Spring Security 在 Spring Boot 中使用 OAuth2【分布式】

/*
SQLyog Ultimate v12.08 (64 bit)
MySQL - 8.0.16 : Database - security_authority
*********************************************************************
*/


/*!40101 SET NAMES utf8 */;

/*!40101 SET SQL_MODE=''*/;

/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
/*Table structure for table `oauth_access_token` */

DROP TABLE IF EXISTS `oauth_access_token`;

CREATE TABLE `oauth_access_token` (
  `token_id` varchar(255) DEFAULT NULL,
  `token` longblob,
  `authentication_id` varchar(255) DEFAULT NULL,
  `user_name` varchar(255) DEFAULT NULL,
  `client_id` varchar(255) DEFAULT NULL,
  `authentication` longblob,
  `refresh_token` varchar(255) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*Data for the table `oauth_access_token` */

/*Table structure for table `oauth_approvals` */

DROP TABLE IF EXISTS `oauth_approvals`;

CREATE TABLE `oauth_approvals` (
  `userId` varchar(255) DEFAULT NULL,
  `clientId` varchar(255) DEFAULT NULL,
  `scope` varchar(255) DEFAULT NULL,
  `status` varchar(10) DEFAULT NULL,
  `expiresAt` datetime DEFAULT NULL,
  `lastModifiedAt` datetime DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*Data for the table `oauth_approvals` */

/*Table structure for table `oauth_client_details` */

DROP TABLE IF EXISTS `oauth_client_details`;

CREATE TABLE `oauth_client_details` (
  `client_id` varchar(255) NOT NULL,
  `resource_ids` varchar(255) DEFAULT NULL,
  `client_secret` varchar(255) DEFAULT NULL,
  `scope` varchar(255) DEFAULT NULL,
  `authorized_grant_types` varchar(255) DEFAULT NULL,
  `web_server_redirect_uri` varchar(255) DEFAULT NULL,
  `authorities` varchar(255) DEFAULT NULL,
  `access_token_validity` int(11) DEFAULT NULL,
  `refresh_token_validity` int(11) DEFAULT NULL,
  `additional_information` varchar(255) DEFAULT NULL,
  `autoapprove` varchar(255) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*Data for the table `oauth_client_details` */

/*Table structure for table `oauth_client_token` */

DROP TABLE IF EXISTS `oauth_client_token`;

CREATE TABLE `oauth_client_token` (
  `token_id` varchar(255) DEFAULT NULL,
  `token` longblob,
  `authentication_id` varchar(255) DEFAULT NULL,
  `user_name` varchar(255) DEFAULT NULL,
  `client_id` varchar(255) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*Data for the table `oauth_client_token` */

/*Table structure for table `oauth_code` */

DROP TABLE IF EXISTS `oauth_code`;

CREATE TABLE `oauth_code` (
  `code` varchar(255) DEFAULT NULL,
  `authentication` varbinary(2550) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*Data for the table `oauth_code` */

/*Table structure for table `oauth_refresh_token` */

DROP TABLE IF EXISTS `oauth_refresh_token`;

CREATE TABLE `oauth_refresh_token` (
  `token_id` varchar(255) DEFAULT NULL,
  `token` longblob,
  `authentication` longblob
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*Data for the table `oauth_refresh_token` */

/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;

<!-- 其实这里这里创建的是 SpringCloud 项目，省略注册中心等 -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-oauth2</artifactId>
</dependency>
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>

server:
  port: 8081

spring:
  datasource:
    # mysql 驱动 6.0 以上使用如下配置
    driverClassName: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://127.0.0.1:3306/db?serverTimezone=UTC
    username: root
    password: root
  jpa:
    database: MySQL
    show-sql: true
    generate-ddl: true
    hibernate:
      ddl-auto: update # 没有表创建表，有表更新表
      naming:
        implicit-strategy: org.hibernate.boot.model.naming.ImplicitNamingStrategyJpaCompliantImpl  # 命名策略
  main:
    # 允许覆盖 OAuth2 放在容器中的 Bean 对象
    allow-bean-definition-overriding: true

/**
 * Created with IntelliJ IDEA.
 *
 * @author Demo_Null
 * @date 2020/10/26
 * @description Security 配置文件
 */
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	@Autowired
    private UserServiceImpl UserServiceImpl;

    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth.userDetailsService(UserServiceImpl).passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()
            .disable()
            .authorizeRequests()	
            .anyRequest().authenticated();
    }

    // AuthenticationManager 对象在 OAuth2 认证服务中要使用，提前放入 IOC 容器中
    // 不注入没有 password grant_type
    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

// 数据库连接池对象，SpringBoot 配置完成后自动注入
@Autowired
private DataSource dataSource;

// 客户端信息来源
@Bean
public ClientDetailsService jdbcClientDetailsService(){
    return new JdbcClientDetailsService(dataSource);
}

// 指定客户端信息的数据库来源
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
   clients.withClientDetails(jdbcClientDetailsService());
}

 @Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory()
    		// 客户端 id
            .withClient("java")
            // 客户端密码
            .secret(new BCryptPasswordEncoder().encode("123456"))
            // 资源 id
            .resourceIds("res")
            // 该客户端允许授权的类型
            .authorizedGrantTypes("authorization_code","refresh_token")
            // 允许授权的范围
            .scopes("all")
            // 验证回调地址
            .redirectUris("http://www.baidu.com");
}

// token 保存策略，指你生成的 Token 要往哪里存储
// 存在数据库：new JdbcApprovalStore(dataSource)，存在内存中：new InMemoryTokenStore()
@Bean
public TokenStore tokenStore(){
    return new JdbcTokenStore(dataSource);
}

// 客户端信息来源
@Bean
public ClientDetailsService jdbcClientDetailsService(){
    return new JdbcClientDetailsService(dataSource);
}

// 令牌管理
@Bean
public AuthorizationServerTokenServices tokenServices() {
    DefaultTokenServices tokenServices = new DefaultTokenServices();
    // token 保存策略
    tokenServices.setTokenStore(tokenStore());
    // 支持刷新模式，即 refresh token 会同步刷新
    tokenServices.setSupportRefreshToken(true);
    // 客户端信息来源
    tokenServices.setClientDetailsService(jdbcClientDetailsService());
    // token 有效期自定义设置，默认 12 小时
    tokenServices.setAccessTokenValiditySeconds(60 * 60 * 12); 
    // refresh token 有效期自定义设置，默认 30 天
    tokenServices.setRefreshTokenValiditySeconds(60 * 60 * 24 * 7);
    
    return tokenServices;
}

// 授权模式专用对象，在 Security 配置中注入容器
@Autowired
private AuthenticationManager authenticationManager;

// 授权信息保存策略
@Bean
public ApprovalStore approvalStore(){
    return new JdbcApprovalStore(dataSource);
}

// 授权码模式数据来源
@Bean
public AuthorizationCodeServices authorizationCodeServices(){
    return new JdbcAuthorizationCodeServices(dataSource);
}

// OAuth2 的主配置信息
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    endpoints
            .approvalStore(approvalStore())
            .authenticationManager(authenticationManager)
            .authorizationCodeServices(authorizationCodeServices())
            .tokenServices(tokenServices());
}

// 检查 token 的策略，即配置令牌端点的安全约束
// 就是这个端点谁能访问，谁不能访问
@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    // tokenkey 这个 endpoint 当使用用 JwtToken 且使用非对称加密时，资源服务用于获取公钥而开放的，此时指 endpoint 完全公开
    security.tokenKeyAccess("permitAll()");
    // checkToken 这个 endpoint 完全公开
    security.checkTokenAccess("permitAll()");
    // 允许表单认证
    security.allowFormAuthenticationForClients();
    
}

/**
 * Created with IntelliJ IDEA.
 *
 * @author Demo_Null
 * @date 2020/10/26
 * @description OAuth2 配置文件
 */
@Configuration
@EnableAuthorizationServer
public class OAuthServerConfig extends AuthorizationServerConfigurerAdapter {

    // 数据库连接池对象，SpringBoot 配置完成后自动注入
    @Autowired
    private DataSource dataSource;


    // 授权模式专用对象，在 Security 配置中注入容器
    @Autowired
    private AuthenticationManager authenticationManager;

    // 客户端信息来源
    @Bean
    public ClientDetailsService jdbcClientDetailsService(){
        return new JdbcClientDetailsService(dataSource);
    }

    // token 保存策略，指你生成的 Token 要往哪里存储
    // 存在数据库：new JdbcApprovalStore(dataSource)，存在内存中：new InMemoryTokenStore()
    @Bean
    public TokenStore tokenStore(){
        return new JdbcTokenStore(dataSource);
    }

    // 指定客户端信息的数据库来源
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.withClientDetails(jdbcClientDetailsService());
    }


    // 授权信息保存策略
    @Bean
    public ApprovalStore approvalStore(){
        return new JdbcApprovalStore(dataSource);
    }

    // 授权码模式数据来源
    @Bean
    public AuthorizationCodeServices authorizationCodeServices(){
        return new JdbcAuthorizationCodeServices(dataSource);
    }


    // 令牌管理
    @Bean
    public AuthorizationServerTokenServices tokenServices() {
        DefaultTokenServices tokenServices = new DefaultTokenServices();
        // token 保存策略
        tokenServices.setTokenStore(tokenStore());
        // 支持刷新模式
        tokenServices.setSupportRefreshToken(true);
        // 客户端信息来源
        tokenServices.setClientDetailsService(jdbcClientDetailsService());
        // token 有效期自定义设置，默认 12 小时
        tokenServices.setAccessTokenValiditySeconds(60 * 60 * 12);
        // refresh token 有效期自定义设置，默认 30 天
        tokenServices.setRefreshTokenValiditySeconds(60 * 60 * 24 * 7);

        return tokenServices;
    }

    // 检查 token 的策略，即配置令牌端点的安全约束
    // 就是这个端点谁能访问，谁不能访问
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        // 此时指 endpoint 完全公开
        security.tokenKeyAccess("permitAll()");
        // checkToken 这个 endpoint 完全公开
        security.checkTokenAccess("permitAll()");
        // 允许表单认证
        security.allowFormAuthenticationForClients();

    }

    // OAuth2 的主配置信息
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
                .approvalStore(approvalStore())
                .authenticationManager(authenticationManager)
                .authorizationCodeServices(authorizationCodeServices())
                .tokenServices(tokenServices());
    }
}

/**
 * Created with IntelliJ IDEA.
 *
 * @author Demo_Null
 * @date 2020/10/26
 * @description 资源服务配置
 */
@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true) // Spring Security 方法权限
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Bean
    public TokenStore tokenStore(){
        return new JdbcTokenStore(dataSource);
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId("res").tokenStore(tokenStore());
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                // 指定不同请求方式访问资源所需要的权限，一般查询是 read，其余是 write。
                .antMatchers(HttpMethod.GET, "/**").access("#oauth2.hasScope('read')")
                .antMatchers(HttpMethod.POST, "/**").access("#oauth2.hasScope('write')")
                .antMatchers(HttpMethod.PATCH, "/**").access("#oauth2.hasScope('write')")
                .antMatchers(HttpMethod.PUT, "/**").access("#oauth2.hasScope('write')")
                .antMatchers(HttpMethod.DELETE, "/**").access("#oauth2.hasScope('write')")
                .and()
                .headers().addHeaderWriter((request, response) -> {
                    // 允许跨域
                    response.addHeader("Access-Control-Allow-Origin", "*");
                    // 如果是跨域的预检请求，则原封不动向下传达请求头信息
                    if (request.getMethod().equals("OPTIONS")) {
                        response.setHeader("Access-Control-Allow-Methods", 
                        					request.getHeader("Access-Control-Request-Method"));
                        response.setHeader("Access-Control-Allow-Headers", 
                        					request.getHeader("Access-Control-Request-Headers"));
                    }
                });
    }
}

# 省略端口，数据源等配置
security:
  oauth2:
    client:
      access-token-uri: http://localhost:8081/oauth/token
      user-authorization-uri: http://localhost:8081/oauth/authorize
      client-id: web
    resource:
      user-info-uri: http://localhost:8081/user
      prefer-token-info: false

/**
 * Created with IntelliJ IDEA.
 *
 * @author Demo_Null
 * @date 2020/10/26
 * @description 返回用户信息
 */
@RestController
public class GetUser {

    @GetMapping("/user")
    public Principal user(Principal user){
        return user;
    }
}