Spring Security OAuth2 使用Redis存储token键值详解

最新推荐文章于 2024-07-04 23:31:57 发布

立小言先森

最新推荐文章于 2024-07-04 23:31:57 发布

阅读量2.2w

点赞数

分类专栏：【spring系列】文章标签： Security OAuth2 Redis 键值对

本文链接：https://blog.csdn.net/yaomingyang/article/details/97481282

版权

【spring系列】专栏收录该内容

194 篇文章 58 订阅

订阅专栏

1.Spring Security OAuth2存储token值的方式由多种，所有的实现方式都是实现了TokenStore接口

InMemoryTokenStore:token存储在本机的内存之中
JdbcTokenStore:token存储在数据库之中
JwtTokenStore:token不会存储到任何介质中
RedisTokenStore:token存储在Redis数据库之中

2.看下RedisTokenStore实现类在redis中存储了那些key,贴上源码如下：

    private static final String ACCESS = "access:";
    private static final String AUTH_TO_ACCESS = "auth_to_access:";
    private static final String AUTH = "auth:";
    private static final String REFRESH_AUTH = "refresh_auth:";
    private static final String ACCESS_TO_REFRESH = "access_to_refresh:";
    private static final String REFRESH = "refresh:";
    private static final String REFRESH_TO_ACCESS = "refresh_to_access:";
    private static final String CLIENT_ID_TO_ACCESS = "client_id_to_access:";
    private static final String UNAME_TO_ACCESS = "uname_to_access:";

本案例是使用password、refresh_token模式，在Redis缓存中共存储了9个键值对，其中有5个跟access_token相关，4个和refresh_token相关；

access_token相关access:(OAuth2AccessToken)、auth:(OAuth2Authentication)、auth_to_access:(OAuth2AccessToken)、client_id_to_access:(OAuth2AccessToken)、uname_to_access:(OAuth2AccessToken)
refresh_token相关refresh:(OAuth2RefreshToken)、refresh_auth:(OAuth2Authentication)、access_to_refresh(refresh_token):、refresh_to_access:(refresh_token)

3.通过查看RedisTokenStore源码（源码我就不贴出来了）的方式理解每个key所存储的数据

access:中存储的键是access:be171b573f5a496ca601b32b1360fe84，值是OAuth2AccessToken对象序列化后的值

键是access:+access_token

值示例如下：

{
        "access_token": "12833d6c89fb4ea58cbe7b6ada5de7b5",
        "token_type": "bearer",
        "refresh_token": "357304ee0a404700b3e65d547713011b",
        "expires_in": 898,
        "scope": "test"
    }

auth_to_access:中存储的键是auth_to_access:a994f2a9a61186f32870e32d72a38d21，值是OAuth2AccessToken序列化后的值

键是auth_to_access:+ username、client_id、scope三个MD5加密后的值

值示例如下：

{
        "access_token": "12833d6c89fb4ea58cbe7b6ada5de7b5",
        "token_type": "bearer",
        "refresh_token": "357304ee0a404700b3e65d547713011b",
        "expires_in": 898,
        "scope": "test"
    }

auth:中存储的键是auth:be171b573f5a496ca601b32b1360fe84，值是OAuth2Authentication对象序列化后的值

键是auth:+access_token值
值示例如下：

{
    "authorities": [
        {
            "authority": "ROLE"
        }
    ],
    "details": {
        "remoteAddress": "0:0:0:0:0:0:0:1",
        "sessionId": null,
        "tokenValue": "dfec9f18e161408dbf66b85b94401d7f",
        "tokenType": "Bearer",
        "decodedDetails": null
    },
    "authenticated": true,
    "userAuthentication": {
        "authorities": [
            {
                "authority": "ROLE"
            }
        ],
        "details": {
            "grant_type": "password",
            "username": "user",
            "scope": "test"
        },
        "authenticated": true,
        "principal": {
            "password": null,
            "username": "user",
            "authorities": [
                {
                    "authority": "ROLE"
                }
            ],
            "accountNonExpired": true,
            "accountNonLocked": true,
            "credentialsNonExpired": true,
            "enabled": true
        },
        "credentials": null,
        "name": "user"
    },
    "credentials": "",
    "principal": {
        "password": null,
        "username": "user",
        "authorities": [
            {
                "authority": "ROLE"
            }
        ],
        "accountNonExpired": true,
        "accountNonLocked": true,
        "credentialsNonExpired": true,
        "enabled": true
    },
    "oauth2Request": {
        "clientId": "client_password",
        "scope": [
            "test"
        ],
        "requestParameters": {
            "grant_type": "password",
            "scope": "test",
            "username": "user"
        },
        "resourceIds": [
            "resource_password_id"
        ],
        "authorities": [],
        "approved": true,
        "refresh": false,
        "redirectUri": null,
        "responseTypes": [],
        "extensions": {},
        "grantType": "password",
        "refreshTokenRequest": null
    },
    "clientOnly": false,
    "name": "user"
}

refresh_auth:中存储的是refresh_auth:d0017ce6db6441d1b87a0a2804d1434b,值是OAuth2Authentication序列化后的值

键是：refresh_auth:+refresh_token值
值示例如下：

{
    "authorities": [
        {
            "authority": "ROLE"
        }
    ],
    "details": {
        "remoteAddress": "0:0:0:0:0:0:0:1",
        "sessionId": null,
        "tokenValue": "dfec9f18e161408dbf66b85b94401d7f",
        "tokenType": "Bearer",
        "decodedDetails": null
    },
    "authenticated": true,
    "userAuthentication": {
        "authorities": [
            {
                "authority": "ROLE"
            }
        ],
        "details": {
            "grant_type": "password",
            "username": "user",
            "scope": "test"
        },
        "authenticated": true,
        "principal": {
            "password": null,
            "username": "user",
            "authorities": [
                {
                    "authority": "ROLE"
                }
            ],
            "accountNonExpired": true,
            "accountNonLocked": true,
            "credentialsNonExpired": true,
            "enabled": true
        },
        "credentials": null,
        "name": "user"
    },
    "credentials": "",
    "principal": {
        "password": null,
        "username": "user",
        "authorities": [
            {
                "authority": "ROLE"
            }
        ],
        "accountNonExpired": true,
        "accountNonLocked": true,
        "credentialsNonExpired": true,
        "enabled": true
    },
    "oauth2Request": {
        "clientId": "client_password",
        "scope": [
            "test"
        ],
        "requestParameters": {
            "grant_type": "password",
            "scope": "test",
            "username": "user"
        },
        "resourceIds": [
            "resource_password_id"
        ],
        "authorities": [],
        "approved": true,
        "refresh": false,
        "redirectUri": null,
        "responseTypes": [],
        "extensions": {},
        "grantType": "password",
        "refreshTokenRequest": null
    },
    "clientOnly": false,
    "name": "user"
}

access_to_refresh:中存储的是access_to_refresh:c90cab28971948d2a85ca2ae814641ed，值是refresh_token值

键是access_to_refresh:+refresh_token值
值是refresh_token值

refresh:中存储的是refresh:d0017ce6db6441d1b87a0a2804d1434b，值是OAuth2RefreshToken对象序列化后的值

键是refresh:+refresh_token值
值示例如下：

 {
        "access_token": "dfec9f18e161408dbf66b85b94401d7f",
        "token_type": "bearer",
        "refresh_token": "8bcd9cfb04a3445e8933c788b2673a89",
        "expires_in": 898,
        "scope": "test"
    }

refresh_to_access:中存储的值是refresh_to_access:d0017ce6db6441d1b87a0a2804d1434b，值是refresh_token值

键是refresh_to_access:+refresh_token值
值示例如下：

be171b573f5a496ca601b32b1360fe84

client_id_to_access:中存储的值是client_id_to_access:client_password，值是OAuth2AccessToken序列化后的值

键是client_id_to_access:+clientId
值示例如下：

{
        "access_token": "dfec9f18e161408dbf66b85b94401d7f",
        "token_type": "bearer",
        "refresh_token": "8bcd9cfb04a3445e8933c788b2673a89",
        "expires_in": 898,
        "scope": "test"
    }

uname_to_access:中存储的键是uname_to_access:client_password:user，值是OAuth2AccessToken对象序列化后的值

键是：uname_to_access:+clientid+用户名
值示例如下：

{
        "access_token": "dfec9f18e161408dbf66b85b94401d7f",
        "token_type": "bearer",
        "refresh_token": "8bcd9cfb04a3445e8933c788b2673a89",
        "expires_in": 898,
        "scope": "test"
    }

GitHub源码：https://github.com/mingyang66/spring-parent/edit/master/spring-security-oauth2-server-redis-service/README.md