【发布时间】：2018-11-04 01:08:58
【问题描述】：
我在这里遇到了真正的问题，需要您的帮助。我在一家银行工作，并被分配了使用 Spring Boot 实现 OAuth2 服务的任务，我从上周开始一直在探索，并且能够实现密码流授权类型 OAuth2 服务，但现在我有几个问题我的前辈说密码流不适合我们的用例。首先我想解释一下用例：
第 1 步：用户将点击无需登录的 Web 应用程序的应用程序 URL，并且在应用程序加载之前，OAuth2 服务将使用已登录的 AD（系统）用户 ID 命中。
第 2 步。OAuth2 服务应使用具有给定用户 ID 的 ldap 对用户进行身份验证，并返回用户所属的所有组以及访问令牌，之后将用于访问 API
现在我有以下查询：
哪种授权类型最适合我的需要，从我所阅读的授权代码授权类型似乎是合适的？还是隐含的？
根据问题 1 的答案，我需要在以下代码中进行哪些代码更改：
我的授权服务器的代码 sn-p：
Oauth2AuthserverApplication.java
@SpringBootApplication
@EnableAuthorizationServer
public class Oauth2AuthserverApplication {
public static void main(String[] args) {
SpringApplication.run(Oauth2AuthserverApplication.class, args);
}
}
OAuth2Congig.java
@Configuration
public class Oauth2Config extends AuthorizationServerConfigurerAdapter {
private String clientId = "client";
private String clientSecret = "secret";
private String privateKey = "private-key";
private String publicKey = "public-key";
@Autowired
@Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;
@Bean
public JwtAccessTokenConverter tokenEnhancer() {
JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
converter.setSigningKey(privateKey);
converter.setVerifierKey(publicKey);
return converter;
}
@Bean
public JwtTokenStore tokenStore() {
return new JwtTokenStore(tokenEnhancer());
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints)
throws Exception {
endpoints.authenticationManager(authenticationManager).
tokenStore(tokenStore())
.accessTokenConverter(tokenEnhancer());
}
@Override
public void configure(AuthorizationServerSecurityConfigurer security)
throws Exception {
security.tokenKeyAccess("permitAll()").
checkTokenAccess("isAuthenticated()");
}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws
Exception {
clients.inMemory().withClient(clientId).
secret(clientSecret).scopes("read", "write")
.authorizedGrantTypes("password",
"refresh_token").accessTokenValiditySeconds(20000)
.refreshTokenValiditySeconds(20000);
}
}
SecurityConfiguration.java
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
CustomDetailsService customDetailsService;
@Bean
public PasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
@Override
@Autowired
protected void configure(AuthenticationManagerBuilder auth) throws
Exception {
auth.userDetailsService(customDetailsService).
passwordEncoder(encoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().authenticated().
and().sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception
{
return super.authenticationManagerBean();
}
}
不粘贴授权服务器类的模型、dao和服务代码，因为它们与本题无关。
来自资源服务器项目的代码片段：
OAuth2ResourceserverApplication.java
@SpringBootApplication
@EnableResourceServer
@RestController
public class Oauth2ResourceserverApplication {
public static void main(String[] args) {
SpringApplication.run(Oauth2ResourceserverApplication.class, args);
}
@RequestMapping(value="/api")
public String success() {
return "SUCCESS";
}
}
JwtConverter.java
@Component
public class JwtConverter extends DefaultAccessTokenConverter implements
JwtAccessTokenConverterConfigurer {
@Override
public void configure(JwtAccessTokenConverter converter) {
converter.setAccessTokenConverter(this);
}
}
SecurityConfiguration.java
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().authenticated().
and().sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.NEVER);
}
}
application.yml
server:
port: 8081
security:
oauth2:
resource:
filter-order: 3
jwt:
key-value: private-key
【问题讨论】：
标签： java spring-boot spring-security oauth-2.0 spring-security-oauth2