OKTA==springboot2.5.4整合OKTA实现单点登录demo

SSO demo with Okta and spring boot - YouTube

整体流程

 去okta注册后会自动生成一个教程，点击 Create your web application

 

设置OKTA认证成功之后返回toekn的URL ，这个地址如果spring security没有指定登录URL，就默认是这个

 ​​​​​​​http://localhost:8081/login

 

获取到client id 和client sercret ,会用在springboot配置文件中

 

获取为这个app提供认证的网址， 就是springboot配置文件中需要写的issuer

 然后设置能够访问这个app的用户，设置邮箱密码

 

 点击新建的people，将app asigned给指定的people

 =========================================================

编写springboot程序

	4.0.0
	
		org.springframework.boot
		spring-boot-starter-parent
		2.5.4
		 
	
	com.example
	demo-okta-sso
	0.0.1-SNAPSHOT
	demo-okta-sso
	Demo project for Spring Boot
	
		1.8
	
	
		
			org.springframework.boot
			spring-boot-starter-security
		
		
			org.springframework.boot
			spring-boot-starter-web
		
		
			com.okta.spring
			okta-spring-boot-starter
			0.6.0
		

		
			org.springframework.boot
			spring-boot-starter-test
			test
		
		
			org.springframework.security
			spring-security-test
			test
		
		
			org.springframework.security.oauth.boot
			spring-security-oauth2-autoconfigure
			2.1.5.RELEASE
		
	

	
		
			
				org.springframework.boot
				spring-boot-maven-plugin
			
		
	

package com.example.demooktasso;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.annotation.security.PermitAll;
import java.security.Principal;

@SpringBootApplication
@RestController
@EnableOAuth2Sso
public class DemoOktaSsoApplication {


	@GetMapping("/")
	public String greetUser(Principal principal){
		return "Hello "+principal.getName()+" from application 2";
	}

	public static void main(String[] args) {
		SpringApplication.run(DemoOktaSsoApplication.class, args);
	}

}

server.port=8081

#from application
okta.oauth2.clientId=刚才在OKTA官网查看到的
okta.oauth2.clientSecret=刚才在OKTA官网查看到的
#from API
okta.oauth2.issuer=刚才在OKTA官网查看到的

======================================

启动程序

无痕模式访问localhost:8081

会重定向到这

重定向的完整路径
https://dev-44813837.okta.com/oauth2/default/v1/authorize?client_id=0oa5w5fx8u66AZswK5d7&redirect_uri=http://localhost:8081/login&response_type=code&scope=profile%20email%20openid&state=wLmpI1

详细信息
https://dev-44813837.okta.com/oauth2/default/v1/authorize?
client_id=0oa5w5fx8u66AZswK5d7
&redirect_uri=http://localhost:8081/login
&response_type=code
&scope=profile%20email%20openid
&state=wLmpI1

重定向到这就会获取到对应app的认证页面，输入people的邮箱密码

然后依次发起三次请求

https://dev-44813837.okta.com/login/token/redirect?
stateToken=02.id.i224I4bxORCa1dAC1xD_v1nWU3t645m50eprGyUR

http://localhost:8081/login?
code=DQTcQ8pJKVkIBmWDinYP54S6OGzWuX6pBnUpOZN4Ms8&state=wLmpI1

http://localhost:8081/

成功访问到资源

====================================

修改代码开个8080端口，然后在OKTA中配置以下重定向的URL，启动项目，无痕模式发现登录不了，因为8081已经登录了