OKTA==springboot2.5.4整合OKTA实现单点登录demo

SSO demo with Okta and spring boot - YouTube

整体流程

 去okta注册后会自动生成一个教程，点击 Create your web application

 

设置OKTA认证成功之后返回toekn的URL ，这个地址如果spring security没有指定登录URL，就默认是这个

 ​​​​​​​http://localhost:8081/login

 

获取到client id 和client sercret ,会用在springboot配置文件中

 

获取为这个app提供认证的网址， 就是springboot配置文件中需要写的issuer

 然后设置能够访问这个app的用户，设置邮箱密码

 

 点击新建的people，将app asigned给指定的people

 =========================================================

编写springboot程序

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
		 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.5.4</version>
		<relativePath/> <!-- lookup parent from repository -->
	</parent>
	<groupId>com.example</groupId>
	<artifactId>demo-okta-sso</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>demo-okta-sso</name>
	<description>Demo project for Spring Boot</description>
	<properties>
		<java.version>1.8</java.version>
	</properties>
	<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>
		<dependency>
			<groupId>com.okta.spring</groupId>
			<artifactId>okta-spring-boot-starter</artifactId>
			<version>0.6.0</version>
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-test</artifactId>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>org.springframework.security.oauth.boot</groupId>
			<artifactId>spring-security-oauth2-autoconfigure</artifactId>
			<version>2.1.5.RELEASE</version>
		</dependency>
	</dependencies>

	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
		</plugins>
	</build>

</project>

package com.example.demooktasso;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.annotation.security.PermitAll;
import java.security.Principal;

@SpringBootApplication
@RestController
@EnableOAuth2Sso
public class DemoOktaSsoApplication {


	@GetMapping("/")
	public String greetUser(Principal principal){
		return "Hello "+principal.getName()+" from application 2";
	}

	public static void main(String[] args) {
		SpringApplication.run(DemoOktaSsoApplication.class, args);
	}

}

server.port=8081

#from application
okta.oauth2.clientId=刚才在OKTA官网查看到的
okta.oauth2.clientSecret=刚才在OKTA官网查看到的
#from API
okta.oauth2.issuer=刚才在OKTA官网查看到的

======================================

启动程序

无痕模式访问localhost:8081

会重定向到这

重定向的完整路径
https://dev-44813837.okta.com/oauth2/default/v1/authorize?client_id=0oa5w5fx8u66AZswK5d7&redirect_uri=http://localhost:8081/login&response_type=code&scope=profile%20email%20openid&state=wLmpI1

详细信息
https://dev-44813837.okta.com/oauth2/default/v1/authorize?
client_id=0oa5w5fx8u66AZswK5d7
&redirect_uri=http://localhost:8081/login
&response_type=code
&scope=profile%20email%20openid
&state=wLmpI1

重定向到这就会获取到对应app的认证页面，输入people的邮箱密码

然后依次发起三次请求

https://dev-44813837.okta.com/login/token/redirect?
stateToken=02.id.i224I4bxORCa1dAC1xD_v1nWU3t645m50eprGyUR

http://localhost:8081/login?
code=DQTcQ8pJKVkIBmWDinYP54S6OGzWuX6pBnUpOZN4Ms8&state=wLmpI1

http://localhost:8081/

成功访问到资源

====================================

修改代码开个8080端口，然后在OKTA中配置以下重定向的URL，启动项目，无痕模式发现登录不了，因为8081已经登录了