一、参数配置
1)配置参数:application.yml
springcloud:
security:
oauth2:
clients[0]:
clientId: zuul-server
clientSecret: '12345678'
accessTokenValiditySeconds: 7200 //通行token有效时间(秒)
refreshTokenValiditySeconds: 604800 //刷新token有效时间(秒)
clients[1]:
clientId: user-server
clientSecret: '123456'
accessTokenValiditySeconds: 7200
refreshTokenValiditySeconds: 604800
2)单个客户端配置封装类:OAuth2ClientProperties.java
@Getter @Setter public class OAuth2ClientProperties {
private String clientId; //客户端id
private String clientSecret; //客户端秘钥
private Integer accessTokenValiditySeconds; //通行token有效时长
private Integer refreshTokenValiditySeconds; //刷新token有效时长
}
3)从配置文件获取配置封装到配置集合中:OAuth2Properties.java
@ConfigurationProperties(prefix = "springcloud.security.oauth2") //匹配前缀为springcloud.security.oauth2的参数
public class OAuth2Properties
{
private OAuth2ClientProperties[] clients = {};//把参数放到数组中,此处也可以从数据库获取,本例子直接配置获取
public OAuth2ClientProperties[] getClients() {
return clients;
}
//OAuth2ClientProperties 单个配置实体封装
public void setClients(OAuth2ClientProperties[] clients) {
this.clients = clients;
}
}
4)核心配置--扫描、注册自定义配置参数
@Configuration
@EnableConfigurationProperties(OAuth2Properties.class)
public class OAuth2CoreConfig
{
}
二、业务配置
1)认证授权参数配置
@Configuration
@EnableResourceServer
@EnableAuthorizationServer //开启授权服务
public class OAuth2Config1 extends AuthorizationServerConfigurerAdapter
{
private JsonParser objectMapper = JsonParserFactory.create();
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private OAuth2Properties oauth2Properties;//注入配置类
@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
//这句不知道是干啥的,大概是开启一个身份验证表单的功能吧,就是弹出一个输入账户、密码的框
oauthServer.allowFormAuthenticationForClients();
}
/*配置客户端基本信息,循环配置数组,加载到配置服务运行内存,用于授权判断*/
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
// 客户端配置化
InMemoryClientDetailsServiceBuilder build = clients.inMemory();
if (ArrayUtils.isNotEmpty(oauth2Properties.getClients())) {
// 验证模式:刷新token,密码、验证码模式,也可根据客户端自定义配置
for (OAuth2ClientProperties config : oauth2Properties.getClients()) {
build.withClient(config.getClientId()).secret(config.getClientSecret())
.accessTokenValiditySeconds(config.getAccessTokenValiditySeconds()) //通行token
.refreshTokenValiditySeconds(config.getRefreshTokenValiditySeconds()) // 刷新token
.authorizedGrantTypes("refresh_token", "password", "authorization_code")//验证模式
.scopes("platform");//作用域,可以在配置中按实际业务自定义各个客户端的作用域,写死并不可取
}
}
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
//JWT方式
endpoints.tokenStore(tokenStore())//设置token存储方式,见方法实现
.tokenEnhancer(jwtTokenEnhancer()) //设置token的加密方式,见方法实现
.authenticationManager(authenticationManager);//开启密码类型验证的bean
}
@Bean
public TokenStore tokenStore() {
return new JwtTokenStore(jwtTokenEnhancer());
}
/*JWT token生成规则,此处对原来的转换器 JwtAccessTokenConverter 下的方法 enhance() 进行重写,
来补充生成token中自定义的业务字段,如组织架构id、用户id等字段*/
@Bean
public JwtAccessTokenConverter jwtTokenEnhancer() {
JwtAccessTokenConverter converter = new JwtAccessTokenConverter() {
/*重写token生成方法,补充组织架构、用户id内容*/
@Override
public OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {
DefaultOAuth2AccessToken result = new DefaultOAuth2AccessToken(accessToken);
Map<String, Object> info = new LinkedHashMap<String, Object>(accessToken.getAdditionalInformation());//附加信息map
String tokenId = result.getValue();
if (!info.containsKey(TOKEN_ID)) {
info.put(TOKEN_ID, tokenId);
}
else {
tokenId = (String) info.get(TOKEN_ID);
}
//自定义信息设置到token负载中
SysUser user = (SysUser)authentication.getPrincipal();//SysUser:系统的登录用户实体,根据实际业务设计
info.put("orgId", us