一、引入依赖
需要在基础版之上引入thymeleaf、JDBC、mybatis、mysql等依赖。
1 <!-- thymeleaf --> 2 <dependency> 3 <groupId>org.springframework.boot</groupId> 4 <artifactId>spring-boot-starter-thymeleaf</artifactId> 5 </dependency> 6 <dependency> 7 <groupId>org.thymeleaf.extras</groupId> 8 <artifactId>thymeleaf-extras-springsecurity4</artifactId> 9 </dependency> 10 11 <!-- JDBC --> 12 <dependency> 13 <groupId>org.springframework.boot</groupId> 14 <artifactId>spring-boot-starter-jdbc</artifactId> 15 </dependency> 16 <dependency> 17 <groupId>org.apache.commons</groupId> 18 <artifactId>commons-dbcp2</artifactId> 19 </dependency> 20 21 <!-- Mybatis --> 22 <dependency> 23 <groupId>org.mybatis.spring.boot</groupId> 24 <artifactId>mybatis-spring-boot-starter</artifactId> 25 <version>1.1.1</version> 26 </dependency> 27 28 <!-- MySQL --> 29 <dependency> 30 <groupId>mysql</groupId> 31 <artifactId>mysql-connector-java</artifactId> 32 </dependency>
二、client和token表
View Code
在oauth_client_details表添加数据：
1 INSERT INTO `oauth_client_details` VALUES ('net5ijy', NULL, '123456', 'all,read,write', 'authorization_code,refresh_token,password', NULL, 'ROLE_TRUSTED_CLIENT', 7200, 7200, NULL, NULL);
2 INSERT INTO `oauth_client_details` VALUES ('tencent', NULL, '123456', 'all,read,write', 'authorization_code,refresh_code', NULL, 'ROLE_TRUSTED_CLIENT', 3600, 3600, NULL, NULL);
三、用户、角色表
1 CREATE TABLE `springcloud_user` ( 2 `id` int(11) NOT NULL AUTO_INCREMENT , 3 `username` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL , 4 `password` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL , 5 `phone` varchar(11) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL , 6 `email` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL , 7 `create_time` datetime NOT NULL , 8 PRIMARY KEY (`id`) 9 ) 10 ENGINE=InnoDB 11 DEFAULT CHARACTER SET=utf8 COLLATE=utf8_general_ci 12 AUTO_INCREMENT=1; 13 14 CREATE TABLE `springcloud_role` ( 15 `id` int(11) NOT NULL AUTO_INCREMENT , 16 `name` varchar(100) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL , 17 PRIMARY KEY (`id`) 18 ) 19 ENGINE=InnoDB 20 DEFAULT CHARACTER SET=utf8 COLLATE=utf8_general_ci 21 AUTO_INCREMENT=1; 22 23 CREATE TABLE `springcloud_user_role` ( 24 `user_id` int(11) NOT NULL , 25 `role_id` int(11) NOT NULL , 26 FOREIGN KEY (`role_id`) REFERENCES `springcloud_role` (`id`) ON DELETE RESTRICT ON UPDATE RESTRICT, 27 FOREIGN KEY (`user_id`) REFERENCES `springcloud_user` (`id`) ON DELETE RESTRICT ON UPDATE RESTRICT, 28 INDEX `user_id_fk` USING BTREE (`user_id`) , 29 INDEX `role_id_fk` USING BTREE (`role_id`) 30 ) 31 ENGINE=InnoDB 32 DEFAULT CHARACTER SET=utf8 COLLATE=utf8_general_ci;
用户表添加数据
1 INSERT INTO `springcloud_user` VALUES (1, 'admin001', '$2a$10$sXHKvdufrEfE2900ME40nOSBmeHRRUOF71szu22uaqqL8FIJeJDYW', '13622114309', '[email protected]', '2019-4-7 09:31:07'); 2 INSERT INTO `springcloud_user` VALUES (2, 'admin002', '$2a$10$sXHKvdufrEfE2900ME40nOSBmeHRRUOF71szu22uaqqL8FIJeJDYW', '17809837654', '[email protected]', '2019-4-7 09:33:00');
角色表添加数据
1 INSERT INTO `springcloud_role` VALUES (1, 'ADMIN'); 2 INSERT INTO `springcloud_role` VALUES (2, 'DBA'); 3 INSERT INTO `springcloud_role` VALUES (3, 'USER');
用户角色关系表添加数据
1 INSERT INTO `springcloud_user_role` VALUES (1, 1); 2 INSERT INTO `springcloud_user_role` VALUES (2, 1);
四、实体类和工具类
1、User实体类
封装授权服务器登录用户信息
View Code
2、Role实体类
封装角色信息
1 public class Role implements Serializable {
2
3 private Integer id;
4 private String name;
5
6 public Role() {
7 super();
8 }
9 public Role(String name) {
10 super();
11 this.name = name;
12 }
13
14 // getter & setter
15
16 @Override
17 public String toString() {
18 return "Role [id=" + id + ", name=" + name + "]";
19 }
20 }
3、ResponseMessage工具类
封装接口响应信息
1 public class ResponseMessage {
2
3 private Integer code;
4 private String message;
5
6 public ResponseMessage() {
7 super();
8 }
9
10 public ResponseMessage(Integer code, String message) {
11 super();
12 this.code = code;
13 this.message = message;
14 }
15
16 // getter & setter
17
18 public static ResponseMessage success() {
19 return new ResponseMessage(0, "操作成功");
20 }
21
22 public static ResponseMessage fail() {
23 return new ResponseMessage(99, "操作失败");
24 }
25 }
五、DAO和Service编写
1、数据源配置
在application.properties文件配置datasource
1 spring.datasource.url=jdbc:mysql://localhost:3306/test 2 spring.datasource.username=system 3 spring.datasource.password=123456 4 spring.datasource.driver-class-name=com.mysql.jdbc.Driver 5 6 spring.datasource.type=org.apache.commons.dbcp2.BasicDataSource 7 spring.datasource.dbcp2.initial-size=5 8 spring.datasource.dbcp2.max-active=25 9 spring.datasource.dbcp2.max-idle=10 10 spring.datasource.dbcp2.min-idle=5 11 spring.datasource.dbcp2.max-wait-millis=10000 12 spring.datasource.dbcp2.validation-query=SELECT 1 13 spring.datasource.dbcp2.connection-properties=characterEncoding=utf8
使用dbcp2数据源
2、mapper.xml
在src/main/resources下创建org.net5ijy.oauth2.mapper包，创建user-mapper.xml配置文件
1 <mapper namespace="org.net5ijy.oauth2.repository.UserRepository">
2
3 <resultMap type="User" id="UserResultMap">
4 <result column="id" property="id" jdbcType="INTEGER" javaType="int" />
5 <result column="username" property="username" jdbcType="VARCHAR"
6 javaType="string" />
7 <result column="password" property="password" jdbcType="VARCHAR"
8 javaType="string" />
9 <result column="phone" property="phone" jdbcType="VARCHAR"
10 javaType="string" />
11 <result column="email" property="email" jdbcType="VARCHAR"
12 javaType="string" />
13 <result column="create_time" property="createTime" jdbcType="TIMESTAMP"
14 javaType="java.util.Date" />
15 <collection property="roles" select="selectRolesByUserId"
16 column="id"></collection>
17 </resultMap>
18
19 <!-- 根据用户名查询用户 -->
20 <select id="findByUsername" parameterType="java.lang.String"
21 resultMap="UserResultMap">
22 <![CDATA[
23 select * from springcloud_user where username = #{username}
24 ]]>
25 </select>
26
27 <!-- 根据user id查询用户拥有的role -->
28 <select id="selectRolesByUserId" parameterType="java.lang.Integer"
29 resultType="Role">
30 <![CDATA[
31 select r.id, r.name from springcloud_user_role ur, springcloud_role r
32 where ur.role_id = r.id and ur.user_id = #{id}
33 ]]>
34 </select>
35
36 </mapper>
因为我们的例子只使用了findByUsername功能，所以只写这个sql就可以了
3、DAO接口
1 public interface UserRepository {
2
3 User findByUsername(String username);
4 }
4、UserService
接口
1 public interface UserService {
2
3 User getUser(String username);
4 }
实现类
1 @Service
2 public class UserServiceImpl implements UserService {
3
4 static Logger logger = LoggerFactory.getLogger(UserServiceImpl.class);
5
6 @Autowired
7 private UserRepository userRepository;
8
9 @Autowired
10 private JdbcTemplate jdbcTemplate;
11
12 @Override
13 public User getUser(String username) {
14 return userRepository.findByUsername(username);
15 }
16 }
5、UserDetailsService实现类
这个接口的实现类需要在Security中配置，Security会使用这个类根据用户名查询用户信息，然后进行用户名、密码的验证。主要就是实现loadUserByUsername方法：
1 @Service
2 public class UserDetailsServiceImpl implements UserDetailsService {
3
4 @Autowired
5 private UserService userService;
6
7 @Override
8 public UserDetails loadUserByUsername(String username)
9 throws UsernameNotFoundException {
10
11 User user = userService.getUser(username);
12 if (user == null || user.getId() < 1) {
13 throw new UsernameNotFoundException("Username not found: "
14 + username);
15 }
16
17 return new org.springframework.security.core.userdetails.User(
18 user.getUsername(), user.getPassword(), true, true, true, true,
19 getGrantedAuthorities(user));
20 }
21
22 private Collection<? extends GrantedAuthority> getGrantedAuthorities(
23 User user) {
24 Set<GrantedAuthority> authorities = new HashSet<GrantedAuthority>();
25 for (Role role : user.getRoles()) {
26 authorities
27 .add(new SimpleGrantedAuthority("ROLE_" + role.getName()));
28 }
29 return authorities;
30 }
31 }
六、自定义登录页面
1、controller编写
编写LoginController类，添加login方法
1 @RestController
2 public class LoginController {
3
4 @GetMapping("/login")
5 public ModelAndView login() {
6 return new ModelAndView("login");
7 }
8
9 @GetMapping("/login-error")
10 public ModelAndView loginError(HttpServletRequest request, Model model) {
11 model.addAttribute("loginError", true);
12 model.addAttribute("errorMsg", "登陆失败，账号或者密码错误！");
13 return new ModelAndView("login", "userModel", model);
14 }
15 }
2、页面代码
页面代码使用到了thymeleaf、bootstrap、表单验证等，具体的js、css引入就不赘述了，只记录最主要的内容：
1 <div>
2 <form th:action="@{/login}" method="post">
3 <div>
4 <label>用 户 名: </label>
5 <div>
6 <input name="username" />
7 </div>
8 </div>
9 <div>
10 <label>密　　码: </label>
11 <div>
12 <input type="password" name="password" />
13 </div>
14 </div>
15 <div>
16 <div>
17 <button type="submit"> 登 陆 </button>
18 </div>
19 </div>
20 </form>
21 </div>
七、自定义授权页面
1、controller编写
编写GrantController类，添加getAccessConfirmation方法
1 @Controller
2 @SessionAttributes("authorizationRequest")
3 public class GrantController {
4
5 @RequestMapping("/oauth/confirm_access")
6 public ModelAndView getAccessConfirmation(Map<String, Object> model,
7 HttpServletRequest request) throws Exception {
8
9 AuthorizationRequest authorizationRequest = (AuthorizationRequest) model
10 .get("authorizationRequest");
11
12 ModelAndView view = new ModelAndView("base-grant");
13 view.addObject("clientId", authorizationRequest.getClientId());
14
15 return view;
16 }
17 }
此处获取到申请授权的clientid用于在页面展示
2、页面代码
此处只写最主要的部分
1 <div>
2 <div>
3 <div>OAUTH-BOOT 授权</div>
4 <div>
5 <a href="javascript:;">帮助</a>
6 </div>
7 </div>
8 <h3 th:text="${clientId}+' 请求授权，该应用将获取您的以下信息'"></h3>
9 <p>昵称，头像和性别</p>
10 授权后表明您已同意 <a href="javascript:;" style="color: #E9686B">OAUTH-BOOT 服务协议</a>
11 <form method="post" action="/oauth/authorize">
12 <input type="hidden" name="user_oauth_approval" value="true" />
13 <input type="hidden" name="scope.all" value="true" />
14 <br />
15 <button class="btn" type="submit">同意/授权</button>
16 </form>
17 </div>
八、配置类和application.properties配置
1、配置mybatis
配置SqlSessionFactoryBean
- 设置数据源
- 设置包别名
- 设置mapper映射文件所在的包
1 @Configuration
2 public class MyBatisConfiguration {
3
4 @Bean
5 @Autowired
6 @ConditionalOnMissingBean
7 public SqlSessionFactoryBean sqlSessionFactory(DataSource dataSource)
8 throws IOException {
9
10 SqlSessionFactoryBean sqlSessionFactoryBean = new SqlSessionFactoryBean();
11
12 // 设置数据源
13 sqlSessionFactoryBean.setDataSource(dataSource);
14
15 // 设置别名包
16 sqlSessionFactoryBean.setTypeAliasesPackage("org.net5ijy.oauth2.bean");
17
18 // 设置mapper映射文件所在的包
19 PathMatchingResourcePatternResolver pathMatchingResourcePatternResolver = new PathMatchingResourcePatternResolver();
20 String packageSearchPath = "classpath*:org/net5ijy/oauth2/mapper/**.xml";
21 sqlSessionFactoryBean
22 .setMapperLocations(pathMatchingResourcePatternResolver
23 .getResources(packageSearchPath));
24
25 return sqlSessionFactoryBean;
26 }
27 }
2、配置AuthorizationServerConfigurer
- 配置使用数据库保存cient信息
- 配置使用数据库保存token令牌
- 配置使用数据库保存授权码
1 @Configuration
2 public class Oauth2AuthorizationServerConfiguration extends
3 AuthorizationServerConfigurerAdapter {
4
5 @Autowired
6 private UserDetailsService userDetailsService;
7
8 @Autowired
9 private AuthenticationManager authenticationManager;
10
11 @Autowired
12 private DataSource dataSource;
13
14 @Override
15 public void configure(ClientDetailsServiceConfigurer clients)
16 throws Exception {
17
18 // 数据库管理client
19 clients.withClientDetails(new JdbcClientDetailsService(dataSource));
20 }
21
22 @Override
23 public void configure(AuthorizationServerEndpointsConfigurer endpoints)
24 throws Exception {
25
26 // 用户信息查询服务
27 endpoints.userDetailsService(userDetailsService);
28
29 // 数据库管理access_token和refresh_token
30 TokenStore tokenStore = new JdbcTokenStore(dataSource);
31
32 endpoints.tokenStore(tokenStore);
33
34 ClientDetailsService clientService = new JdbcClientDetailsService(
35 dataSource);
36
37 DefaultTokenServices tokenServices = new DefaultTokenServices();
38 tokenServices.setTokenStore(tokenStore);
39 tokenServices.setSupportRefreshToken(true);
40 tokenServices.setClientDetailsService(clientService);
41 // tokenServices.setAccessTokenValiditySeconds(180);
42 // tokenServices.setRefreshTokenValiditySeconds(180);
43
44 endpoints.tokenServices(tokenServices);
45
46 endpoints.authenticationManager(authenticationManager);
47
48 // 数据库管理授权码
49 endpoints.authorizationCodeServices(new JdbcAuthorizationCodeServices(
50 dataSource));
51 // 数据库管理授权信息
52 ApprovalStore approvalStore = new JdbcApprovalStore(dataSource);
53 endpoints.approvalStore(approvalStore);
54 }
55 }
3、配置security
- 配置使用数据库保存登录用户信息
- 配置自定义登录页面
- 暂时禁用CSRF
1 @EnableWebSecurity
2 public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
3
4 @Autowired
5 private UserDetailsService userDetailsService;
6
7 @Autowired
8 private PasswordEncoder passwordEncoder;
9
10 @Bean
11 public PasswordEncoder passwordEncoder() {
12 return new BCryptPasswordEncoder(); // 使用 BCrypt 加密
13 }
14
15 public AuthenticationProvider authenticationProvider() {
16 DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
17 authenticationProvider.setUserDetailsService(userDetailsService);
18 authenticationProvider.setPasswordEncoder(passwordEncoder);
19 authenticationProvider.setHideUserNotFoundExceptions(false);
20 return authenticationProvider;
21 }
22
23 @Override
24 public void configure(WebSecurity web) throws Exception {
25 web.ignoring().antMatchers("/css/**", "/js/**", "/fonts/**",
26 "/icon/**", "/favicon.ico");
27 }
28
29 @Override
30 protected void configure(HttpSecurity http) throws Exception {
31
32 http.requestMatchers()
33 .antMatchers("/login", "/login-error", "/oauth/authorize",
34 "/oauth/token").and().authorizeRequests()
35 .antMatchers("/login").permitAll().anyRequest().authenticated();
36
37 // 登录页面
38 http.formLogin().loginPage("/login").failureUrl("/login-error");
39
40 // 禁用CSRF
41 http.csrf().disable();
42 }
43
44 @Autowired
45 public void configureGlobal(AuthenticationManagerBuilder auth)
46 throws Exception {
47 auth.userDetailsService(userDetailsService);
48 auth.authenticationProvider(authenticationProvider());
49 }
50
51 public static void main(String[] args) {
52 System.out.println(new BCryptPasswordEncoder().encode("123456"));
53 }
54 }
4、application.properties文件配置
1 server.port=7001 2 3 ##### Built-in DataSource ##### 4 spring.datasource.url=jdbc:mysql://localhost:3306/test 5 spring.datasource.username=system 6 spring.datasource.password=123456 7 spring.datasource.driver-class-name=com.mysql.jdbc.Driver 8 9 spring.datasource.type=org.apache.commons.dbcp2.BasicDataSource 10 spring.datasource.dbcp2.initial-size=5 11 spring.datasource.dbcp2.max-active=25 12 spring.datasource.dbcp2.max-idle=10 13 spring.datasource.dbcp2.min-idle=5 14 spring.datasource.dbcp2.max-wait-millis=10000 15 spring.datasource.dbcp2.validation-query=SELECT 1 16 spring.datasource.dbcp2.connection-properties=characterEncoding=utf8 17 18 ##### Thymeleaf ##### 19 # 编码 20 spring.thymeleaf.encoding=UTF-8 21 # 热部署静态文件 22 spring.thymeleaf.cache=false 23 # 使用HTML5标准 24 spring.thymeleaf.mode=HTML5
九、受保护资源
1 @RestController
2 @RequestMapping(value = "/order")
3 public class TestController {
4
5 Logger log = LoggerFactory.getLogger(TestController.class);
6
7 @RequestMapping(value = "/demo")
8 @ResponseBody
9 public ResponseMessage getDemo() {
10 Authentication auth = SecurityContextHolder.getContext()
11 .getAuthentication();
12 log.info(auth.toString());
13 return ResponseMessage.success();
14 }
15 }
十、应用启动类
1 @SpringBootApplication
2 @EnableAuthorizationServer
3 @EnableResourceServer
4 @MapperScan("org.net5ijy.oauth2.repository")
5 public class Oauth2Application {
6
7 public static void main(String[] args) {
8
9 // args = new String[] { "--debug" };
10
11 SpringApplication.run(Oauth2Application.class, args);
12 }
13 }
十一、测试授权码模式
1、获取authorization_code授权码
使用浏览器访问：
http://localhost:7001/oauth/authorize?response_type=code&client_id=net5ijy&redirect_uri=http://localhost:8080&scope=all
地址
http://localhost:7001/oauth/authorize
参数
|
response_type |
code |
|
client_id |
根据实际的client-id填写，此处写net5ijy |
|
redirect_uri |
生成code后的回调地址，http://localhost:8080 |
|
scope |
权限范围 |
登录，admin001和123456
允许授权
看到浏览器重定向到了http://localhost:8080并携带了code参数，这个code就是授权服务器生成的授权码
2、获取token令牌
使用curl命令获取token令牌
curl --user net5ijy:123456 -X POST -d "grant_type=authorization_code&scope=all&redirect_uri=http%3a%2f%2flocalhost%3a8080&code=ubtvR4" http://localhost:7001/oauth/token
地址
http://localhost:7001/oauth/token
参数
|
grant_type |
授权码模式，写authorization_code |
|
scope |
权限范围 |
|
redirect_uri |
回调地址，http://localhost:8080需要urlencode |
|
code |
就是上一步生成的授权码 |
返回值
1 {
2 "access_token": "c5836918-1924-4b0a-be67-043218c6e7e0",
3 "token_type": "bearer",
4 "refresh_token": "7950b7f9-7d60-41da-9a95-bd2c8b29ada1",
5 "expires_in": 7199,
6 "scope": "all"
7 }
这样就获取到了token令牌，该token的访问权限范围是all权限，在2小时后失效。
3、使用token访问资源
http://localhost:7001/order/demo?access_token=c5836918-1924-4b0a-be67-043218c6e7e0