Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

增加注释，资源服务器增加tokenStore #41

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

增加注释，资源服务器增加tokenStore #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions ...als-springboot2/src/main/java/moe/cnkirito/security/oauth2/config/OAuth2ServerConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,15 @@
* @author 徐靖峰
* Date 2018-04-19
*/

/**
* @author yangyiyun
* Date 2020-08-17
* 关键逻辑：你访问某被保护的资源，后台返回没权限并提供授权页面。授权页面有用户名/密码/client_id/client_password等参数，
* 输入后提交给认证服务器，认证服务器通过查询数据或redis等，验证是否合法用户。如果合法，则生成token并保存到数据库或redis
* 此处关键在于，资源服务器也能访问token保存的地方，因此，在用户拿着认证器给的token去资源服务器取资源时，资源服务器可以验证
* token的有效性
*/
@Configuration
public class OAuth2ServerConfig {

Expand All @@ -33,8 +42,13 @@ public class OAuth2ServerConfig {
@EnableResourceServer
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

@Autowired
RedisConnectionFactory redisConnectionFactory;
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
// yangyiyun 资源服务器设置token的保存位置
resources.tokenStore(new RedisTokenStore(redisConnectionFactory));
// stateless(bool) 表示这个资源 是否 要认证后才能访问，默认true
resources.resourceId(DEMO_RESOURCE_ID).stateless(true);
}

Expand Down Expand Up @@ -68,6 +82,11 @@ public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
// password 方案三：支持多种编码，通过密码的前缀区分编码方式
String finalSecret = "{bcrypt}"+new BCryptPasswordEncoder().encode("123456");
//配置两个客户端,一个用于password认证一个用于client认证
// 此处的配置的意思是 如果传的client_id 是client_1,那么只能以client认证的方式做认证，也就是密码要对，
// 同时有刷新token的权限（根据authorizedGrantTypes判断的），如果传的client_id是client_2,那么
// 就只能以密码的方式认证，并且可以刷新token。用户名+密码得校验通过
// 那么，用户名密码的校验的逻辑在哪呢？在spring security的安全配置里，多种方式，推荐创建一个实现了UserDetailsService借口
// 的实现类，并作为bean注册到spring容器（@Bean，@Component都行）
clients.inMemory().withClient("client_1")
.resourceIds(DEMO_RESOURCE_ID)
.authorizedGrantTypes("client_credentials", "refresh_token")
Expand All @@ -80,6 +99,12 @@ public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
.scopes("select")
.authorities("oauth2")
.secret(finalSecret);
//配置客户端存储到db 代替原来得内存模式
/*db的表名约定为：oauth_client_details,字段：client_id,resource_ids,client_secret,
scope,authorized_grant_types,web_server_redirect_url
JdbcClientDetailsService clientDetailsService = new JdbcClientDetailsService(dataSource);
clientDetailsService.setPasswordEncoder(passwordEncoder);
clients.withClientDetails(clientDetailsService);*/
}

@Override
Expand Down
2 changes: 2 additions & 0 deletions ...-springboot2/src/main/java/moe/cnkirito/security/oauth2/config/SecurityConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,8 @@ public AuthenticationManager authenticationManagerBean() throws Exception {

@Override
protected void configure(HttpSecurity http) throws Exception {
// 对 oauth2自动创建的接口 不做校验，这些接口用来 生成access_token，后续看源码
// 看这些自动创建的接口具体的逻辑
// @formatter:off
http
.requestMatchers().anyRequest()
Expand Down