Spring Cloud OAuth 2.0实现四种授权方式
基于Spring Boot 2.0.3，Spring Cloud OAuth 2.0实现四种授权方式，实现后的验证交互步骤
OAuth 2.0定义了四种授权方式。
1.授权码模式（authorization code）
2.简化模式（implicit）
3.密码模式（resource owner password credentials）
4.客户端模式（client credentials）
客户端模式（client credentials）
client_id=unity-client
client_secret=unity
http://localhost:8080/oauth/token?grant_type=client_credentials&scope=read&client_id=unity-client&client_secret=unity
{
"access_token": "32f044cd-48ef-4382-9a77-7ee35bd9a824",
"token_type": "bearer",
"expires_in": 41413,
"scope": "read write"
}
访问资源服务器
http://localhost:8080/api/order/11?access_token=32f044cd-48ef-4382-9a77-7ee35bd9a824
order id : 11
表oauth_client_details 字段 resource_ids 内容要和资源服务器配置的一样
@Configuration
@EnableResourceServer
@EnableOAuth2Client
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
@Override
public void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.requestMatchers().antMatchers("/api/**").and().authorizeRequests().anyRequest().authenticated();
}
private static final String DEMO_RESOURCE_ID = "api";
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.resourceId(DEMO_RESOURCE_ID).stateless(true);
}
}
BCryptPasswordEncoder
http://localhost:8080/oauth/token?grant_type=client_credentials&scope=read&client_id=clients&client_secret=$08$MU/8V8maXM/fldSLnat1Re7VFgE8wd1XxH5q/iSz7CHOQ7RXaHVre
授权码模式（authorization code）
http://localhost:8080/oauth/authorize?client_id=unity-client&response_type=code&redirect_uri=http://www.baidu.com
http://localhost:8080/oauth/authorize?response_type=code&client_id=client&redirect_uri=http://www.baidu.com
输入用户的用户，密码
https://www.baidu.com/?code=uX6fl0
根据code换取access_code，注意使用post方法
http://localhost:8080/oauth/token?client_id=client&grant_type=authorization_code&redirect_uri=http://www.baidu.com&code=uX6fl0
注意这个code要和上个步骤中获得的code保持一致
输入客户端的用户，密码
用户名输入client，密码是secret,点击确定
{"access_token":"2f695ad8-0e64-478e-a5c4-b13597dc0df2","token_type":"bearer","refresh_token":"c67241bd-1c0f-4b9f-bd61-6948b788e12d","expires_in":43199,"scope":"app"}
访问资源服务器
http://localhost:8080/api/order/11?access_token=2f695ad8-0e64-478e-a5c4-b13597dc0df2
order id : 11
http://localhost:8080/oauth/token?grant_type=refresh_token&refresh_token=c67241bd-1c0f-4b9f-bd61-6948b788e12d
{"access_token":"ec4b4d6c-3dfe-48fe-93b3-e3e335e6637b","token_type":"bearer","refresh_token":"c67241bd-1c0f-4b9f-bd61-6948b788e12d","expires_in":43199,"scope":"app"}
{"access_token":"8be81c35-641f-4997-ac34-ede545ced3d5","token_type":"bearer","refresh_token":"c67241bd-1c0f-4b9f-bd61-6948b788e12d","expires_in":43199,"scope":"app"}
refresh_token必须在过期之前调用才能换新的token
只要refresh_token有效，就可以直接用它来换新的access_token
密码模式（resource owner password credentials）
http://localhost:8080/oauth/token?grant_type=password&username=admin&password=123
{"access_token":"8be81c35-641f-4997-ac34-ede545ced3d5","token_type":"bearer","refresh_token":"c67241bd-1c0f-4b9f-bd61-6948b788e12d","expires_in":42630,"scope":"app"}
简化模式（implicit）
该模式直接在浏览器中向认证服务器申请令牌，无需经过client端的服务器，跳过了"授权码"这个步骤，所有步骤在浏览器中完成，直接在回调url中传递令牌。
适合直接在前端应用获取token的应用
步骤跟authorization code类似，只不过少了授权码：
在浏览器向认证服务器请求token
用户登录(如果之前没有登陆的话)
用户授权
授权完直接跳转到redirectUri并在url中携带token
需要开启表单验证
@Override
protected void configure(HttpSecurity http) throws Exception {
// [1]
// http.httpBasic().and().csrf().disable();
// [2]
// http.authorizeRequests().anyRequest().authenticated().and().formLogin().and().httpBasic();
http.csrf().disable();
http.requestMatchers().antMatchers("/oauth/**", "/login/**", "/logout/**").and().authorizeRequests()
.antMatchers("/oauth/**").authenticated().and().formLogin().permitAll();
}
http://localhost:8080/oauth/authorize?response_type=token&client_id=client&redirect_uri=http://www.baidu.com
https://www.baidu.com/#access_token=8be81c35-641f-4997-ac34-ede545ced3d5&token_type=bearer&expires_in=38324&scope=app
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">