Spring Authorization Server 自定义授权模式

已于 2023-06-19 22:48:01 修改
阅读量4.2k 收藏 30
点赞数 8
分类专栏： 编程学习 文章标签： spring java spring boot
于 2023-02-07 23:09:22 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/moresi/article/details/128927500
版权

在本小节中，我们将自定义 Spring Authorization Server 授权模式 - 密码模式（password）。
源码请见：GitHub： https://github.com/motribe/spring-authorization-server

背景

Spring Security团队停止维护 Spring Security OAuth，推荐使用 Spring Authorization Server 。然而基于OAuth 2.1的 Spring Authorization Server 将不再对以下两种授权模式提供支持：

  • 密码模式（password）
  • 简化模式（implicit）

对于已经依赖了这两种授权模式的项目，出于这样那样的各种原因，来不及或无法迁移至新的授权模式，该如何处理？

或许我们可以考虑自行实现授权模式，比如：密码模式（password）

版本说明

  • Spring Boot：2.7.2
  • Spring Authorization Server：0.4.0

实现

在开始之前，需要着重说明一点：由于自定义授权模式所依赖的某些 Spring Authorization Server 类只能在同 package 下访问，请大家在自己项目的src目录下先创建 同名的 package 路径，拷贝代码时也 请勿改变 package 。

1. 自定义AuthenticationToken

AuthenticationToken用于存放 密码模式（password）所需的各种信息，包括 username、password、scopes 等。

OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken

package org.springframework.security.oauth2.server.authorization.authentication;

import java.util.Collections;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

import org.springframework.lang.Nullable;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.util.Assert;

/**
 * An {@link Authentication} implementation used for the OAuth 2.0 Resource Owner Password Credentials Grant.
 *
 * @author Moluo
 * @since 0.0.1
 * @see OAuth2AuthorizationGrantAuthenticationToken
 * @see OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider
 */
public class OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken extends OAuth2AuthorizationGrantAuthenticationToken {
	private final String username;
	private final String password;
	private final Set<String> scopes;

	/**
	 * Constructs an {@code OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken} using the provided parameters.
	 * @param username the username
	 * @param password the password
	 * @param clientPrincipal the authenticated client principal
	 * @param scopes the requested scope(s)
	 * @param additionalParameters the additional parameters
	 */
	public OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken(String username, String password, Authentication clientPrincipal,
																	 @Nullable Set<String> scopes, @Nullable Map<String, Object> additionalParameters) {
		super(AuthorizationGrantType.PASSWORD, clientPrincipal, additionalParameters);
		Assert.hasText(username, "username cannot be empty");
		Assert.hasText(username, "password cannot be empty");
		this.username = username;
		this.password = password;
		this.scopes = Collections.unmodifiableSet(
				scopes != null ? new HashSet<>(scopes) : Collections.emptySet());
	}

	/**
	 * Returns the username.
	 *
	 * @return the username
	 */
	public String getUsername() {
		return this.username;
	}

	/**
	 * Returns the password.
	 *
	 * @return the password
	 */
	@Nullable
	public String getPassword() {
		return this.password;
	}

	/**
	 * Returns the requested scope(s).
	 *
	 * @return the requested scope(s), or an empty {@code Set} if not available
	 */
	public Set<String> getScopes() {
		return this.scopes;
	}
}

2. 自定义AuthenticationConverter

AuthenticationConverter用于从HttpServletRequest中提取 密码模式（password） 所需的各种信息，包括username、password、scopes等。并转换为步骤1中的AuthenticationToken

OAuth2ResourceOwnerPasswordCredentialsAuthenticationConverter

package org.springframework.security.oauth2.server.authorization.web.authentication;

import java.util.*;

import javax.servlet.http.HttpServletRequest;

import org.springframework.lang.Nullable;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken;
import org.springframework.security.oauth2.server.authorization.web.OAuth2TokenEndpointFilter;
import org.springframework.security.web.authentication.AuthenticationConverter;
import org.springframework.util.MultiValueMap;
import org.springframework.util.StringUtils;

/**
 * Attempts to extract an Access Token Request from {@link HttpServletRequest} for the OAuth 2.0 Resource Owner Password Credentials Grant
 * and then converts it to an {@link OAuth2ResourceOwnerPasswordCredentialsAuthenticationConverter} used for authenticating the authorization grant.
 *
 * @author Moluo
 * @since 0.1.2
 * @see AuthenticationConverter
 * @see OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken
 * @see OAuth2TokenEndpointFilter
 */
public final class OAuth2ResourceOwnerPasswordCredentialsAuthenticationConverter implements AuthenticationConverter {

	@Nullable
	@Override
	public Authentication convert(HttpServletRequest request) {
		// grant_type (REQUIRED)
		String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
		if (!AuthorizationGrantType.PASSWORD.getValue().equals(grantType)) {
			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// username (REQUIRED)
		String username = parameters.getFirst(OAuth2ParameterNames.USERNAME);
		if (!StringUtils.hasText(username) ||
				parameters.get(OAuth2ParameterNames.USERNAME).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.USERNAME,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

		// password (REQUIRED)
		String password = parameters.getFirst(OAuth2ParameterNames.PASSWORD);
		if (StringUtils.hasText(password) &&
				parameters.get(OAuth2ParameterNames.PASSWORD).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.PASSWORD,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

		// scope (OPTIONAL)
		String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
		if (StringUtils.hasText(scope) &&
				parameters.get(OAuth2ParameterNames.SCOPE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.SCOPE,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}
		Set<String> requestedScopes = null;
		if (StringUtils.hasText(scope)) {
			requestedScopes = new HashSet<>(
					Arrays.asList(StringUtils.delimitedListToStringArray(scope, " ")));
		}

		Map<String, Object> additionalParameters = new HashMap<>();
		parameters.forEach((key, value) -> {
			if (!key.equals(OAuth2ParameterNames.GRANT_TYPE) &&
					!key.equals(OAuth2ParameterNames.USERNAME) &&
					!key.equals(OAuth2ParameterNames.PASSWORD) &&
					!key.equals(OAuth2ParameterNames.SCOPE)) {
				additionalParameters.put(key, value.get(0));
			}
		});

		return new OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken(
				username, password, clientPrincipal, requestedScopes, additionalParameters);
	}

}

3. 自定义AuthenticationProvider

AuthenticationProvider 是自定义 密码模式（password） 的核心逻辑，其功能主要如下：

  • 检验 密码模式（password） 所需信息的正确性，包括 username、password、scopes 等
  • 检验通过后，生成并返回 Access token、Refresh token、ID token 等信息

OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider

package org.springframework.security.oauth2.server.authorization.authentication;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.core.*;
import org.springframework.security.oauth2.core.oidc.OidcIdToken;
import org.springframework.security.oauth2.core.oidc.OidcScopes;
import org.springframework.security.oauth2.core.oidc.endpoint.OidcParameterNames;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.server.authorization.OAuth2Authorization;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
import org.springframework.security.oauth2.server.authorization.OAuth2TokenType;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
import org.springframework.security.oauth2.server.authorization.token.DefaultOAuth2TokenContext;
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenContext;
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenGenerator;
import org.springframework.util.Assert;
import org.springframework.util.CollectionUtils;

import java.security.Principal;
import java.util.*;

import static org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthenticationProviderUtils.getAuthenticatedClientElseThrowInvalidClient;

/**
 * An {@link AuthenticationProvider} implementation for the OAuth 2.0 Resource Owner Password Credentials Grant.
 *
 * @author Moluo
 * @since 0.0.1
 * @see OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken
 * @see OAuth2AccessTokenAuthenticationToken
 * @see OAuth2AuthorizationService
 * @see OAuth2TokenGenerator
 * @see <a target="_blank" href="https://datatracker.ietf.org/doc/html/rfc6749#section-4.3">Section 4.3 Resource Owner Password Credentials Grant</a>
 */
public final class OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider implements AuthenticationProvider {
	private static final String ERROR_URI = "https://datatracker.ietf.org/doc/html/rfc6749#section-4.3";
	private static final OAuth2TokenType ID_TOKEN_TOKEN_TYPE = new OAuth2TokenType(OidcParameterNames.ID_TOKEN);
	private final Log logger = LogFactory.getLog(getClass());
	private final OAuth2AuthorizationService authorizationService;
	private final OAuth2TokenGenerator<? extends OAuth2Token> tokenGenerator;
	private final UserDetailsService userDetailsService;
	private final PasswordEncoder passwordEncoder;

	/**
	 * Constructs an {@code OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider} using the provided parameters.
	 *
	 * @param authorizationService the authorization service
	 * @param tokenGenerator the token generator
	 * @param userDetailsService the user details service
	 * @param passwordEncoder the password encoder
	 * @since 0.2.3
	 */
	public OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider(OAuth2AuthorizationService authorizationService,
																		OAuth2TokenGenerator<? extends OAuth2Token> tokenGenerator,
																		UserDetailsService userDetailsService,
																		PasswordEncoder passwordEncoder) {
		Assert.notNull(authorizationService, "authorizationService cannot be null");
		Assert.notNull(tokenGenerator, "tokenGenerator cannot be null");
		Assert.notNull(userDetailsService, "userDetailsService cannot be null");
		Assert.notNull(passwordEncoder, "passwordEncoder cannot be null");
		this.authorizationService = authorizationService;
		this.tokenGenerator = tokenGenerator;
		this.userDetailsService = userDetailsService;
		this.passwordEncoder = passwordEncoder;
	}

	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken resourceOwnerPasswordCredentialsAuthentication =
				(OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken) authentication;

		OAuth2ClientAuthenticationToken clientPrincipal =
				getAuthenticatedClientElseThrowInvalidClient(resourceOwnerPasswordCredentialsAuthentication);
		RegisteredClient registeredClient = clientPrincipal.getRegisteredClient();

		if (this.logger.isTraceEnabled()) {
			this.logger.trace("Retrieved registered client");
		}

		if (!registeredClient.getAuthorizationGrantTypes().contains(AuthorizationGrantType.PASSWORD)) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.UNAUTHORIZED_CLIENT);
		}

		Set<String> authorizedScopes = Collections.emptySet();
		if (!CollectionUtils.isEmpty(resourceOwnerPasswordCredentialsAuthentication.getScopes())) {
			for (String requestedScope : resourceOwnerPasswordCredentialsAuthentication.getScopes()) {
				if (!registeredClient.getScopes().contains(requestedScope)) {
					throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_SCOPE);
				}
			}
			authorizedScopes = new LinkedHashSet<>(resourceOwnerPasswordCredentialsAuthentication.getScopes());
		}

		UserDetails userDetails;
		try {
			userDetails = this.userDetailsService.loadUserByUsername(resourceOwnerPasswordCredentialsAuthentication.getUsername());
		} catch (UsernameNotFoundException e) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
		}
		if (userDetails == null) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
		}

		if (!this.passwordEncoder.matches(resourceOwnerPasswordCredentialsAuthentication.getPassword(), userDetails.getPassword())) {
			if (this.logger.isDebugEnabled()) {
				this.logger.debug("Failed to authenticate since password does not match stored value");
			}
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
		}

		if (this.logger.isTraceEnabled()) {
			this.logger.trace("Validated token request parameters");
		}

        Authentication principal = new UsernamePasswordAuthenticationToken(userDetails.getUsername(), userDetails.getPassword(), userDetails.getAuthorities());

		// @formatter:off
		DefaultOAuth2TokenContext.Builder tokenContextBuilder = DefaultOAuth2TokenContext.builder()
				.registeredClient(registeredClient)
				.principal(principal)
				.authorizationServerContext(AuthorizationServerContextHolder.getContext())
				.authorizedScopes(authorizedScopes)
				.authorizationGrantType(AuthorizationGrantType.PASSWORD)
				.authorizationGrant(resourceOwnerPasswordCredentialsAuthentication);
		// @formatter:on

		OAuth2Authorization.Builder authorizationBuilder = OAuth2Authorization.withRegisteredClient(registeredClient)
				.principalName(principal.getName())
				.attribute(Principal.class.getName(), principal)
				.authorizationGrantType(AuthorizationGrantType.PASSWORD)
				.authorizedScopes(authorizedScopes);

		// ----- Access token -----
		OAuth2TokenContext tokenContext = tokenContextBuilder.tokenType(OAuth2TokenType.ACCESS_TOKEN).build();
		OAuth2Token generatedAccessToken = this.tokenGenerator.generate(tokenContext);
		if (generatedAccessToken == null) {
			OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,
					"The token generator failed to generate the access token.", ERROR_URI);
			throw new OAuth2AuthenticationException(error);
		}

		if (this.logger.isTraceEnabled()) {
			this.logger.trace("Generated access token");
		}

		OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
				generatedAccessToken.getTokenValue(), generatedAccessToken.getIssuedAt(),
				generatedAccessToken.getExpiresAt(), tokenContext.getAuthorizedScopes());
		if (generatedAccessToken instanceof ClaimAccessor) {
			authorizationBuilder.token(accessToken, (metadata) ->
					metadata.put(OAuth2Authorization.Token.CLAIMS_METADATA_NAME, ((ClaimAccessor) generatedAccessToken).getClaims()));
		} else {
			authorizationBuilder.accessToken(accessToken);
		}

		// ----- Refresh token -----
		OAuth2RefreshToken refreshToken = null;
		if (registeredClient.getAuthorizationGrantTypes().contains(AuthorizationGrantType.REFRESH_TOKEN) &&
				// Do not issue refresh token to public client
				!clientPrincipal.getClientAuthenticationMethod().equals(ClientAuthenticationMethod.NONE)) {

			tokenContext = tokenContextBuilder.tokenType(OAuth2TokenType.REFRESH_TOKEN).build();
			OAuth2Token generatedRefreshToken = this.tokenGenerator.generate(tokenContext);
			if (!(generatedRefreshToken instanceof OAuth2RefreshToken)) {
				OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,
						"The token generator failed to generate the refresh token.", ERROR_URI);
				throw new OAuth2AuthenticationException(error);
			}

			if (this.logger.isTraceEnabled()) {
				this.logger.trace("Generated refresh token");
			}

			refreshToken = (OAuth2RefreshToken) generatedRefreshToken;
			authorizationBuilder.refreshToken(refreshToken);
		}

		// ----- ID token -----
		OidcIdToken idToken;
		if (authorizedScopes.contains(OidcScopes.OPENID)) {
			// @formatter:off
			tokenContext = tokenContextBuilder
					.tokenType(ID_TOKEN_TOKEN_TYPE)
					.authorization(authorizationBuilder.build())	// ID token customizer may need access to the access token and/or refresh token
					.build();
			// @formatter:on
			OAuth2Token generatedIdToken = this.tokenGenerator.generate(tokenContext);
			if (!(generatedIdToken instanceof Jwt)) {
				OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,
						"The token generator failed to generate the ID token.", ERROR_URI);
				throw new OAuth2AuthenticationException(error);
			}

			if (this.logger.isTraceEnabled()) {
				this.logger.trace("Generated id token");
			}

			idToken = new OidcIdToken(generatedIdToken.getTokenValue(), generatedIdToken.getIssuedAt(),
					generatedIdToken.getExpiresAt(), ((Jwt) generatedIdToken).getClaims());
			authorizationBuilder.token(idToken, (metadata) ->
					metadata.put(OAuth2Authorization.Token.CLAIMS_METADATA_NAME, idToken.getClaims()));
		} else {
			idToken = null;
		}

		OAuth2Authorization authorization = authorizationBuilder.build();

		this.authorizationService.save(authorization);

		if (this.logger.isTraceEnabled()) {
			this.logger.trace("Saved authorization");
		}

		Map<String, Object> additionalParameters = Collections.emptyMap();
		if (idToken != null) {
			additionalParameters = new HashMap<>();
			additionalParameters.put(OidcParameterNames.ID_TOKEN, idToken.getTokenValue());
		}

		if (this.logger.isTraceEnabled()) {
			this.logger.trace("Authenticated token request");
		}

		return new OAuth2AccessTokenAuthenticationToken(
				registeredClient, clientPrincipal, accessToken, refreshToken, additionalParameters);
	}

	@Override
	public boolean supports(Class<?> authentication) {
		return OAuth2ResourceOwnerPasswordCredentialsAuthenticationToken.class.isAssignableFrom(authentication);
	}

}

4. 自定义AuthenticationProviderBuilder

AuthenticationProviderBuilder 仅仅是小编为了方便构建出 AuthenticationProvider 所编写的工具类，并非 Spring Authorization Server 所要求。所以不强制要求实现，观众老爷们可自行决定是否使用该类。

OAuth2ResourceOwnerPasswordCredentialsAuthenticationProviderBuilder

package org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.core.OAuth2Token;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider;
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenGenerator;

/**
 * An Builder for {@link OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider}.
 *
 * @author Moluo
 * @see OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider
 * @see OAuth2AuthorizationService
 * @see OAuth2TokenGenerator
 * @since 0.0.1
 */
public final class OAuth2ResourceOwnerPasswordCredentialsAuthenticationProviderBuilder {

    private HttpSecurity httpSecurity;
    private UserDetailsService userDetailsService;
    private PasswordEncoder passwordEncoder;

    public OAuth2ResourceOwnerPasswordCredentialsAuthenticationProviderBuilder(
            HttpSecurity httpSecurity, UserDetailsService userDetailsService, PasswordEncoder passwordEncoder) {
        this.httpSecurity = httpSecurity;
        this.userDetailsService = userDetailsService;
        this.passwordEncoder = passwordEncoder;
    }


    public OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider build() {
        OAuth2AuthorizationService authorizationService = OAuth2ConfigurerUtils.getAuthorizationService(httpSecurity);
        OAuth2TokenGenerator<? extends OAuth2Token> tokenGenerator = OAuth2ConfigurerUtils.getTokenGenerator(httpSecurity);

        OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider resourceOwnerPasswordCredentialsAuthenticationProvider =
                new OAuth2ResourceOwnerPasswordCredentialsAuthenticationProvider(authorizationService, tokenGenerator,
                        userDetailsService, passwordEncoder);
        return resourceOwnerPasswordCredentialsAuthenticationProvider;
    }
}

5. 添加密码模式（password）配置

配置tokenEndpoint，添加我们自定义的 AuthenticationProvider 和 AuthenticationConverter

@Configuration
public class SecurityConfig {
    ...

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Bean
    @Order(1)
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
            throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
                .tokenEndpoint(oAuth2TokenEndpointConfigurer -> oAuth2TokenEndpointConfigurer
                         // 配置 Provider和 RequestConverter
                        .authenticationProvider(new OAuth2ResourceOwnerPasswordCredentialsAuthenticationProviderBuilder(
                                http, userDetailsService, passwordEncoder).build())
                        .accessTokenRequestConverter(new OAuth2ResourceOwnerPasswordCredentialsAuthenticationConverter())
                )

        return http.build();
    }
    
    ...
}

测试

  1. 添加client信息
    请添加图片描述
  2. 添加用户信息
    在这里插入图片描述
  3. 发送请求，正常返回token信息
    在这里插入图片描述
  4. 依次测试：使用token访问资源、使用refresh_token刷新token等均正常

小结

到此，授权模式自定义已完成。说句实话，为了自定义授权模式 - 密码模式（password），小编头都秃了，反复分析 Spring Authorization Server 中的其他2种授权模式：

  • 授权码模式（authorization-code）
  • 客户端模式（client credentials）

有兴趣的小伙伴也可以尝试分析试试，关键类如下：

TokenEndpoint的入口类：OAuth2TokenEndpointFilter

授权码模式相关类：OAuth2AuthorizationCodeAuthenticationToken、OAuth2AuthorizationCodeRequestAuthenticationProvider、OAuth2AuthorizationCodeAuthenticationProvider、OAuth2AuthorizationCodeAuthenticationConverter、OAuth2AuthorizationCodeRequestAuthenticationConverter

客户端模式相关类：OAuth2ClientCredentialsAuthenticationToken、OAuth2ClientCredentialsAuthenticationProvider、OAuth2ClientCredentialsAuthenticationConverter

Mo思
关注
专栏目录
spring-security-oauth2-authorization-server.zip
08-25
在IT领域，安全是至关重要的，特别是在Web应用中。Spring Security是Java开发人员广泛使用的安全框架，它提供了全面的身份...同时，它也为你提供了扩展和自定义OAuth2行为的基础，如添加自定义授权逻辑、令牌增强等。
spring-authorization-server系列--Oauth2.1自定义模式
qq_16033193的博客
06-19 943
前面几篇文章分析，找到Oauth2.1支持的自定义入口OAuth2AuthorizationServerConfigurer中的tokenEndpoint方法，通过这个入口我们可以将自定义的模式注入到Oauth2.1框架中。/***/
Spring Authorization Server入门 (一) 初识SpringAuthorizationServer和OAuth2.1协议
云逸的博客
06-01 1万+
Spring authorization server是由社区推动的一个项目，在Spring security团队的领导下基于Nimbus库重头编写，其目的主要是为 Spring 社区提供 OAuth 2.0 授权服务器支持，替代已被废弃的Spring Security OAuth框架。Spring authorization server提供了OAuth 2.1和OpenID Connect 1.0规范以及其他相关规范的实现。
Spring Authorization Server授权框架
最新发布
aRtHuR1207的博客
09-25 761
英文官网假设想要以 Google 帐号来登录 echatsoft客服系统，需要怎么做呢？最简单的方式是把用户名密码交给 echatsoft，这样 echatsoft 就能以 Google 的身份登录。但是这样存在很大的安全隐患，如果echatsoft不小心泄漏了用户名密码，或者想要撤销授权的时候，基本就没有很好的办法。因此我们需要一种授权协议，并不直接给第三方应用用户名密码，而是引入一个中间层，access_token。
Spring Authorization Server入门 (二) Spring Boot整合Spring Authorization Server
云逸的博客
06-02 1万+
本篇文章从0到1搭建了一个简单认证服务，解释了认证服务的各项配置用意，如何设置自己的登录页和授权确认页，如何让认证服务解析请求时携带的token，文章过长难免有遗漏的地方，如果文章中有遗漏或错误的地方请各位读者在评论区指出。
【spring authorization server系列教程】(一)入门系列，spring authorization server简介。快速构建一个授权服务器（基于最新版本0.3.0）
热门推荐
爱音乐的程序猿的博客
06-07 1万+
【spring authorization server系列教程】(一)入门系列，快速构建一个授权服务器spring authorization server是spring团队最新的认证授权服务器，之前的oauth2后面会逐步弃用。不过到现在发文的时候，我看到官网已经把之前oauth2仓库废弃了。 现在spring authorization server已经到生产就绪阶段了，不过目前项目还没有完全到生产可用阶段。...
【Spring Authorization Server 系列】（一）入门篇，快速搭建一个授权服务器
Markix的博客
08-01 1万+
Spring Authorization Server是一个框架，提供了OAuth2.1和OpenIDConnect1.0规范以及其他相关规范的实现。它建立在SpringSecurity之上，为构建OpenIDConnect1.0IdentityProviders和OAuth2AuthorizationServer产品提供安全、轻量级和可定制的基础。旧版的框架是，该框架已停止维护。SpringSecurityOAuth2认证/授权服务器的前世今生。...............
Spring Authorization Server 授权服务器
xxxzzzqqq_的博客
03-07 2719
​ Spring Authorization Server 遵循Oauth2.1和OpenID Connect 1.0，它建立在Spring Security之上。 ​
Spring cloud Oauth2的密码模式数据库方式实现登录授权验证
12-09
综上所述，实现“Spring Cloud Oauth2的密码模式数据库方式实现登录授权验证”涉及多个步骤，包括设置Authorization Server和Resource Server，配置数据库，实现用户认证逻辑，以及处理令牌的生成与管理。...
Java_Spring授权服务器.zip
05-22
在“Java_Spring授权服务器.zip”这个压缩包中，我们关注的是Spring Security的一个特定组件——Spring Authorization Server，它主要用于处理身份验证和授权。 Spring Authorization Server是Spring Security框架...
dropwizard-authorization:Dropwizard框架的授权扩展
05-13
此扩展使用自定义@Auth批注进行主体身份验证和授权。 @Principal批注可用于主体注入。 验证由dropwizard-auth模块执行。 有几种方法可以定义授权规则： 通过定义角色。 主体需要具有@Auth批注元素指定的角色，...
Spring cloud Oauth2的密码模式内存方式实现登录授权验证
12-09
综上所述，Spring Cloud Oauth2的密码模式内存方式实现登录授权验证涉及了多个步骤，包括配置、用户管理、登录处理和安全控制。理解并熟练掌握这些步骤，将有助于构建安全、可扩展的微服务架构。
资料-Spring Security Oauth2.0认证授权专题.rar
05-03
2. **Authorization Server（授权服务器）**：授权服务器负责处理用户的登录、授权请求，并生成访问令牌。它验证用户凭证，决定是否授权，然后颁发令牌给客户端。 3. **Client（客户端）**：客户端是需要访问资源...
Spring Security+OAuth2 精讲，打造企业级认证与授权
10-12
OAuth2的角色包括资源所有者（Resource Owner）、客户端（Client）、授权服务器（Authorization Server）和资源服务器（Resource Server）。通过授权码流程、密码模式、客户端凭据模式等多种授权类型，OAuth2提供了...
springcloud-oauth2-security.rar
04-25
1. AuthorizationServer：负责处理用户的登录请求，验证用户身份并发放授权码或访问令牌。在Spring Cloud Security中，可以通过`@EnableAuthorizationServer`注解开启授权服务器功能。 2. ResourceServer：保护资源...
spring security oauth2.0 （讲义+代码）
03-10
首先，OAuth2.0 有四个核心角色：资源所有者（Resource Owner）、客户端（Client）、资源服务器（Resource Server）和授权服务器（Authorization Server）。资源所有者是拥有受保护资源的用户，客户端是请求访问资源...
Spring Authorization Server1.0 介绍与使用
言午玉口才
12-24 7674
authorizationConsentService：关于OAuth2AuthorizationConsent信息的处理（入库）jwkSource()、generateRsaKey()、jwtDecoder：关于token生成规则的处理authorizationServerSettings：关于AuthorizationServerSettings【授权服务器】的配置，含路径及接口。此处需要注意编码器的注入，配置不当会影响授权码的账号密码输入，获取不到code值。需要拓展的根据自己的需求拓展。
Spring Authorization Server简介
HaSaKing的博客
03-05 1717
Spring Authorization Server是一个基于Spring Security开发的库，它允许开发者在自己的Spring应用中快速实现OAuth 2.0和OpenID Connect协议。这意味着你可以构建一个作为OAuth 2.0提供者的授权服务器，它可以发放令牌给客户端应用，以便它们可以安全地访问你的资源服务器上的受保护资源。Spring Authorization Server是Spring生态系统中的一个项目，提供了一个符合OAuth 2.1规范的授权服务器。
Spring Authorization Server 1.1 扩展实现 OAuth2 密码模式与 Spring Cloud 的整合实战
有来技术
10-24 1万+
本文基于开源微服务商城项目 youlai-mall、Spring Boot 3 和 Spring Authorization Server 1.1 版本，演示了如何扩展密码模式，以及如何将其应用于 Spring Cloud 微服务实战。
Spring Authorization Server 自定义登录
01-17
Spring Authorization Server允许我们自定义登录方式。下面是一个示例： 首先，我们需要创建一个自定义的认证提供者（AuthenticationProvider），用于处理自定义登录方式。在这个认证提供者中，我们可以实现自己的...
评论 11
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值