spring oauth2实现数据库存储token

其他 2019-03-29 00:21:20 阅读次数: 0
版权声明：本文为博主原创文章，未经博主允许不得转载。 https://blog.csdn.net/Ybt_c_index/article/details/85067321

之前我有写过一篇关于spring oauth2的学习笔记，当时的实现是使用了在内存中定死了用户，然后将token存到redis中，可以说是一种比较简单的实现方式。
这篇文章是在之前的基础上迈了一小步，可以实现从数据库读取用户，并将token存储到数据库中。这样就可以满足一般的基本生产需求了。
当然还有更加深入的将client信息保存到数据库，使用jwt等等，由于我没有深入的了解，并且也不需要如此复杂的系统，所以就不献丑了，想要了解的朋友可以去查一下相关资料。

GitHub项目地址

参考文章：
https://www.jianshu.com/p/ded9dc32f550
https://wiselyman.iteye.com/blog/2379419

oauth2服务器

一般来说，我们会将oauth2的服务器和用户管理整合到一起，也就是说，和用户相关的一些操作都在这里，并且使用oauth2做一些认证。

所以首先就是我使用常用的账户管理：用户及权限角色

package com.yubotao.springOAuth2.model;

import lombok.Getter;
import lombok.Setter;

import javax.persistence.*;
import java.util.List;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 14:45 2018/12/17
 * @Modified By:
 */
@Entity
@Table(name = "account")
public class Account {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Getter
    @Setter
    @Column(name = "id")
    private Long id;
    @Getter
    @Setter
    @Column(name = "username")
    private String username;
    @Getter
    @Setter
    @Column(name = "password")
    private String password;
    @Getter
    @Setter
    @OneToMany(mappedBy = "account")
    private List<AccountRole> accountRoles;
}


package com.yubotao.springOAuth2.model;

import lombok.Getter;
import lombok.Setter;

import javax.persistence.*;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 14:44 2018/12/17
 * @Modified By:
 */
@Entity
@Table(name = "role")
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Getter
    @Setter
    @Column(name = "id")
    private Long id;
    @Getter
    @Setter
    @Column(name = "name")
    private String name;
}

由于用户和角色间是多对多关系，所以有一个中间类

package com.yubotao.springOAuth2.model;

import lombok.Getter;
import lombok.Setter;

import javax.persistence.*;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 14:45 2018/12/17
 * @Modified By:
 */
@Entity
@Table(name = "account_role")
public class AccountRole {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Getter
    @Setter
    @Column(name = "id")
    private Long id;
    @Getter
    @Setter
    @JoinColumn(name = "role_id")
    @ManyToOne
    private Role role;
    @Getter
    @Setter
    @ManyToOne
    @JoinColumn(name = "account_id")
    private Account account;
}

接着使用jpa简单的实现了一下查询方法

package com.yubotao.springOAuth2.jpa;

import com.yubotao.springOAuth2.model.Account;
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.jpa.repository.Query;
import org.springframework.data.repository.query.Param;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 16:59 2018/12/17
 * @Modified By:
 */
public interface AccountJpa extends JpaRepository<Account, String> {
    @Query("SELECT u FROM Account u WHERE LOWER(u.username) = LOWER(:username)")
    Account findAccountByUsername(@Param("username") String username);
}


package com.yubotao.springOAuth2.jpa;

import com.yubotao.springOAuth2.model.Account;
import com.yubotao.springOAuth2.model.AccountRole;
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.jpa.repository.Query;
import org.springframework.data.repository.query.Param;

import java.util.List;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 17:14 2018/12/17
 * @Modified By:
 */
public interface ARJpa extends JpaRepository<AccountRole, String> {
    @Query("SELECT ar FROM AccountRole ar WHERE LOWER(ar.account) = LOWER(:account)")
    List<AccountRole> findAccountRolesByAccount(@Param("account") Account account);
}

然后我们需要开始进行相关的安全设置。

spring security

package com.yubotao.springOAuth2.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 10:51 2018/7/26
 * @Modified By:
 */
@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
	// 自定义UserDetailsService实现
    @Autowired
    CustomUserDetailsService userDetailsService;

    // 内存用法
//    @Bean
//    @Override
//    protected UserDetailsService userDetailsService(){
//        BCryptPasswordEncoder bCryptPasswordEncoder = new BCryptPasswordEncoder();
//        String finalPassword = "{bcrypt}" + bCryptPasswordEncoder.encode("123456");
//        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
//        manager.createUser(User.withUsername("user_1").password(finalPassword).authorities("ADMIN").build());
//        manager.createUser(User.withUsername("user_2").password(finalPassword).authorities("USER").build());
//        return manager;
//    }

    @Bean
    PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

//    public static void main(String[] args) {
//        System.out.println(new  BCryptPasswordEncoder().encode("admin"));
//    }

    @Autowired
    public void config(AuthenticationManagerBuilder auth) throws Exception{
        //设置UserDetailsService以及密码规则
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    /**
     * 这一步的配置是必不可少的，否则SpringBoot会自动配置一个AuthenticationManager,覆盖掉内存中的用户
    * */
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        AuthenticationManager manager = super.authenticationManagerBean();
        return manager;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .requestMatchers().anyRequest()
                .and()
                .authorizeRequests()
                .antMatchers("/oauth/**").permitAll();
    }

}

spring oauth2

package com.yubotao.springOAuth2.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.*;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.AuthorizationServerTokenServices;
import org.springframework.security.oauth2.provider.token.DefaultTokenServices;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JdbcTokenStore;

import javax.sql.DataSource;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 10:07 2018/7/26
 * @Modified By:
 */
@Configuration
public class OAuth2ServerConfig {

    private static final String DEMO_RESOURCE_ID = "order";

    @Configuration
    // 资源服务器
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
        @Autowired
        private AuthExceptionEntryPoint authExceptionEntryPoint;

        @Override
        public void configure(ResourceServerSecurityConfigurer resources){
            resources.resourceId(DEMO_RESOURCE_ID).stateless(true);
            resources.authenticationEntryPoint(new AuthExceptionEntryPoint());
        }

        @Override
        public void configure(HttpSecurity http) throws Exception {
            // @formatter:off
            http.exceptionHandling().authenticationEntryPoint(authExceptionEntryPoint)
                    .and()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                    .and()
                    .requestMatchers().anyRequest()
                    .and()
                    .anonymous()
                    .and()
                    .authorizeRequests()
                    // or可以通过access_token访问，但是and不行；经过测试，应该是hasRole()方法出了问题，这里无法通过
//                    .antMatchers("/product/**").access("#oauth2.hasScope('select') and  hasRole('ROLE_ADMIN')")
                    .antMatchers("/order/**").authenticated();  // 配置order访问控制，必须认证过后才可以访问
            // @formatter:on
        }

    }

    @Configuration
//    身份认证服务器
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
        @Autowired
        AuthenticationManager authenticationManager;
//        @Autowired
//        RedisConnectionFactory redisConnectionFactory;
//        @Autowired
//        UserDetailsService userDetailsService;
        @Autowired
        private DataSource dataSource;
        @Autowired
        private CustomUserDetailsService userDetailsService;


        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            String finalSecret = new BCryptPasswordEncoder().encode("123456");
            // 配置两个客户端，一个用于password认证，一个用于client认证
            clients.inMemory().withClient("client_1")
                    .resourceIds(DEMO_RESOURCE_ID)
                    .authorizedGrantTypes("client_credentials")
                    .scopes("select")
                    .authorities("oauth2")
                    .secret(finalSecret)
                    .and()
                    .withClient("client_2")
                    .resourceIds(DEMO_RESOURCE_ID)
                    .authorizedGrantTypes("password", "refresh_token")
                    .scopes("select")
                    .authorities("oauth2")
                    .secret(finalSecret);
        }

        // 用来对token进行相关设置，比如设置token有效时长
        @Primary
        @Bean
        public AuthorizationServerTokenServices tokenServices() {
            DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
            defaultTokenServices.setAccessTokenValiditySeconds(1000000);
            defaultTokenServices.setRefreshTokenValiditySeconds(200000);
            defaultTokenServices.setSupportRefreshToken(true);
            defaultTokenServices.setReuseRefreshToken(false);
            defaultTokenServices.setTokenStore(tokenStore());
            return defaultTokenServices;
        }

        @Bean
        @Primary
        public TokenStore tokenStore() {
//            TokenStore tokenStore = new InMemoryTokenStore();
            return new JdbcTokenStore(dataSource);
        }


        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints
                    .tokenStore(tokenStore())
//                    .tokenStore(new RedisTokenStore(redisConnectionFactory))
//                    .tokenServices(tokenServices())
                    .authenticationManager(authenticationManager)
                    // 没有它，在使用refresh_token的时候会报错 IllegalStateException, UserDetailsService is required.
                    .userDetailsService(userDetailsService)
                    // 不加报错"method_not_allowed",
                    .allowedTokenEndpointRequestMethods(HttpMethod.GET,HttpMethod.GET);
        }

        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            // 允许表单认证
            oauthServer.allowFormAuthenticationForClients();
        }
    }

}

资源服务器就不用多说了，主要是在身份认证服务器做一些小的修改。首先就是TokenStore的设置，使用了数据库模式；然后在配置AuthorizationServerEndpointsConfigurer时，设置好对应的tokenStore以及userDetailsService（也就是我们自定义的）。

自定义UserDetailsService

package com.yubotao.springOAuth2.config;

import com.yubotao.springOAuth2.exception.CustomException;
import com.yubotao.springOAuth2.jpa.ARJpa;
import com.yubotao.springOAuth2.jpa.AccountJpa;
import com.yubotao.springOAuth2.model.Account;
import com.yubotao.springOAuth2.model.AccountRole;
import com.yubotao.springOAuth2.model.Role;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Transactional;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 17:29 2018/12/17
 * @Modified By:
 */
@Component
public class CustomUserDetailsService implements UserDetailsService {
    @Autowired
    AccountJpa accountJpa;
    @Autowired
    ARJpa arJpa;

    @Override
    @Transactional
    public UserDetails loadUserByUsername(final String username) {
        String lowerUsername = username.toLowerCase();
        Account account = accountJpa.findAccountByUsername(lowerUsername);
        if (account == null) {
            throw new CustomException("User " + lowerUsername + " was not found in the database");
        }
        Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();
        List<AccountRole> ars = arJpa.findAccountRolesByAccount(account);
        for (AccountRole ar : ars){
            Role role = ar.getRole();
            GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role.getName());
            grantedAuthorities.add(grantedAuthority);
        }

        return new User(account.getUsername(), account.getPassword(), grantedAuthorities);
    }
}

这里主要的功能就是构造一个UserDetails以便供oauth2使用，这里如果不太了解可以去看我的学习笔记中关于这里的源码解读。
而我们构造User的方式就是取数据库中的数据以及对应权限来构造。

接着，在我们获取token之前，我们需要构建两张表来存token。sql如下：

-- ----------------------------
-- Table structure for oauth_access_token
-- ----------------------------
DROP TABLE IF EXISTS `oauth_access_token`;
CREATE TABLE `oauth_access_token` (
  `token_id` varchar(256) DEFAULT NULL,
  `token` blob,
  `authentication_id` varchar(256) DEFAULT NULL,
  `user_name` varchar(256) DEFAULT NULL,
  `client_id` varchar(256) DEFAULT NULL,
  `authentication` blob,
  `refresh_token` varchar(256) DEFAULT NULL
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

-- ----------------------------
-- Records of oauth_access_token
-- ----------------------------

-- ----------------------------
-- Table structure for oauth_refresh_token
-- ----------------------------
DROP TABLE IF EXISTS `oauth_refresh_token`;
CREATE TABLE `oauth_refresh_token` (
  `token_id` varchar(256) DEFAULT NULL,
  `token` blob,
  `authentication` blob
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

-- ----------------------------
-- Records of oauth_refresh_token
-- ----------------------------

这个表的构建格式是有相关文档的，在spring oauth2的官方资料中有。我现在只找到中文版的了。

当这些准备完毕之后，我们就可以测试一下token端点获取access_token了。
在这里插入图片描述

这里需要提的一点就是，所有涉及密码的地方，spring要求都必须使用加密后的密码。包括用户的密码以及client的密码。如果这些密码没有加密过，用的明文的话就会报错，导致无法获取token。

oauth2 客户端

当我们建起oauth2服务端之后，我们就需要在整个服务架构中使用oauth2来保证资源的安全。这样我们就需要为那些需要受保护的服务配置oauth2.
所以可以看到还有一个oauth2-client服务。里面的配置非常简单。

首先我们需要配置资源服务器

package com.yubotao.oauth2client.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;

import javax.servlet.http.HttpServletResponse;

/**
 * @Auther: yubt
 * @Description:
 * @Date: Created in 9:41 2018/12/18
 * @Modified By:
 */
@Configuration
public class OAuth2Config {
    @Configuration
    @EnableResourceServer
    public class ResourceServerConfig  extends ResourceServerConfigurerAdapter {

        @Override
        public void configure(HttpSecurity http) throws Exception {
            http
                    .csrf().disable()
                    .exceptionHandling()
                    .authenticationEntryPoint((request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
                    .and()
                    // 这里配置了任何该服务下的资源全部需要通过认证来获取
                    .authorizeRequests()
                    .anyRequest().authenticated()
                    .and()
                    .httpBasic();
        }
    }
}

接着我们需要在配置文件application.properties中配置oauth2的user信息端点：

security.oauth2.resource.user-info-uri=http://localhost:8080/user

所以，同时我们需要在oauth2服务器端配置相应的端点。

@RequestMapping(value = "/user", method = RequestMethod.GET)
    public Principal user(Principal user){
        return user;
    }

之后我们测试我们client端的资源请求。只有在携带token的情况下才能够正常得到资源信息。
在这里插入图片描述

猜你喜欢

转载自blog.csdn.net/Ybt_c_index/article/details/85067321
今日推荐
NetBSD 禁止提交由 AI 生成的代码
Apache Doris 2.0.10 版本正式发布！
开源日报 | 大模型开战；大模型独角兽被曝卖身；周鸿祎建议谷歌开源所有产品；最大开源AI社区提供1000万美元共享GPU
开源日报 | Chrome内置Gemini的意义不在于Gemini；中国AI追随之路的五大误区；ECharts创始人“下海”养鱼；谷歌I/O开发者大会什么都有，只是没有惊喜
微软回应中国区AI团队“打包赴美”传闻
基于大语言模型的开源知识库问答系统 MaxKB GitHub Star 数量突破 5,000 个！
周排行
女程序员是这样被恶搞的
B/S 和 C/S 的优缺点
vector一直申请会怎样？
座头鲸识别比赛(Humpback Whale Identification)总结
Linux高性能服务器编程——I/O复用 select
Mysql连接数据库（当包使用）
通过URI获取的文件路径为null的解决方法
1022-Primes on Interval(素数筛选+二分查找) ZCMU
Python出现： TypeError: expected string or buffer
bzoj2434: [Noi2011]阿狸的打字机 ac自动机+树状数组
每日归档
更多
2024-05-18(4)
2024-05-17(34)
2024-05-16(6)
2024-05-15(24)
2024-05-14(0)
2024-05-13(18)
2024-05-12(0)
2024-05-11(38)
2024-05-10(38)
2024-05-09(35)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022