# Spring-cloud-auth-learning **Repository Path**: li_VillageHead/spring-cloud-auth-learning ## Basic Information - **Project Name**: Spring-cloud-auth-learning - **Description**: 权限框架搭建和认证学习 - **Primary Language**: Unknown - **License**: Not specified - **Default Branch**: master - **Homepage**: None - **GVP Project**: No ## Statistics - **Stars**: 1 - **Forks**: 0 - **Created**: 2024-07-01 - **Last Updated**: 2026-03-25 ## Categories & Tags **Categories**: Uncategorized **Tags**: Java ## README ## SpringBoot 最新版3.x 集成 OAuth 2.0 实现认证授权服务、第三方应用客户端以及资源服务... https://gitee.com/wang-bata/springboot-oauth2-server 前言 Spring Boot 3已经发布一段时间，网上关于Spring Boot 3的资料不是很多，本着对新技术的热情，学习和研究了大量Spring Boot 3新功能和新特性，感兴趣的同学可以参考Spring官方资料全面详细的新功能/新改进介绍 * Spring版本升级到6.x * JDK版本至少17+ 新特性有很多，本文主要针对[OAuth](https://so.csdn.net/so/search?q=OAuth&spm=1001.2101.3001.7020) 2.0的集成，如果快速开发自己的认证授权服务、OAuth客户端以及资源服务 环境介绍 | 组件依赖 | 版本 | | -------------------- | -------- | | Spring Boot | 3.0 | | Spring Cloud alibaba | 2022.0.0 | | Spring Cloud | | ## 端口说明 新建三个服务，分别对应认证授权服务、OAuth客户端及资源服务 | 服务 | 端口 | | --------------- | ---- | | 认证授权服务 | 8080 | | Oauth客户端服务 | 8081 | | 资源服务 | 8082 | ## 认证授权服务 maven pom.xml依赖 ```xml dependencies> org.springframework.boot spring-boot-starter-security org.springframework.security spring-security-oauth2-authorization-server ${spring-security-oauth2-authorization-server.version} org.springframework.boot spring-boot-starter-web org.springframework.security spring-security-test test ``` ## 默认yml配置 ```yaml server: port: 8080 spring: security: user: name: user password: password oauth2: authorizationserver: client: oidc-client: registration: client-id: "oidc-client" client-secret: "{noop}secret" client-authentication-methods: - "client_secret_basic" authorization-grant-types: - "authorization_code" - "refresh_token" redirect-uris: - "http://127.0.0.1:8080/login/oauth2/code/oidc-client" - "http://127.0.0.1:8080/authorized" post-logout-redirect-uris: - "http://127.0.0.1:8080/" scopes: - "openid" - "profile" - "message.read" - "message.write" require-authorization-consent: true ``` ## 新建`Oauth2ServerAutoConfiguration`类 如果要自定义默认配置（无论是否使用 Spring Boot），可以在 Spring 中将所需的最小组件定义为 .`@Bean``@Configuration` 这些组件可以定义如下： ```java package com.mate.cloud.authclient.config; import com.nimbusds.jose.jwk.JWKSet; import com.nimbusds.jose.jwk.RSAKey; import com.nimbusds.jose.jwk.source.ImmutableJWKSet; import com.nimbusds.jose.jwk.source.JWKSource; import com.nimbusds.jose.proc.SecurityContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.annotation.Order; import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.oauth2.core.AuthorizationGrantType; import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.oidc.OidcScopes; import org.springframework.security.oauth2.jwt.JwtDecoder; import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository; import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository; import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration; import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer; import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings; import org.springframework.security.oauth2.server.authorization.settings.ClientSettings; import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import java.security.KeyPair; import java.security.KeyPairGenerator; import java.security.interfaces.RSAPrivateKey; import java.security.interfaces.RSAPublicKey; import java.util.UUID; /** * Oauth2ServerAutoConfiguration类 * * @author: MI * @email: 448341911@qq.com * @createTime: 2024/6/14 18:11 * @updateUser: MI * @updateTime: 2024/6/14 18:11 * @updateRemark: 修改内容 * @version: v1.0 */ @Configuration public class Oauth2ServerAutoConfiguration { @Bean @Order(1) public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception { OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http); http.getConfigurer(OAuth2AuthorizationServerConfigurer.class) .oidc(Customizer.withDefaults()); // Enable OpenID Connect 1.0 http // Redirect to the login page when not authenticated from the // authorization endpoint .exceptionHandling((exceptions) -> exceptions .authenticationEntryPoint( new LoginUrlAuthenticationEntryPoint("/login")) ) // Accept access tokens for User Info and/or Client Registration .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt); return http.build(); } @Bean @Order(2) public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception { http .authorizeHttpRequests((authorize) -> authorize .requestMatchers(new AntPathRequestMatcher("/actuator/**"), new AntPathRequestMatcher("/oauth2/**"), new AntPathRequestMatcher("/**/*.json"), new AntPathRequestMatcher("/**/*.html")).permitAll() .anyRequest().authenticated() ) // Form login handles the redirect to the login page from the // authorization server filter chain .formLogin(Customizer.withDefaults()); return http.build(); } @Bean public UserDetailsService userDetailsService() { UserDetails userDetails = User.withDefaultPasswordEncoder() .username("test") .password("test") .roles("USER") .build(); return new InMemoryUserDetailsManager(userDetails); } @Bean public RegisteredClientRepository registeredClientRepository() { RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString()) .clientId("demo-client-id") .clientSecret("{noop}demo-client-secret") .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC) .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE) .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) // .tokenSettings(TokenSettings.builder().accessTokenFormat(OAuth2TokenFormat.REFERENCE).build()) .redirectUri("http://127.0.0.1:8081/login/oauth2/code/client-id-1") .redirectUri("http://127.0.0.1:8081/login/oauth2/code/client-id-2") .scope(OidcScopes.OPENID) .scope(OidcScopes.PROFILE) .scope("message.read") .scope("message.write") .scope("user_info") .scope("pull_requests") // 登录成功后对scope进行确认授权 .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build()) .build(); return new InMemoryRegisteredClientRepository(registeredClient); } @Bean public JWKSource jwkSource() { KeyPair keyPair = generateRsaKey(); RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic(); RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate(); RSAKey rsaKey = new RSAKey.Builder(publicKey) .privateKey(privateKey) .keyID(UUID.randomUUID().toString()) .build(); JWKSet jwkSet = new JWKSet(rsaKey); return new ImmutableJWKSet<>(jwkSet); } private static KeyPair generateRsaKey() { KeyPair keyPair; try { KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA"); keyPairGenerator.initialize(2048); keyPair = keyPairGenerator.generateKeyPair(); } catch (Exception ex) { throw new IllegalStateException(ex); } return keyPair; } @Bean public JwtDecoder jwtDecoder(JWKSource jwkSource) { return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource); } @Bean public AuthorizationServerSettings authorizationServerSettings() { return AuthorizationServerSettings.builder().build(); } } ``` ## 第三方应用Oauth客户端 maven pom.xml依赖 ```xml ``` https://docs.spring.io/spring-authorization-server/reference/getting-started.html https://blog.csdn.net/yu619251940/article/details/130768196 https://blog.csdn.net/weixin_36380516/article/details/131160411 [SpringBoot 最新版3.x 集成 OAuth 2.0 实现认证授权服务、第三方应用客户端以及资源服务...-CSDN博客](https://blog.csdn.net/weixin_36380516/article/details/131160411)