The @EnableAuthorizationServer statement is as follows:java
/**
* Convenience annotation for enabling an Authorization Server (i.e. an {@link AuthorizationEndpoint} and a
* {@link TokenEndpoint}) in the current application context, which must be a {@link DispatcherServlet} context. Many
* features of the server can be customized using <code>@Beans</code> of type {@link AuthorizationServerConfigurer}
* (e.g. by extending {@link AuthorizationServerConfigurerAdapter}). The user is responsible for securing the
* Authorization Endpoint (/oauth/authorize) using normal Spring Security features ({@link EnableWebSecurity
* @EnableWebSecurity} etc.), but the Token Endpoint (/oauth/token) will be automatically secured using HTTP Basic
* authentication on the client's credentials. Clients <em>must</em> be registered by providing a
* {@link ClientDetailsService} through one or more AuthorizationServerConfigurers.
*
* @author Dave Syer
*
*/
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Documented
@Import({AuthorizationServerEndpointsConfiguration.class, AuthorizationServerSecurityConfiguration.class})
public @interface EnableAuthorizationServer {
}
The @AuthorizationServerConfigurer statement is as follows:less
/**
* Convenient strategy for configuring an OAUth2 Authorization Server. Beans of this type are applied to the Spring
* context automatically if you {@link EnableAuthorizationServer @EnableAuthorizationServer}.
*
* @author Dave Syer
*
*/
public interface AuthorizationServerConfigurer {
/**
* Configure the security of the Authorization Server, which means in practical terms the /oauth/token endpoint. The
* /oauth/authorize endpoint also needs to be secure, but that is a normal user-facing endpoint and should be
* secured the same way as the rest of your UI, so is not covered here. The default settings cover the most common
* requirements, following recommendations from the OAuth2 spec, so you don't need to do anything here to get a
* basic server up and running.
*
* @param security a fluent configurer for security features
*/
void configure(AuthorizationServerSecurityConfigurer security) throws Exception;
/**
* Configure the {@link ClientDetailsService}, e.g. declaring individual clients and their properties. Note that
* password grant is not enabled (even if some clients are allowed it) unless an {@link AuthenticationManager} is
* supplied to the {@link #configure(AuthorizationServerEndpointsConfigurer)}. At least one client, or a fully
* formed custom {@link ClientDetailsService} must be declared or the server will not start.
*
* @param clients the client details configurer
*/
void configure(ClientDetailsServiceConfigurer clients) throws Exception;
/**
* Configure the non-security features of the Authorization Server endpoints, like token store, token
* customizations, user approvals and grant types. You shouldn't need to do anything by default, unless you need
* password grants, in which case you need to provide an {@link AuthenticationManager}.
*
* @param endpoints the endpoints configurer
*/
void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception;
}
傳遞的對象爲private AuthorizationServerEndpointsConfigurer endpoints = new AuthorizationServerEndpointsConfigurer();
AuthorizationServerEndpointsConfigurer statement is as follows:
/**
* Configure the properties and enhanced functionality of the Authorization Server endpoints.
*/
public final class AuthorizationServerEndpointsConfigurer {
...
}
也就是調用如下方法。
/**
* Configure the non-security features of the Authorization Server endpoints, like token store, token
* customizations, user approvals and grant types. You shouldn't need to do anything by default, unless you need
* password grants, in which case you need to provide an {@link AuthenticationManager}.
*
* @param endpoints the endpoints configurer
*/
void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception;
/**
* This needs to be a <code>@Bean</code> so that it can be
* <code>@Transactional</code> (in case the token store supports them). If
* you are overriding the token services in an
* {@link AuthorizationServerConfigurer} consider making it a
* <code>@Bean</code> for the same reason (assuming you need transactions,
* e.g. for a JDBC token store).
*
* @return an AuthorizationServerTokenServices
*/
@Bean
public AuthorizationServerTokenServices defaultAuthorizationServerTokenServices() {
return endpoints.getDefaultAuthorizationServerTokenServices();
}
AuthorizationServerEndpointsConfiguration The core initialization
Initialize authorizationEndpoint and TokenEndpint.
@Bean
public AuthorizationEndpoint authorizationEndpoint() throws Exception {
AuthorizationEndpoint authorizationEndpoint = new AuthorizationEndpoint();
FrameworkEndpointHandlerMapping mapping = getEndpointsConfigurer().getFrameworkEndpointHandlerMapping();
authorizationEndpoint.setUserApprovalPage(extractPath(mapping, "/oauth/confirm_access"));
authorizationEndpoint.setProviderExceptionHandler(exceptionTranslator());
authorizationEndpoint.setErrorPage(extractPath(mapping, "/oauth/error"));
authorizationEndpoint.setTokenGranter(tokenGranter());
authorizationEndpoint.setClientDetailsService(clientDetailsService);
authorizationEndpoint.setAuthorizationCodeServices(authorizationCodeServices());
authorizationEndpoint.setOAuth2RequestFactory(oauth2RequestFactory());
authorizationEndpoint.setOAuth2RequestValidator(oauth2RequestValidator());
authorizationEndpoint.setUserApprovalHandler(userApprovalHandler());
return authorizationEndpoint;
}
@Bean
public TokenEndpoint tokenEndpoint() throws Exception {
TokenEndpoint tokenEndpoint = new TokenEndpoint();
tokenEndpoint.setClientDetailsService(clientDetailsService);
tokenEndpoint.setProviderExceptionHandler(exceptionTranslator());
tokenEndpoint.setTokenGranter(tokenGranter());
tokenEndpoint.setOAuth2RequestFactory(oauth2RequestFactory());
tokenEndpoint.setOAuth2RequestValidator(oauth2RequestValidator());
tokenEndpoint.setAllowedRequestMethods(allowedTokenEndpointRequestMethods());
return tokenEndpoint;
}
@Bean
public CheckTokenEndpoint checkTokenEndpoint() {
CheckTokenEndpoint endpoint = new CheckTokenEndpoint(getEndpointsConfigurer().getResourceServerTokenServices());
endpoint.setAccessTokenConverter(getEndpointsConfigurer().getAccessTokenConverter());
endpoint.setExceptionTranslator(exceptionTranslator());
return endpoint;
}
@Bean
public WhitelabelApprovalEndpoint whitelabelApprovalEndpoint() {
return new WhitelabelApprovalEndpoint();
}
@Bean
public WhitelabelErrorEndpoint whitelabelErrorEndpoint() {
return new WhitelabelErrorEndpoint();
}
@Bean
public FrameworkEndpointHandlerMapping oauth2EndpointHandlerMapping() throws Exception {
return getEndpointsConfigurer().getFrameworkEndpointHandlerMapping();
}
@Bean
public ConsumerTokenServices consumerTokenServices() throws Exception {
return getEndpointsConfigurer().getConsumerTokenServices();
}
/**
* This needs to be a <code>@Bean</code> so that it can be
* <code>@Transactional</code> (in case the token store supports them). If
* you are overriding the token services in an
* {@link AuthorizationServerConfigurer} consider making it a
* <code>@Bean</code> for the same reason (assuming you need transactions,
* e.g. for a JDBC token store).
*
* @return an AuthorizationServerTokenServices
*/
@Bean
public AuthorizationServerTokenServices defaultAuthorizationServerTokenServices() {
return endpoints.getDefaultAuthorizationServerTokenServices();
}
public AuthorizationServerEndpointsConfigurer getEndpointsConfigurer() {
if (!endpoints.isTokenServicesOverride()) {
endpoints.tokenServices(defaultAuthorizationServerTokenServices());
}
return endpoints;
}
其中comsumerTokenService() and defaultAuthorizationServerTokenServices()都將調用AuthorizationServerEndpointsConfigurer的createDefaultTokenServices方法兩次，前一個方法初始化consumerTokenServices，後一個方法初始化defaultTokenServices。
ConsumerTokenServices and AuthorizationServerTokenServices are interfaces。DefaultTokenServices類同時實現ConsumerTokenServices和AuthorizationServerTokenServices。
AuthorizationServerSecurityConfiguration
AuthorizationServerSecurityConfiguration statement is as follows：
@Configuration
@Order(0)
@Import({ ClientDetailsServiceConfiguration.class, AuthorizationServerEndpointsConfiguration.class })
public class AuthorizationServerSecurityConfiguration extends WebSecurityConfigurerAdapter {
...
}
Import ClientDetailsServiceConfiguration
客戶端憑證配置類。初始化客戶端憑證數據，由內存初始化，或者來自jdbc。
@Configuration
public class ClientDetailsServiceConfiguration {
@SuppressWarnings("rawtypes")
private ClientDetailsServiceConfigurer configurer = new ClientDetailsServiceConfigurer(new ClientDetailsServiceBuilder());
@Bean
public ClientDetailsServiceConfigurer clientDetailsServiceConfigurer() {
return configurer;
}
@Bean
@Lazy
@Scope(proxyMode=ScopedProxyMode.INTERFACES)
public ClientDetailsService clientDetailsService() throws Exception {
return configurer.and().build();
}
}
