了解 Spring Boot 的 Oauth2 启动器

Question

我开始研究 Oauth2 入门项目和最小配置。

https://github.com/spring-projects/spring-security-oauth/blob/master/tests/annotation/jdbc/src/main/java/demo/Application.java

所有示例都在内存配置或 jdbc 配置中用于存储客户端角色（例如 ClientDetailsS​​erviceConfigurer）。在我的情况下，详细信息应该在 LDAP 中。所以我有两个问题。

1. 如何覆盖默认转到 ldap 而不是内存或 jdbc。
2. 一般来说，如何解开 Spring Boot 线程并阅读入门源代码以及如何更改默认配置？我所看到的只是一个高级注释。

org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer

Spring Boot 中的这种间接性使其极难遵循，而且文档不足也无济于事。或者也许我错过了什么？

谢谢！！！这一直困扰着我一段时间。

Answer 1

要使用 LDAP 实现 Oauth2，您可以按照以下教程进行操作：https://raymondhlee.wordpress.com/2015/12/05/oauth2-authorization-server-with-spring-security。 你也可以看看这个其他问题：spring-security-oauth2 2.0.7 refresh token UserDetailsService Configuration - UserDetailsService is required

---

至于您的另一个问题“我想关注请求并查看调用哪些组件以及何时调用”：我建议您添加日志记录。

(1) 在每个方法中添加日志记录

(2) 设置application.properties中安全包的日志级别：

logging.level.org.springframework.security=DEBUG

(3) 添加CommonsRequestLoggingFilter:

@Bean
public CommonsRequestLoggingFilter requestLoggingFilter() {
    LOGGER.info("Creating CommonsRequestLoggingFilter");
    CommonsRequestLoggingFilter crlf = new CommonsRequestLoggingFilter();
    crlf.setIncludeClientInfo(true);
    crlf.setIncludeQueryString(true);
    crlf.setIncludePayload(true);
    return crlf;
}

(4) 为 CommonsRequestLoggingFilter 添加日志级别（在 application.properties 中）：

logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter=DEBUG

---

对于 OAuth/LDAP 教程，以下是值得注意的部分（引自 https://raymondhlee.wordpress.com/2015/12/05/oauth2-authorization-server-with-spring-security）：

授权服务器配置下面是我的实现 授权服务器配置适配器。 JDBC 的数据库模式 可以在此处找到客户端详细信息和令牌服务。

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
     @Autowired
     private AuthenticationManager authenticationManager;
     @Autowired
     private DataSource dataSource;
     @Override
     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
          endpoints.tokenStore(new JdbcTokenStore(dataSource)).authenticationManager(authenticationManager);
     }
     @Override
     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.jdbc(dataSource);
      }
 }

登录安全配置 下面是安全配置 处理用户授权。

@Configuration
@Order(Ordered.HIGHEST_PRECEDENCE) // note 1
public class LoginConfig extends WebSecurityConfigurerAdapter {

      @Value("${ldap.domain}")
      private String DOMAIN;

      @Value("${ldap.url}")
      private String URL;

      @Override
      protected void configure(HttpSecurity http) throws Exception {
           http.requiresChannel().anyRequest().requiresSecure();

           // Only requests matching regex are handled by this security configurer
           http.requestMatchers().regexMatchers("/login", "/login.+", "/oauth/.+", "/j_spring_security_check", "/logout"); //

           AuthenticationEntryPoint entryPoint = entryPoint();
           http.exceptionHandling().authenticationEntryPoint(entryPoint);
           http.formLogin(); // note 3i
           http.addFilter(usernamePasswordAuthenticationFilter());
           http.authorizeRequests().antMatchers("/login").permitAll();
           http.authorizeRequests().antMatchers("/oauth/**").authenticated();
           http.authorizeRequests().antMatchers("/j_spring_security_check").anonymous().and().csrf().disable();

      }

      @Override
      protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception { // note 4
           authManagerBuilder.parentAuthenticationManager(authenticationManager());
      }

      protected AuthenticationManager authenticationManager() {
           return new ProviderManager(Arrays.asList(activeDirectoryLdapAuthenticationProvider()));
      }

      public AuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
           ActiveDirectoryLdapAuthenticationProvider provider = new ActiveDirectoryLdapAuthenticationProvider(DOMAIN, URL);
           provider.setConvertSubErrorCodesToExceptions(true);
           provider.setUseAuthenticationRequestCredentials(true);
           return provider;
      }

      private AuthenticationEntryPoint entryPoint() {
           return new LoginUrlAuthenticationEntryPoint("/login"); 
      }

      private UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter() {
           UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter();
           filter.setAuthenticationManager(authenticationManager();
           AuthenticationFailureHandler failureHandler = new SimpleUrlAuthenticationFailureHandler("/login?login_error=true");
           filter.setAuthenticationFailureHandler(failureHandler);
           return filter;
      }
}