一个非常基础的数据库查询语句

<mapper namespace="com.example.oauth2.mapper.UserMapper">
    <select id="queryUserByUsername" resultType="com.example.oauth2.entity.User">
        select * from t_user where user_name=#{username}
    </select>
</mapper>

3.配置鉴权服务器，我们需要把redis和上面自定义的用户查询配置到鉴权服务里

Configuration
//开启鉴权服务器
@EnableAuthorizationServer
public class AuthoriztionServerConfiguration extends AuthorizationServerConfigurerAdapter {

    //全局SpringSecurity AuthenticationManager 需要在SpringSecurity中注入，下文会写到
    @Autowired
    private AuthenticationManager authenticationManager;

    //redis工厂会自动配置
    @Autowired
    private RedisConnectionFactory redisConnectionFactory;

    //数据源会自动配置
    @Autowired
    private DataSource dataSource;

    //我们自定义的UserDetailsService实现类
    @Autowired
    private UserDetailsService userDetailsService;

    //全局加密编码类
    @Autowired
    private BCryptPasswordEncoder passwordEncoder;

    /**
     * 用来配置令牌端点的安全约束
     * @param security
     * @throws Exception
     */
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security
                //允许所有用户访问 /oauth/token节点来获取token
                .tokenKeyAccess("permitAll()")
                //允许已经鉴权通过的用户访问 /oauth/check_token节点
                .checkTokenAccess("isAuthenticated()")
                // 允许表单认证
                .allowFormAuthenticationForClients();
    }

    /**
     * 定义客户端详细信息的配置器
     * @param clients
     * @throws Exception
     */
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
//         从DB中拉取client信息
        clients.withClientDetails(jdbcClientDetailsService());
    }

    /**
     *配置鉴权服务终结点配置
     * @param endpoints
     * @throws Exception
     */
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception{
        endpoints.authenticationManager(this.authenticationManager)
                //配置允许访问的http方式
                .allowedTokenEndpointRequestMethods(HttpMethod.GET,HttpMethod.POST)
                //用于配置自定义的用户校验服务
                .userDetailsService(userDetailsService)
                //配置自定义的token保存地址
                .tokenStore(tokenStore())
                //用于配置自定义的token维护服务
                .tokenServices(tokenServices());
    }

    /**
     * 配置使用redis来存储token
     * @return
     */
    @Bean
    public TokenStore tokenStore(){
        return new RedisTokenStore(redisConnectionFactory);
    }

    /**
     * 配置通过数据的方式去读取client信息
     * @return
     */
    @Bean
    public ClientDetailsService jdbcClientDetailsService(){
        JdbcClientDetailsService jdbcClientDetailsService=new JdbcClientDetailsService(dataSource);
        jdbcClientDetailsService.setPasswordEncoder(passwordEncoder);
        return  jdbcClientDetailsService;
    }

    /**
     * 自定义token的生产和过期机制
     * @return
     */
    @Bean
    public DefaultTokenServices tokenServices(){
        DefaultTokenServices defaultTokenServices=new DefaultTokenServices();
        defaultTokenServices.setAccessTokenValiditySeconds((int)TimeUnit.HOURS.toSeconds(4));
        defaultTokenServices.setRefreshTokenValiditySeconds((int)TimeUnit.HOURS.toSeconds(2));
        defaultTokenServices.setSupportRefreshToken(true);
        defaultTokenServices.setTokenStore(tokenStore());
        return  defaultTokenServices;
    }

    /**
     * 指定全局加密方式
     * @return
     */
    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

同时我们需要在数据库中建一张client的信息表SQL脚本：

CREATE TABLE `oauth_client_details` (
  `client_id` varchar(256) NOT NULL,
  `resource_ids` varchar(256) DEFAULT NULL,
  `client_secret` varchar(256) DEFAULT NULL,
  `scope` varchar(256) DEFAULT NULL,
  `authorized_grant_types` varchar(256) DEFAULT NULL,
  `web_server_redirect_uri` varchar(256) DEFAULT NULL,
  `authorities` varchar(256) DEFAULT NULL,
  `access_token_validity` int(11) DEFAULT NULL,
  `refresh_token_validity` int(11) DEFAULT NULL,
  `additional_information` varchar(4096) DEFAULT NULL,
  `autoapprove` varchar(256) DEFAULT NULL,
  PRIMARY KEY (`client_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

完成以上步骤后鉴权服务器就配置完成了，记下来我们需要配置资源服务器

2.资源服务器

资源服务器配置相对简单，我们只需要暴露出可供用户使用的节点即可

@Configuration
//开启资源服务
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception{
        http
                .authorizeRequests()
                //暴露出/oauth/**的所有接口
                .antMatchers("/oauth/**")
                .permitAll()
                .anyRequest()
                .authenticated();
    }
}

配置完资源服务之后最关键的一步来了，我们需要自定义自己的用户校验

3.自定义用户校验

SpringSecurity中所有的校验都是通过AuthenticationProvider来实现的，所以我们需要实现自己的Provider注入到用于校验的Provider列表中去

@Component
public class MyAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

    //前面我们自己实现的读取用户信息的实现类
    @Autowired
    private UserDetailsService userDetailsService;

    //全局加密方式
    @Autowired
    private BCryptPasswordEncoder passwordEncoder;

    //对表单传入的用户信息和线程上下文中的用户进行比对判断是否是正确的用户
    @Override
    protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken) throws AuthenticationException {
       //数据库中的密码
        String authPassword = userDetails.getPassword();
        //上下文中的密码
        String tokenPassword = (String) usernamePasswordAuthenticationToken.getCredentials();
        boolean isPass = passwordEncoder.matches(tokenPassword, authPassword);
        if (isPass) {
            return;
        }
        throw new AuthenticationServiceException("password.wrong");
    }

    //根据表单中传入的用户名从数据库中获取用户信息
    @Override
    protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken) throws AuthenticationException {
        UserDetails user = userDetailsService.loadUserByUsername(username);
        if (user == null) {
            throw new AuthenticationServiceException("未找到用户");
        }
        return user;
    }
}

把我们自定的provider注入进去

@Configuration
public class GlobalAuthenticationConfig extends GlobalAuthenticationConfigurerAdapter {

    @Autowired
    private MyAuthenticationProvider authenticationProvider;

    @Override
    public void init(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider( authenticationProvider);

    }
}

最后我们需要配置一下SpringSecurity

4.配置SpringSecurity

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private MyAuthenticationProvider authenticationProvider;

    /**
     * 注入用户信息服务
     * @return 用户信息服务对象
     */
    @Bean
    @Override
    public UserDetailsService userDetailsService() {
        return new UserDetailsServiceImpl();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS,"/oauth/**")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .csrf()
                .disable();
    }
}

然后配置文件中配好数据库和redis信息

server:
  port: 5000
spring:
  datasource:
    url: xxx
    username: xxx
    password: xxx
    driver-class-name: com.mysql.jdbc.Driver
  redis:
    host: xxx
    port: 6379
    database: 7
    password: xxx


mybatis-plus:
  mapper-locations: classpath:/mapper/*Mapper.xml
  configuration:
    map-underscore-to-camel-case: true
logging:
  level:
    ROOT: debug

在启动之前我们需要先在数据库中添加一个client和一个用户

@SpringBootTest
class Oauth2ApplicationTests {

    @Autowired
    JdbcClientDetailsService jdbcClientDetailsService;


    @Autowired
    private BCryptPasswordEncoder passwordEncoder;

    @Test
    void contextLoads() {
        //通过我们在鉴权服务中注入的JdbcClientDetailsService来插入一条Client信息
        BaseClientDetails baseClientDetails = new BaseClientDetails();
        baseClientDetails.setClientId("client");
        baseClientDetails.setClientSecret(passwordEncoder.encode("secret"));
        List<String> grantTypes = new ArrayList<>();
        grantTypes.add("password");
        baseClientDetails.setAuthorizedGrantTypes(grantTypes);
        jdbcClientDetailsService.addClientDetails(baseClientDetails);
        //用指定的密码生成器搞一个密码一会手动填到库里这里就不写sql 了
        String str = passwordEncoder.encode("666");
        System.out.println("终于他妈的完事了");/**/
    }

}

注意给scope填个select上面忘记写了

启动项目访问获取通通token的接口，完美。