Spring Security OAuth2 授权码模式 (Authorization Code)

前言

Spring Security OAuth2 授权码模式 (Authorization Code)
应该是授权登录的一个行业标准

整体流程

1. 首先在平台注册获取CLIENT_ID和CLIENT_SECRET 即应用id和key
2. 第三方通过请求重定向到平台的登录页面
3. 输入平台的账号密码之后点击确认授权重定向到第三方的页面并携带code
4. 通过code获取token
5. 通过token获取用户信息

code的实现逻辑

• 自带的InMemoryAuthorizationCodeServices是用ConcurrentHashMap存储的
• 通过父类的createAuthorizationCode方法生成一个code
• 通过code获取token时通过remove获取对应的用户信息同时删除token 做到只能使用一次
• 这里也不难看出 可以通过重新这个类来做到自定义的code

public class InMemoryAuthorizationCodeServices extends RandomValueAuthorizationCodeServices {
    protected final ConcurrentHashMap<String, OAuth2Authentication> authorizationCodeStore = new ConcurrentHashMap();

    public InMemoryAuthorizationCodeServices() {
    }

    protected void store(String code, OAuth2Authentication authentication) {
        this.authorizationCodeStore.put(code, authentication);
    }

    public OAuth2Authentication remove(String code) {
        OAuth2Authentication auth = (OAuth2Authentication)this.authorizationCodeStore.remove(code);
        return auth;
    }
}

对应的配置

1. 数据库添加authorization_code
2. 放行Login页面

protected void configure(HttpSecurity http) throws Exception {
               /* http.requestMatcher(new OAuth2RequestedMatcher()).authorizeRequests().antMatchers("ljl-auth/oauth/token","/login").permitAll().anyRequest().authenticated().and()
                .httpBasic().and().csrf().disable();*/
/*        ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = http
                .authorizeRequests();
        registry.and().addFilterBefore(securityOauthFilter, FilterSecurityInterceptor.class);*/

        http
                .requestMatchers().anyRequest()
                .and().authorizeRequests().antMatchers(HttpMethod.OPTIONS, "/public/login","/oauth/**").permitAll()
                .antMatchers("/swagger-ui.html").permitAll()
                .antMatchers("/webjars/**").permitAll()
                .antMatchers("/v2/**").permitAll()
                .antMatchers("/swagger-resources/**").permitAll().and()
                .formLogin().permitAll()
                .and().csrf();
    }

由于我添加了各种自定义的认证模式所以要保持InMemoryAuthorizationCodeServices一致
之前通过code获取token一直报code失效 是因为InMemoryAuthorizationCodeServices不是单例 导致了去获取code的时候不是同一个对象

@Override
//重点inMemoryAuthorizationCodeServices
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore()).tokenGranter(tokenGranter)
                .authenticationManager(this.authenticationManager)
                .userDetailsService(OauthUserService).accessTokenConverter(jwtAccessTokenConverter()).authorizationCodeServices(inMemoryAuthorizationCodeServices());
    }

//重点inMemoryAuthorizationCodeServices
private AuthorizationCodeServices authorizationCodeServices() {
        if (authorizationCodeServices == null) {
            authorizationCodeServices = inMemoryAuthorizationCodeServices;
        }
        return authorizationCodeServices;
    }
private List<TokenGranter> getDefaultTokenGranters() {
        AuthorizationServerTokenServices tokenServices = tokenServices();
        AuthorizationCodeServices authorizationCodeServices = authorizationCodeServices();
        OAuth2RequestFactory requestFactory = requestFactory();

        List<TokenGranter> tokenGranters = new ArrayList<TokenGranter>();
        // 添加授权码模式
        tokenGranters.add(new AuthorizationCodeTokenGranter(tokenServices, authorizationCodeServices, clientDetailsService, requestFactory));
        // 添加刷新令牌的模式
        tokenGranters.add(new RefreshTokenGranter(tokenServices, clientDetailsService, requestFactory));
        // 添加隐士授权模式
        tokenGranters.add(new ImplicitTokenGranter(tokenServices, clientDetailsService, requestFactory));
        // 添加客户端模式
        tokenGranters.add(new ClientCredentialsTokenGranter(tokenServices, clientDetailsService, requestFactory));
        if (authenticationManager != null) {
            // 添加密码模式
            tokenGranters.add(new ResourceOwnerPasswordTokenGranter(authenticationManager, tokenServices, clientDetailsService, requestFactory));
            // 添加自定义授权模式（手机号码）
            tokenGranters.add(new MobileCodeTokenGranter(authenticationManager, tokenServices, clientDetailsService, requestFactory));
            // 添加自定义授权模式（cas)
            tokenGranters.add(new CasTicketTokenGranter(authenticationManager, tokenServices, clientDetailsService, requestFactory));
        }
        return tokenGranters;
    }

流程展示

浏览器上面通过请求到平台的登录页

http://127.0.0.1:8881/base/oauth/authorize?response_type=code&client_id=curl_client&client_secret=user&redirect_uri=http://baidu.com

输入账号密码

授权

获取token

通过code获取token

http://127.0.0.1:8881/base/oauth/token?grant_type=authorization_code&client_id=curl_client&client_secret=user&code=RAMMan&redirect_uri=http://baidu.com