Spring Boot 2.0 整合 Spring Security Oauth2

時間 2019-11-25

標籤 spring boot 2.0 整合 security oauth2 oauth 欄目 Spring 简体版

原文原文鏈接

是金子在哪都會發光的——每一個說這句話的人都誤覺得本身是金子。html

https://raw.githubusercontent.com/longfeizheng/longfeizheng.github.io/master/images/spring-security-OAuth205.png — https://user-gold-cdn.xitu.io/2018/4/29/16311778866b1c3b?w=2199&h=1500&f=jpeg&s=385604

前言

在Spring Security源碼分析十一：Spring Security OAuth2整合JWT中，咱們使用Spring Boot 1.5.6.RELEASE版本整合Spring Security Oauth2實現了受權碼模式、密碼模式以及用戶自定義登陸返回token。但更新至Spring Boot 2.0.1.RELEASE版本時會出現一些小問題。在此，幫你們踩一下坑。關於OAuth2請參考理解OAuth 2.0java

修改pom.xml

更新Spring Boot版本爲Spring Boot 2.0.1.RELEASEgit

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.1.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
複製代碼

新增SecurityConfig配置

新增SecurityConfig用於暴露AuthenticationManagergithub

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        AuthenticationManager manager = super.authenticationManagerBean();
        return manager;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
// .formLogin().and()
                .httpBasic().and()
                .csrf().disable();
    }
}
複製代碼

修改MerryyouAuthorizationServerConfig

修改MerryyouAuthorizationServerConfig用於加密clientsecret和設置重定向地址redis

......
 @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        InMemoryClientDetailsServiceBuilder build = clients.inMemory();
        if (ArrayUtils.isNotEmpty(oAuth2Properties.getClients())) {
            for (OAuth2ClientProperties config : oAuth2Properties.getClients()) {
                build.withClient(config.getClientId())
                        .secret(passwordEncoder.encode(config.getClientSecret()))
                        .accessTokenValiditySeconds(config.getAccessTokenValiditySeconds())
                        .refreshTokenValiditySeconds(60 * 60 * 24 * 15)
                        .authorizedGrantTypes("refresh_token", "password", "authorization_code")//OAuth2支持的驗證模式
                        .redirectUris("http://www.merryyou.cn")
                        .scopes("all");
            }
        }
......
複製代碼

修改application.yml

因爲在2.x版本中因爲引入了不一樣的客戶端，須要指定配置哪一種鏈接池。spring

server:
 port: 8888
 redis:
 host: localhost
 port: 6379
 jedis:
 pool:
 max-active: 8
 max-wait: -1
 min-idle: 0
 max-idle: 8
logging:
 level:
    org.springframework: info
merryyou:
 security:
 oauth2:
 storeType: redis #或者jwt
 jwtSigningKey: merryyou
      clients[0]:
 clientId: merryyou
 clientSecret: merryyou
      clients[1]:
 clientId: merryyou1
 clientSecret: merryyou1

複製代碼