简述
在开发过程中权限控制必不可少,如何选择一款优秀的权限架构是一份很头疼的事,而shiro和spring-security则是市面上比较优秀的两款权限开源框架,通过改造对应的定制化源码扩展出自己业务所需的架构。下面主要来运行一下官方spring-security-oauth2权限框架的测试demo,通过运行的效果来初步认识这款权限架构。
1、下面是从官方下载[源码地址:https://github.com/spring-projects/spring-security-oauth]的源码导入到Idea中的工程目录:
![aa23731e88a35c2dd1d5c745a2373bd2.png](https://i-blog.csdnimg.cn/blog_migrate/5a9f99d3cdfa38504b923029f66d7186.jpeg)
![68a799de7e4fc0912052c70e0c3fd650.png](https://i-blog.csdnimg.cn/blog_migrate/944a47c5246a908e915600864d0b200e.jpeg)
2、本实例运行的demo为上图只向的jwt[spring-oauth2-jwt],打开demo工程可以看到是个简单的springboot工程:
@SpringBootApplication@EnableResourceServer@RestControllerpublic class Application {public static void main(String[] args) {SpringApplication.run(Application.class, args);}@RequestMapping("/")public String home() {return "Hello World";}@Configuration@EnableAuthorizationServerprotected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {@Autowiredprivate AuthenticationManager authenticationManager;@Beanpublic JwtAccessTokenConverter accessTokenConverter() {// 返回jwt模式return new JwtAccessTokenConverter();}@Overridepublic void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {// 开启token和token_key授权oauthServer.tokenKeyAccess("isAnonymous() || hasAuthority('ROLE_TRUSTED_CLIENT')").checkTokenAccess("hasAuthority('ROLE_TRUSTED_CLIENT')");}@Overridepublic void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {endpoints.authenticationManager(authenticationManager).accessTokenConverter(accessTokenConverter());}@Overridepublic void configure(ClientDetailsServiceConfigurer clients) throws Exception {// @formatter:offclients.inMemory()// 客户端名称.withClient("my-trusted-client")// 授权客户端 拥有密码模式授权、客户端模式、刷新token、隐式模式.authorizedGrantTypes("password