Springboot Oauth2 Server 搭建Oauth2认证服务

本教程源码

https://github.com/bestaone/HiAuth

源码比较全面，教程我就只介绍关键代码了，喜欢的点个star，谢谢！

关键词

• 微服务认证
• Oauth2
• 认证中心
• springboot
• spring-cloud-starter-oauth2
• 集成Oauth2
• Oauth2 客户端

介绍

这里我将介绍两个部分

• Oauth2 server 的开发 （hi-auth-web模块）
• Oauth2 client 的开发 （hi-mall-web模块）

效果图

himall.gif

umc.gif

LIVE DEMO

• HiMall: http://hiauth.cn/himall
• UMC: http://hiauth.cn/umc
• Swagger2：http://hiauth.cn/hiauth/swagger-ui.html

Oauth2 server 搭建

• 数据库表（mysql5.6）,其中只有sys_user表由我们自己控制，其他表由框架控制

CREATE TABLE `clientdetails` (
  `appId` varchar(255) NOT NULL,
  `resourceIds` varchar(256) DEFAULT NULL,
  `appSecret` varchar(256) DEFAULT NULL,
  `scope` varchar(256) DEFAULT NULL,
  `grantTypes` varchar(256) DEFAULT NULL,
  `redirectUrl` varchar(256) DEFAULT NULL,
  `authorities` varchar(256) DEFAULT NULL,
  `access_token_validity` int(11) DEFAULT NULL,
  `refresh_token_validity` int(11) DEFAULT NULL,
  `additionalInformation` varchar(4096) DEFAULT NULL,
  `autoApproveScopes` varchar(256) DEFAULT NULL,
  PRIMARY KEY (`appId`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

CREATE TABLE `oauth_access_token` (
  `token_id` varchar(256) DEFAULT NULL,
  `token` blob,
  `authentication_id` varchar(255) NOT NULL,
  `user_name` varchar(256) DEFAULT NULL,
  `client_id` varchar(256) DEFAULT NULL,
  `authentication` blob,
  `refresh_token` varchar(256) DEFAULT NULL,
  PRIMARY KEY (`authentication_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

CREATE TABLE `oauth_approvals` (
  `userId` varchar(256) DEFAULT NULL,
  `clientId` varchar(256) DEFAULT NULL,
  `scope` varchar(256) DEFAULT NULL,
  `status` varchar(10) DEFAULT NULL,
  `expiresAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  `lastModifiedAt` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00'
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

CREATE TABLE `oauth_client_details` (
  `client_id` varchar(255) NOT NULL,
  `resource_ids` varchar(256) DEFAULT NULL,
  `client_secret` varchar(256) DEFAULT NULL,
  `scope` varchar(256) DEFAULT NULL,
  `authorized_grant_types` varchar(256) DEFAULT NULL,
  `web_server_redirect_uri` varchar(2560) DEFAULT NULL,
  `authorities` varchar(256) DEFAULT NULL,
  `access_token_validity` int(11) DEFAULT NULL,
  `refresh_token_validity` int(11) DEFAULT NULL,
  `additional_information` varchar(4096) DEFAULT NULL,
  `autoapprove` varchar(256) DEFAULT NULL,
  PRIMARY KEY (`client_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

INSERT INTO `oauth_client_details` VALUES ('client', null, '$2a$10$1N/.LvTJuYpvxDzoJ1KdvuPDdV/kDSQE9Cxm9BzB1PreyzK6gmFRe', 'ALL,AUTH,USER,GOODS,ORDER', 'authorization_code,client_credentials,password,refresh_token', 'http://localhost:8081/mall/callback,http://localhost:9080/user/webjars/springfox-swagger-ui/oauth2-redirect.html,http://localhost:9081/goods/webjars/springfox-swagger-ui/oauth2-redirect.html,http://localhost:9082/order/webjars/springfox-swagger-ui/oauth2-redirect.html,http://localhost/user/webjars/springfox-swagger-ui/oauth2-redirect.html,http://localhost/goods/webjars/springfox-swagger-ui/oauth2-redirect.html,http://localhost/order/webjars/springfox-swagger-ui/oauth2-redirect.html', 'ROLE_USER', '1800', '86400', null, 'false');

CREATE TABLE `oauth_client_token` (
  `token_id` varchar(256) DEFAULT NULL,
  `token` blob,
  `authentication_id` varchar(255) NOT NULL,
  `user_name` varchar(256) DEFAULT NULL,
  `client_id` varchar(256) DEFAULT NULL,
  PRIMARY KEY (`authentication_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

CREATE TABLE `oauth_code` (
  `code` varchar(256) DEFAULT NULL,
  `authentication` blob
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

CREATE TABLE `oauth_refresh_token` (
  `token_id` varchar(256) DEFAULT NULL,
  `token` blob,
  `authentication` blob
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

CREATE TABLE `sys_user` (
  `id` bigint(20) NOT NULL,
  `name` varchar(20) DEFAULT NULL,
  `username` varchar(20) NOT NULL,
  `password` varchar(128) NOT NULL,
  `tel` varchar(20) DEFAULT NULL,
  `gender` varchar(10) DEFAULT NULL,
  `createTime` datetime DEFAULT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `unique_username` (`username`),
  UNIQUE KEY `unique_tel` (`tel`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

INSERT INTO `sys_user` VALUES ('1', '张三', 'admin', '123456', '13712345678', 'MALE', '2018-12-03 17:57:12');
INSERT INTO `sys_user` VALUES ('2', '李四', 'user', '123456', '13812345678', 'UNKNOWN', '2018-12-03 17:57:12');

• pom.xml如下

    org.springframework.boot
    spring-boot-starter-web


    org.springframework.boot
    spring-boot-starter-security


    org.springframework.cloud
    spring-cloud-starter-oauth2
    2.0.1.RELEASE


    org.springframework.boot
    spring-boot-starter-thymeleaf


    org.springframework.boot
    spring-boot-starter-jdbc


    mysql
    mysql-connector-java


    org.mybatis.spring.boot
    mybatis-spring-boot-starter
    2.0.0

• 添加表sys_user的service、mapper

@Mapper
public interface UserMapper {

    @Insert("INSERT INTO sys_user(id,name,username,password,tel,gender,createTime) VALUES(#{id},#{name},#{username},#{password},#{tel},#{gender},#{createTime})")
    void insert(User user);

    @Delete("DELETE FROM sys_user WHERE id = #{id}")
    void delete(Long id);

    @Update("UPDATE sys_user SET name=#{name},username=#{username},password=#{password},tel=#{tel},gender=#{gender},createTime=#{createTime} WHERE id =#{id}")
    int update(User user);

    @ResultMap("BaseResultMap")
    @Select("SELECT * FROM sys_user WHERE id=#{id}")
    User findById(Long id);

    @ResultMap("BaseResultMap")
    @Select("SELECT * FROM sys_user WHERE username=#{username}")
    User findByUsername(String username);

    @ResultMap("BaseResultMap")
    @Select("SELECT * FROM sys_user WHERE tel=#{tel}")
    User findByTel(String tel);

    @ResultMap("BaseResultMap")
    @Select("SELECT * FROM sys_user")
    List findAll();

    @ResultMap("BaseResultMap")
    @Select("SELECT * FROM sys_user WHERE name like #{name}")
    List findByName(String name);

}

@Service
public class UserServiceImpl implements UserService {

    @Resource
    UserMapper mapper;

    @Override
    public User save(User user) {
        if(user.getId()!=null){
            mapper.update(user);
        } else {
            user.setId(System.currentTimeMillis());
            mapper.insert(user);
        }
        return user;
    }

    @Override
    public User findById(Long id) {
        return mapper.findById(id);
    }

    @Override
    public User findByUsername(String username) {
        return mapper.findByUsername(username);
    }

    @Override
    public User findByTel(String tel) {
        return mapper.findByTel(tel);
    }

    @Override
    public List findAll() {
        return mapper.findAll();
    }

    @Override
    public void delete(Long id) {
        mapper.delete(id);
    }

    @Override
    public List findByName(String name) {
        return mapper.findByName("%" + name + "%");
    }

}

• 添加登录拦截

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Bean
    public UserDetailsService simpleUserDetailsService(){
        return new UserDetailsServiceImpl();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(simpleUserDetailsService());
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.userDetailsService(userDetailsService());
        http.csrf().disable();
        http.formLogin()
                .loginPage("/signin").loginProcessingUrl("/signin/form/account").defaultSuccessUrl("/index")
                .and()
                .logout().logoutUrl("/signout").logoutSuccessUrl("/signin")
                .and()
                .authorizeRequests()
                .antMatchers("/signin","/signin/form/tel","/code/image","/code/mobile","/static/**").permitAll()
                .antMatchers("/oauth/**").permitAll()
                .antMatchers("/user/**").hasAnyRole("USER","ADMIN")
                .anyRequest().authenticated();

    }

}

• 添加登录表单signin.html

    

        用户名
        
        密码
        
        登录
    

• Oauth2 server Config

@Configuration
@EnableAuthorizationServer
public class OAuth2AuthorizationConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private Environment env;

    @Autowired
    private AuthenticationManager authenticationManager;

    /**
     * 自定义授权页面
     */
    @Autowired
    private AuthorizationEndpoint authorizationEndpoint;

    @PostConstruct
    public void init() {
        authorizationEndpoint.setUserApprovalPage("forward:/oauth/my_approval_page");
        authorizationEndpoint.setErrorPage("forward:/oauth/my_error_page");
    }

    @Bean
    public DataSource dataSource() {
        final DriverManagerDataSource dataSource = new DriverManagerDataSource();
        dataSource.setDriverClassName(env.getProperty("spring.datasource.driver-class-name"));
        dataSource.setUrl(env.getProperty("spring.datasource.url"));
        dataSource.setUsername(env.getProperty("spring.datasource.username"));
        dataSource.setPassword(env.getProperty("spring.datasource.password"));
        return dataSource;
    }

    @Bean
    public ApprovalStore approvalStore() {
        return new JdbcApprovalStore(dataSource());
    }

    @Bean
    protected AuthorizationCodeServices authorizationCodeServices() {
        return new JdbcAuthorizationCodeServices(dataSource());
    }

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource());
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        // oauth_client_details
        clients.jdbc(dataSource());
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
        // oauth_approvals
        endpoints.approvalStore(approvalStore());
        // oauth_code
        endpoints.authorizationCodeServices(authorizationCodeServices());
        // oauth_access_token & oauth_refresh_token
        endpoints.tokenStore(tokenStore());
        // 支持password grant type
        endpoints.authenticationManager(authenticationManager);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
        oauthServer.allowFormAuthenticationForClients();
    }

}

Oauth2 client 搭建

• pom.xml

    org.springframework.boot
    spring-boot-starter-web


    org.springframework.boot
    spring-boot-starter-thymeleaf


    com.github.scribejava
    scribejava-apis
    5.0.0

• DefaultApi20

public class AiwanApi extends DefaultApi20  {

    private String accessTokenEndpoint = "http://localhost:8080/oauth/token";
    private String authorizationBaseUrl = "http://localhost:8080/oauth/authorize";

    protected AiwanApi() {}

    private static class InstanceHolder {
        private static final AiwanApi INSTANCE = new AiwanApi();
    }

    public static AiwanApi instance() {
        return InstanceHolder.INSTANCE;
    }

    @Override
    public String getAccessTokenEndpoint() {
        return accessTokenEndpoint;
    }

    @Override
    protected String getAuthorizationBaseUrl() {
        return authorizationBaseUrl;
    }
    
    @Override
    public TokenExtractor getAccessTokenExtractor() {
        return OAuth2AccessTokenJsonExtractor.instance();
    }

    @Override
    public OAuth20Service createService(OAuthConfig config) {
        return new AiwanService(this, config);
    }

}

• OAuth20Service

public class AiwanService extends OAuth20Service {

    public AiwanService(DefaultApi20 api, OAuthConfig config) {
        super(api, config);
    }
    
    @Override
    protected OAuthRequest createAccessTokenRequest(String code) {
        final OAuthRequest request = new OAuthRequest(getApi().getAccessTokenVerb(), getApi().getAccessTokenEndpoint());
        final OAuthConfig config = getConfig();
        request.addParameter(OAuthConstants.CLIENT_ID, config.getApiKey());
        final String apiSecret = config.getApiSecret();
        if (apiSecret != null) {
            request.addParameter(OAuthConstants.CLIENT_SECRET, apiSecret);
        }
        request.addParameter(OAuthConstants.CODE, code);
        request.addParameter(OAuthConstants.REDIRECT_URI, config.getCallback());
        final String scope = config.getScope();
        if (scope != null) {
            request.addParameter(OAuthConstants.SCOPE, scope);
        }
        request.addParameter(OAuthConstants.GRANT_TYPE, OAuthConstants.AUTHORIZATION_CODE);
        request.addHeader(OAuthConstants.HEADER,
                OAuthConstants.BASIC + ' '
                + Base64Encoder.getInstance()
                .encode(String.format("%s:%s", config.getApiKey(), apiSecret).getBytes(Charset.forName("UTF-8"))));
        return request;
    }
}

• 获取access_token

@Controller
public class IndexController {

    private static Logger logger = LoggerFactory.getLogger(IndexController.class);
    
    private static final String SESSION_KEY_ACCESS_TOKEN = "MY_ACCESS_TOKEN";

    /**
     * 为防止CSRF跨站攻击，每次请求STATE的值应该不同，可以放入Session！
     * 由于都是localhost测试，所以session无法保持，用一个固定值。
     */
    private static final String STATE = "secret-rensanning";
    private static final String CLIENT_ID = "client";
    private static final String CLIENT_SECRET = "123456";
    private static final String CALLBACK_URL = "http://localhost:8081/mall/callback";
    private static final String SCOPE = "ALL";
    private OAuth20Service aiwanApi = new ServiceBuilder(CLIENT_ID)
            .apiSecret(CLIENT_SECRET)
            .scope(SCOPE)
            .state(STATE)
            .callback(CALLBACK_URL)
            .build(AiwanApi.instance());

    @GetMapping("/")
    public String index() {
        return "index";
    }

    @GetMapping("/signin")
    public void signin(HttpServletRequest request, HttpServletResponse response) throws IOException {
        logger.debug("signin");
        logger.info("session id:{}", request.getSession().getId());
        String authorizationUrl = aiwanApi.getAuthorizationUrl();
        logger.info("redirectURL:{}", authorizationUrl);
        response.sendRedirect(authorizationUrl);
    }

    @GetMapping("/callback")
    public String callback(@RequestParam(value = "code", required = false) String code,
                           @RequestParam(value = "state", required = false) String state, HttpServletRequest request) throws Exception {

        logger.debug("callback [code:{}],[state:{}],[sessionId:{}]", code, state, request.getSession().getId());
        
        if (STATE.equals(state)) {
            logger.info("State OK!");
        } else {
            logger.error("State NG!");
        }

        OAuth2AccessToken accessToken = aiwanApi.getAccessToken(code);
        request.getSession().setAttribute(SESSION_KEY_ACCESS_TOKEN, accessToken);

        return "profile";
    }

}

本教程源码请移步 [https://github.com/bestaone/HiAuth]