spring Security4 和 oauth2整合 註解+xml混合使用（授權碼篇）
阿新 • • 發佈：2018-11-27
Spring Security4 和 oauth2整合授權碼模式
上兩篇介紹了環境配置和使用者密碼模式，下面介紹授權碼模式。
git地址：https://gitee.com/xiaoyaofeiyang/OauthUmp
spring Security4 和 oauth2整合 註解+xml混合使用（基礎執行篇）
spring Security4 和 oauth2整合 註解+xml混合使用（進階篇）
spring Security4 和 oauth2整合 註解+xml混合使用（授權碼篇）
spring Security4 和 oauth2整合 註解+xml混合使用（注意事項篇）
spring Security4 和 oauth2整合 註解+xml混合使用（替換6位的授權碼）
spring Security4 和 oauth2整合 註解+xml混合使用（替換使用者名稱密碼認證）
spring Security4 和 oauth2整合 註解+xml混合使用（驗證碼等額外資料驗證）
OAuth2SecurityConfiguration
授權碼模式需要對OAuth2SecurityConfiguration進行一些配置，對跳轉的url做限制。
package com.ump.test.oauth;
import org.springframework.beans authlogin.jsp
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<%@ page language="java" pageEncoding="UTF-8"%>
<head>
<%
String baseUrl = request.getContextPath();
%>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<script type="text/javascript" src="<%=baseUrl%>/js/jquery-3.2.1.min.js"></script>
<title>SkyNet</title>
</head>
<script type="text/javascript">
function ajaxTest() {
var type = "1";
$.ajax({
type : "post",
url : "<%=baseUrl%>/test/welCome",
dataType : "json",
data : {reqType : type} ,
success : function(data) {
$("#div1").html(data.uuid + "<br>" +
data.welMsg + "<br>"+
data.dateTime);
},
error : function(XMLHttpRequest, textStatus, errorThrown) {
alert(errorThrown);
}
});
}
</script>
<body>
這裡是htm1
<div id="div1"></div>
<button type="button" onclick="ajaxTest()">Welcome</button>
<form action="<%=baseUrl%>/login" method="post">
First name:<br>
<input type="text" name="userName">
<br>
Last name:<br>
<input type="text" name="userPwd">
<input type="submit" value="Submit" />
</form>
<script type="text/javascript">
$(document).ready(function() {
$("#div1").html("呵呵");
});
</script>
</body>
</html>
加上前面兩篇的測試頁面，這樣授權碼模式就可以了。不過還有個問題，就是授權碼的client_id必須用baseauth的方式去寫，不能直接寫在連結裡，這就很煩人。想寫在連結裡，很簡單，AuthorizationServerConfiguration加上一句oauthServer.allowFormAuthenticationForClients();即可。
package com.ump.test.oauth;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.ClientDetailsService;
import org.springframework.security.oauth2.provider.approval.UserApprovalHandler;
import org.springframework.security.oauth2.provider.token.TokenStore;
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
private static String REALM = "MY_OAUTH_REALM";
@Autowired
private TokenStore tokenStore;
@Autowired
@Qualifier("myClientDetailsService")
private ClientDetailsService clientDetailsService;
@Autowired
private UserApprovalHandler userApprovalHandler;
@Autowired
@Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.withClientDetails(clientDetailsService);
// clients.inMemory().withClient("my-trusted-client")
// .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
// .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT").scopes("read", "write", "trust").secret("secret")
// .accessTokenValiditySeconds(120)
// .refreshTokenValiditySeconds(600);
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
.authenticationManager(authenticationManager);
}
@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
oauthServer.allowFormAuthenticationForClients();
oauthServer.realm(REALM + "/client");
}
}
自定義授權頁面
oauth2的授權頁面太醜了，可以考慮改一下，找個最簡單的方案即可。我這裡頁面跟它類似，也很醜，就是copy它的，做個示範。
package com.ump.test.oauth;
import java.util.Map;
import javax.servlet.http.HttpServletRequest;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.SessionAttributes;
@Controller
@SessionAttributes("authorizationRequest")
public class OAuth2ApprovalController {
@RequestMapping("/oauth/confirm_access")
public String getAccessConfirmation(Map<String, Object> model, HttpServletRequest request) throws Exception {
return "/user/oauth_approval.jsp";
}
}
oauth_approval.jsp
<%@ page language="java" pageEncoding="UTF-8"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>授權</title>
</head>
<body>
<h1>自定義 Approval</h1>
<p>這是我自己的，怎麼樣？</p>
<form id='confirmationForm' name='confirmationForm'
action='/oauth/authorize' method='post'>
<input name='user_oauth_approval' value='true' type='hidden' /><label><input
name='authorize' value='Authorize' type='submit' /></label>
</form>
<form id='denialForm' name='denialForm' action='/oauth/authorize'
method='post'>
<input name='user_oauth_approval' value='false' type='hidden' /><label><input
name='deny' value='Deny' type='submit' /></label>
</form>
</body>
</html>可以咯，下一篇寫個注意事項。