1
<dependency>
2
    <groupId>org.springframework.cloud</groupId>
3
    <artifactId>spring-cloud-starter-oauth2</artifactId>
4
    <version>2.1.0.RELEASE</version>
5
</dependency>

1
<?xml version="1.0" encoding="UTF-8"?>
2
<project xmlns="http://maven.apache.org/POM/4.0.0"
3
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5
    <parent>
6
        <artifactId>springboot_security_oauth</artifactId>
7
        <groupId>com.itheima</groupId>
8
        <version>1.0-SNAPSHOT</version>
9
    </parent>
10
    <modelVersion>4.0.0</modelVersion>
11
    <artifactId>heima_oauth_source</artifactId>
12
    <dependencies>
13
        <dependency>
14
            <groupId>org.springframework.boot</groupId>
15
            <artifactId>spring-boot-starter-web</artifactId>
16
        </dependency>
17
        <dependency>
18
            <groupId>org.springframework.boot</groupId>
19
            <artifactId>spring-boot-starter-security</artifactId>
20
        </dependency>
21
        <dependency>
22
            <groupId>org.springframework.cloud</groupId>
23
            <artifactId>spring-cloud-starter-oauth2</artifactId>
24
            <version>2.1.0.RELEASE</version>
25
        </dependency>
26
        <dependency>
27
            <groupId>mysql</groupId>
28
            <artifactId>mysql-connector-java</artifactId>
29
            <version>5.1.47</version>
30
        </dependency>
31
        <dependency>
32
            <groupId>org.mybatis.spring.boot</groupId>
33
            <artifactId>mybatis-spring-boot-starter</artifactId>
34
            <version>2.1.0</version>
35
        </dependency>
36
    </dependencies>
37
</project>

1
server:
2
  port: 9002
3
spring:
4
  datasource:
5
    driver-class-name: com.mysql.jdbc.Driver
6
    url: jdbc:mysql:///security_authority
7
    username: root
8
    password: root
9
  main:
10
    allow-bean-definition-overriding: true #允许我们自己覆盖spring放入到IOC容器的对象
11
mybatis:
12
  type-aliases-package: com.itheima.domain
13
  configuration:
14
    map-underscore-to-camel-case: true
15
logging:
16
  level:
17
    com.itheima: debug

1
@SpringBootApplication
2
@MapperScan("com.itheima.mapper")
3
public class OauthSourceApplication {
4
    public static void main(String[] args) {
5
        SpringApplication.run(OauthSourceApplication.class, args);
6
    }
7
}

1
@RestController
2
@RequestMapping("/product")
3
public class ProductController {
4

5
    @GetMapping("/findAll")
6
    public String findAll(){
7
        return "产品列表查询成功！";
8
    }
9
}

1
public class SysRole implements GrantedAuthority {
2

3
    private Integer id;
4
    private String roleName;
5
    private String roleDesc;
6
}

1
public class SysUser implements UserDetails {
2

3
    private Integer id;
4
    private String username;
5
    private String password;
6
    private Integer status;
7
    private List<SysRole> roles;
8
}

1
@Configuration
2
@EnableResourceServer
3
public class OauthSourceConfig extends ResourceServerConfigurerAdapter {
4

5
    // 只要配置了数据库的配置，就会将DataSource放入到IOC容器中
6
    @Autowired
7
    private DataSource dataSource;
8

9
    /**
10
     * 指定token的持久化策略
11
     * InMemoryTokenStore表示将token存储在内存
12
     * Redis表示将token存储在redis中
13
     * JdbcTokenStore存储在数据库中
14
     * @return
15
     */
16
    @Bean
17
    public TokenStore jdbcTokenStore(){
18
        return new JdbcTokenStore(dataSource);
19
    }
20

21
    /**
22
     * 指定当前资源的id和存储方案
23
     * @param resources
24
     * @throws Exception
25
     */
26
    @Override
27
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
28
        // 也就是当前资源服务的id
29
        resources.resourceId("product_api").tokenStore(jdbcTokenStore());
30
    }
31

32
    @Override
33
    public void configure(HttpSecurity http) throws Exception{
34
        http.authorizeRequests()
35
                //指定不同请求方式访问资源所需要的权限，一般查询是read，其余是write。
36
                .antMatchers(HttpMethod.GET, "/**").access("#oauth2.hasScope('read')")
37
                .antMatchers(HttpMethod.POST, "/**").access("#oauth2.hasScope('write')")
38
                .antMatchers(HttpMethod.PATCH, "/**").access("#oauth2.hasScope('write')")
39
                .antMatchers(HttpMethod.PUT, "/**").access("#oauth2.hasScope('write')")
40
                .antMatchers(HttpMethod.DELETE, "/**").access("#oauth2.hasScope('write')")
41
                .and()
42
                .headers().addHeaderWriter((request, response) -> {
43
            //允许跨域
44
            response.addHeader("Access-Control-Allow-Origin", "*");
45
            //如果是跨域的预检请求，则原封不动向下传达请求头信息
46
            if (request.getMethod().equals("OPTIONS")) {
47
                response.setHeader("Access-Control-Allow-Methods", request.getHeader("Access-Control-Request-Method"));
48
                response.setHeader("Access-Control-Allow-Headers", request.getHeader("Access-Control-Request-Headers"));
49
            }
50
        });
51
    }
52
}

1
<?xml version="1.0" encoding="UTF-8"?>
2
<project xmlns="http://maven.apache.org/POM/4.0.0"
3
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5
    <parent>
6
        <artifactId>springboot_security_oauth</artifactId>
7
        <groupId>com.itheima</groupId>
8
        <version>1.0-SNAPSHOT</version>
9
    </parent>
10
    <modelVersion>4.0.0</modelVersion>
11

12
    <artifactId>heima_oauth_server</artifactId>
13

14
    <dependencies>
15
        <dependency>
16
            <groupId>org.springframework.boot</groupId>
17
            <artifactId>spring-boot-starter-web</artifactId>
18
        </dependency>
19
        <dependency>
20
            <groupId>org.springframework.boot</groupId>
21
            <artifactId>spring-boot-starter-security</artifactId>
22
        </dependency>
23
        <dependency>
24
            <groupId>org.springframework.cloud</groupId>
25
            <artifactId>spring-cloud-starter-oauth2</artifactId>
26
            <version>2.1.0.RELEASE</version>
27
        </dependency>
28
        <dependency>
29
            <groupId>mysql</groupId>
30
            <artifactId>mysql-connector-java</artifactId>
31
            <version>5.1.47</version>
32
        </dependency>
33
        <dependency>
34
            <groupId>org.mybatis.spring.boot</groupId>
35
            <artifactId>mybatis-spring-boot-starter</artifactId>
36
            <version>2.1.0</version>
37
        </dependency>
38
    </dependencies>
39
</project>

1
server:
2
  port: 9001
3
spring:
4
  datasource:
5
    driver-class-name: com.mysql.jdbc.Driver
6
    url: jdbc:mysql:///security_authority
7
    username: root
8
    password: root
9
  main:
10
    allow-bean-definition-overriding: true
11
mybatis:
12
  type-aliases-package: com.itheima.domain
13
  configuration:
14
    map-underscore-to-camel-case: true
15
logging:
16
  level:
17
    com.itheima: debug

1
@SpringBootApplication
2
@MapperScan("com.itheima.mapper")
3
public class OauthServerApplication {
4
    public static void main(String[] args) {
5
        SpringApplication.run(OauthServerApplication.class, args);
6
    }
7
}

1
@Configuration
2
@EnableWebSecurity
3
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
4

5
    @Autowired
6
    private UserService userService;
7

8
    @Bean
9
    public BCryptPasswordEncoder passwordEncoder(){
10
        return new BCryptPasswordEncoder();
11
    }
12

13
    @Override
14
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
15
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder());
16
    }
17

18
    @Override
19
    protected void configure(HttpSecurity http) throws Exception {
20
        http.authorizeRequests()
21
                .anyRequest().authenticated()
22
                .and()
23
                .formLogin()
24
                .loginProcessingUrl("/login")
25
              // 允许匿名访问
26
                .permitAll()
27
                .and()
28
                .csrf()
29
                .disable();
30
    }
31

32
    //AuthenticationManager对象在OAuth2认证服务中要使用，提前放入IOC容器中【授权码模式使用】
33
    @Override
34
    @Bean
35
    public AuthenticationManager authenticationManagerBean() throws Exception {
36
        return super.authenticationManagerBean();
37
    }
38
}

1
@Configuration
2
@EnableAuthorizationServer
3
public class OauthServerConfig extends AuthorizationServerConfigurerAdapter {
4

5
    //数据库连接池对象
6
    @Autowired
7
    private DataSource dataSource;
8

9
    //认证业务对象
10
    @Autowired
11
    private UserService userService;
12

13
    //授权模式专用对象
14
    @Autowired
15
    private AuthenticationManager authenticationManager;
16

17
    //客户端信息来源
18
    @Bean
19
    public JdbcClientDetailsService jdbcClientDetailsService(){
20
        return new JdbcClientDetailsService(dataSource);
21
    }
22

23
    //token保存策略
24
    @Bean
25
    public TokenStore tokenStore(){
26
        return new JdbcTokenStore(dataSource);
27
    }
28

29
    //授权信息保存策略
30
    @Bean
31
    public ApprovalStore approvalStore(){
32
        return new JdbcApprovalStore(dataSource);
33
    }
34

35
    //授权码模式数据来源
36
    @Bean
37
    public AuthorizationCodeServices authorizationCodeServices(){
38
        return new JdbcAuthorizationCodeServices(dataSource);
39
    }
40

41
    //指定客户端信息的数据库来源
42
    @Override
43
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
44
        clients.withClientDetails(jdbcClientDetailsService());
45
    }
46

47
    //检查token的策略
48
    @Override
49
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
50
        security.allowFormAuthenticationForClients();
51
        security.checkTokenAccess("isAuthenticated()");
52
    }
53

54
    //OAuth2的主配置信息
55
    @Override
56
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
57
        endpoints
58
                .approvalStore(approvalStore())
59
                .authenticationManager(authenticationManager)
60
                .authorizationCodeServices(authorizationCodeServices())
61
                .tokenStore(tokenStore());
62
    }
63
}

1
INSERT INTO `oauth_client_details` (`client_id`,`resource_ids`,`client_secret`,`scope`,`authorized_grant_types`,`web_server_redirect_uri`,`authorities`,`access_token_validity`,`refresh_token_validity`,`additional_information`,`autoapprove`) VALUES
2
('heima_one','product_api','$2a$10$CYX9OMv0yO8wR8rE19N2fOaXDJondci5uR68k2eQJm50q8ESsDMlC','read, write','client_credentials,implicit,authorization_code,refresh_token,password','http://www.baidu.com',NULL,NULL,NULL,NULL,'false');