\n| \n \u7b80\u5316\u6a21\u5f0f<\/p>\n<\/td>\n | \n \u7eaf\u524d\u7aef\u5e94\u7528（\u65e0\u540e\u7aef）<\/p>\n<\/td>\n | \n \u4f4e<\/p>\n<\/td>\n | \n \u2605\u2606\u2606\u2606\u2606<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u4eca\u5929\u7684\u5b9e\u6218\u76ee\u6807：\u6211\u4eec\u8981\u642d\u5efa\u4e00\u4e2a\u5b8c\u6574\u7684 OAuth2.0 \u7cfb\u7edf，\u5305\u62ec：<\/p>\n \n1. \u6388\u6743\u670d\u52a1\u5668（Authorization Server）- \u8d1f\u8d23\u9881\u53d1 Token<\/p>\n<\/li>\n \n2. \u8d44\u6e90\u670d\u52a1\u5668（Resource Server）- \u8d1f\u8d23\u9a8c\u8bc1 Token \u5e76\u8fd4\u56de\u8d44\u6e90<\/p>\n<\/li>\n \n3. \u5ba2\u6237\u7aef\u5e94\u7528（Client Application）- \u83b7\u53d6 Token \u5e76\u8bbf\u95ee\u8d44\u6e90<\/p>\n<\/li>\n
\n\u4e8c\u3001\u9879\u76ee\u521d\u59cb\u5316\u4e0e\u73af\u5883\u51c6\u5907<\/h3>\n2.1 \u521b\u5efa SpringBoot \u9879\u76ee<\/h4>\n\u4f7f\u7528 Spring Initializr \u521b\u5efa\u9879\u76ee，\u9009\u62e9\u4ee5\u4e0b\u4f9d\u8d56：<\/p>\n <dependencies>
\n\u00a0 \u00a0\u00a0<!– SpringBoot Web –>
\n\u00a0 \u00a0\u00a0<dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<groupId>org.springframework.boot<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<artifactId>spring-boot-starter-web<\/artifactId>
\n\u00a0 \u00a0\u00a0<\/dependency>
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0<!– OAuth2 \u6388\u6743\u670d\u52a1\u5668 –>
\n\u00a0 \u00a0\u00a0<dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<groupId>org.springframework.boot<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<artifactId>spring-boot-starter-oauth2-authorization-server<\/artifactId>
\n\u00a0 \u00a0\u00a0<\/dependency>
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0<!– OAuth2 \u8d44\u6e90\u670d\u52a1\u5668 –>
\n\u00a0 \u00a0\u00a0<dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<groupId>org.springframework.boot<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<artifactId>spring-boot-starter-oauth2-resource-server<\/artifactId>
\n\u00a0 \u00a0\u00a0<\/dependency>
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0<!– \u6570\u636e\u5e93\u76f8\u5173（\u5b58\u50a8\u5ba2\u6237\u7aef\u4fe1\u606f\u548c\u7528\u6237\u4fe1\u606f） –>
\n\u00a0 \u00a0\u00a0<dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<groupId>org.springframework.boot<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<artifactId>spring-boot-starter-data-jpa<\/artifactId>
\n\u00a0 \u00a0\u00a0<\/dependency>
\n\u00a0 \u00a0\u00a0<dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<groupId>com.mysql<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<artifactId>mysql-connector-j<\/artifactId>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<scope>runtime<\/scope>
\n\u00a0 \u00a0\u00a0<\/dependency>
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0<!– \u5de5\u5177\u7c7b –>
\n\u00a0 \u00a0\u00a0<dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<groupId>org.projectlombok<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<artifactId>lombok<\/artifactId>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<optional>true<\/optional>
\n\u00a0 \u00a0\u00a0<\/dependency>
\n<\/dependencies><\/p>\n 2.2 \u6570\u636e\u5e93\u914d\u7f6e<\/h4>\n# application.yml
\nspring:
\n\u00a0\u00a0datasource:
\n\u00a0 \u00a0\u00a0url:\u00a0jdbc:mysql:\/\/localhost:3306\/oauth2_demo?useSSL=false&serverTimezone=UTC
\n\u00a0 \u00a0\u00a0username:\u00a0root
\n\u00a0 \u00a0\u00a0password:\u00a0123456
\n\u00a0 \u00a0\u00a0driver-class-name:\u00a0com.mysql.cj.jdbc.Driver
\n\u00a0 \u00a0\u00a0
\n\u00a0\u00a0jpa:
\n\u00a0 \u00a0\u00a0hibernate:
\n\u00a0 \u00a0 \u00a0\u00a0ddl-auto:\u00a0update
\n\u00a0 \u00a0\u00a0show-sql:\u00a0true
\n\u00a0 \u00a0\u00a0properties:
\n\u00a0 \u00a0 \u00a0\u00a0hibernate:
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0dialect:\u00a0org.hibernate.dialect.MySQL8Dialect
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\nserver:
\n\u00a0\u00a0port:\u00a08080<\/p>\n
\n\u4e09\u3001\u6388\u6743\u670d\u52a1\u5668\u5b9e\u73b0<\/h3>\n3.1 \u6388\u6743\u670d\u52a1\u5668\u914d\u7f6e\u7c7b<\/h4>\n\u6388\u6743\u670d\u52a1\u5668\u662f\u6574\u4e2a OAuth2.0 \u4f53\u7cfb\u7684\u6838\u5fc3，\u8d1f\u8d23\u7ba1\u7406\u5ba2\u6237\u7aef\u3001\u7528\u6237\u8ba4\u8bc1\u548c Token \u9881\u53d1\u3002<\/p>\n @Configuration
\n@EnableWebSecurity
\npublic\u00a0class\u00a0AuthorizationServerConfig\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u914d\u7f6e Spring Security
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0@Order(1)
\n\u00a0 \u00a0\u00a0public\u00a0SecurityFilterChain\u00a0authorizationServerSecurityFilterChain(HttpSecurity http)\u00a0throws\u00a0Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0http
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u5141\u8bb8\u8ba4\u8bc1\u7aef\u70b9\u8868\u5355\u63d0\u4ea4
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .formLogin(Customizer.withDefaults())
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .build();
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u914d\u7f6e\u6388\u6743\u670d\u52a1\u5668
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0RegisteredClientRepository\u00a0registeredClientRepository()\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u521b\u5efa\u4e00\u4e2a\u5ba2\u6237\u7aef\u6ce8\u518c\u4fe1\u606f
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0RegisteredClient\u00a0client\u00a0=\u00a0RegisteredClient.withId(UUID.randomUUID().toString())
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .clientId("my-client") \u00a0\/\/ \u5ba2\u6237\u7aefID
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .clientSecret("{noop}my-secret") \u00a0\/\/ \u5ba2\u6237\u7aef\u5bc6\u94a5，{noop}\u8868\u793a\u4e0d\u52a0\u5bc6
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC) \u00a0\/\/ \u8ba4\u8bc1\u65b9\u5f0f
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE) \u00a0\/\/ \u6388\u6743\u7801\u6a21\u5f0f
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) \u00a0\/\/ \u652f\u6301\u5237\u65b0Token
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) \u00a0\/\/ \u5ba2\u6237\u7aef\u51ed\u8bc1\u6a21\u5f0f
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .redirectUri("http:\/\/127.0.0.1:8080\/login\/oauth2\/code\/my-client") \u00a0\/\/ \u56de\u8c03\u5730\u5740
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .redirectUri("http:\/\/127.0.0.1:8080\/authorized") \u00a0\/\/ \u6388\u6743\u540e\u7684\u56de\u8c03
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .scope(OidcScopes.OPENID) \u00a0\/\/ OpenID Connect \u652f\u6301
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .scope("read") \u00a0\/\/ \u81ea\u5b9a\u4e49scope
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .scope("write")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .clientSettings(ClientSettings.builder()
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .requireAuthorizationConsent(true) \u00a0\/\/ \u9700\u8981\u7528\u6237\u6388\u6743\u786e\u8ba4
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .build())
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .build();
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u53ef\u4ee5\u6ce8\u518c\u591a\u4e2a\u5ba2\u6237\u7aef
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0new\u00a0InMemoryRegisteredClientRepository(client);
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u914d\u7f6e JWK Source（\u7528\u4e8eJWT\u7b7e\u540d）
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0JWKSource<SecurityContext>\u00a0jwkSource()\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0RSAKey\u00a0rsaKey\u00a0=\u00a0generateRsa();
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0JWKSet\u00a0jwkSet\u00a0=\u00a0new\u00a0JWKSet(rsaKey);
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0(jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0static\u00a0RSAKey\u00a0generateRsa()\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0KeyPair\u00a0keyPair\u00a0=\u00a0generateRsaKey();
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0RSAPublicKey\u00a0publicKey\u00a0=\u00a0(RSAPublicKey) keyPair.getPublic();
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0RSAPrivateKey\u00a0privateKey\u00a0=\u00a0(RSAPrivateKey) keyPair.getPrivate();
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0new\u00a0RSAKey.Builder(publicKey)
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .privateKey(privateKey)
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .keyID(UUID.randomUUID().toString())
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .build();
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0static\u00a0KeyPair\u00a0generateRsaKey()\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0 KeyPair keyPair;
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0try\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0KeyPairGenerator\u00a0keyPairGenerator\u00a0=\u00a0KeyPairGenerator.getInstance("RSA");
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 keyPairGenerator.initialize(2048);
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 keyPair = keyPairGenerator.generateKeyPair();
\n\u00a0 \u00a0 \u00a0 \u00a0 }\u00a0catch\u00a0(Exception ex) {
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0throw\u00a0new\u00a0IllegalStateException(ex);
\n\u00a0 \u00a0 \u00a0 \u00a0 }
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0keyPair;
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u914d\u7f6e JWT \u89e3\u7801\u5668
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0JwtDecoder\u00a0jwtDecoder(JWKSource<SecurityContext> jwkSource)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
\n\u00a0 \u00a0 }
\n}<\/p>\n 3.2 \u7528\u6237\u4fe1\u606f\u670d\u52a1<\/h4>\n\u6388\u6743\u670d\u52a1\u5668\u9700\u8981\u77e5\u9053\u7528\u6237\u4fe1\u606f\u624d\u80fd\u8fdb\u884c\u8ba4\u8bc1：<\/p>\n @Service
\npublic\u00a0class\u00a0CustomUserDetailsService\u00a0implements\u00a0UserDetailsService\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u5b9e\u9645\u9879\u76ee\u4e2d\u5e94\u8be5\u4ece\u6570\u636e\u5e93\u67e5\u8be2\u7528\u6237\u4fe1\u606f
\n\u00a0 \u00a0 \u00a0* \u8fd9\u91cc\u4e3a\u4e86\u6f14\u793a，\u4f7f\u7528\u5185\u5b58\u6570\u636e
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@Override
\n\u00a0 \u00a0\u00a0public\u00a0UserDetails\u00a0loadUserByUsername(String username)\u00a0throws\u00a0UsernameNotFoundException {
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u6a21\u62df\u6570\u636e\u5e93\u67e5\u8be2
\n\u00a0 \u00a0 \u00a0 \u00a0 Map<String, UserDetails> users =\u00a0new\u00a0HashMap<>();
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u7ba1\u7406\u5458\u7528\u6237
\n\u00a0 \u00a0 \u00a0 \u00a0 users.put("admin", User.withUsername("admin")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .password("{noop}admin123") \u00a0\/\/ {noop}\u8868\u793a\u4e0d\u52a0\u5bc6
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .roles("ADMIN",\u00a0"USER")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorities("read",\u00a0"write")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .build());
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u666e\u901a\u7528\u6237
\n\u00a0 \u00a0 \u00a0 \u00a0 users.put("user", User.withUsername("user")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .password("{noop}user123")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .roles("USER")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorities("read")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .build());
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0UserDetails\u00a0user\u00a0=\u00a0users.get(username);
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0if\u00a0(user ==\u00a0null) {
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0throw\u00a0new\u00a0UsernameNotFoundException("\u7528\u6237\u4e0d\u5b58\u5728: "\u00a0+ username);
\n\u00a0 \u00a0 \u00a0 \u00a0 }
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0user;
\n\u00a0 \u00a0 }
\n}<\/p>\n 3.3 \u914d\u7f6e\u7528\u6237\u8ba4\u8bc1<\/h4>\n@Configuration
\n@EnableWebSecurity
\npublic\u00a0class\u00a0DefaultSecurityConfig\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0SecurityFilterChain\u00a0defaultSecurityFilterChain(HttpSecurity http)\u00a0throws\u00a0Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 http
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorizeHttpRequests(authorize -> authorize
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .requestMatchers("\/oauth2\/**",\u00a0"\/login\/**").permitAll() \u00a0\/\/ \u516c\u5f00\u7aef\u70b9
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .anyRequest().authenticated() \u00a0\/\/ \u5176\u4ed6\u9700\u8981\u8ba4\u8bc1
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .formLogin(form -> form
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .loginPage("\/login") \u00a0\/\/ \u81ea\u5b9a\u4e49\u767b\u5f55\u9875
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .permitAll()
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .csrf(csrf -> csrf.ignoringRequestMatchers("\/oauth2\/**")); \u00a0\/\/ \u5ffd\u7565OAuth2\u7aef\u70b9\u7684CSRF
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0http.build();
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0UserDetailsService\u00a0userDetailsService()\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0new\u00a0CustomUserDetailsService();
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0PasswordEncoder\u00a0passwordEncoder()\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u5b9e\u9645\u9879\u76ee\u4e2d\u5e94\u8be5\u4f7f\u7528 BCryptPasswordEncoder
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0NoOpPasswordEncoder.getInstance(); \u00a0\/\/ \u4ec5\u7528\u4e8e\u6f14\u793a，\u751f\u4ea7\u73af\u5883\u4e0d\u5b89\u5168！
\n\u00a0 \u00a0 }
\n}<\/p>\n 3.4 \u81ea\u5b9a\u4e49\u767b\u5f55\u9875\u9762<\/h4>\n<!– src\/main\/resources\/templates\/login.html –>
\n<!DOCTYPE\u00a0html>
\n<html\u00a0xmlns:th="http:\/\/www.thymeleaf.org">
\n<head>
\n\u00a0 \u00a0\u00a0<meta\u00a0charset="UTF-8">
\n\u00a0 \u00a0\u00a0<title>OAuth2 \u6388\u6743\u767b\u5f55<\/title>
\n\u00a0 \u00a0\u00a0<style>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0body\u00a0{\u00a0font-family: Arial, sans-serif;\u00a0max-width:\u00a0400px;\u00a0margin:\u00a050px\u00a0auto; }
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0.form-group\u00a0{\u00a0margin-bottom:\u00a015px; }
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0label\u00a0{\u00a0display: block;\u00a0margin-bottom:\u00a05px; }
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0input\u00a0{\u00a0width:\u00a0100%;\u00a0padding:\u00a08px;\u00a0box-sizing: border-box; }
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0button\u00a0{\u00a0background:\u00a0#007bff;\u00a0color: white;\u00a0border: none;\u00a0padding:\u00a010px\u00a020px;\u00a0cursor: pointer; }
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0.error\u00a0{\u00a0color: red;\u00a0margin-top:\u00a010px; }
\n\u00a0 \u00a0\u00a0<\/style>
\n<\/head>
\n<body>
\n\u00a0 \u00a0\u00a0<h2>\u6388\u6743\u767b\u5f55<\/h2>
\n\u00a0 \u00a0\u00a0<div\u00a0th:if="${param.error}"\u00a0class="error">
\n\u00a0 \u00a0 \u00a0 \u00a0 \u7528\u6237\u540d\u6216\u5bc6\u7801\u9519\u8bef！
\n\u00a0 \u00a0\u00a0<\/div>
\n\u00a0 \u00a0\u00a0<form\u00a0th:action="@{\/login}"\u00a0method="post">
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<div\u00a0class="form-group">
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<label>\u7528\u6237\u540d：<\/label>
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<input\u00a0type="text"\u00a0name="username"\u00a0required>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/div>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<div\u00a0class="form-group">
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<label>\u5bc6\u7801：<\/label>
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<input\u00a0type="password"\u00a0name="password"\u00a0required>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/div>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<button\u00a0type="submit">\u767b\u5f55\u5e76\u6388\u6743<\/button>
\n\u00a0 \u00a0\u00a0<\/form>
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0<!– \u663e\u793a\u53ef\u7528\u7684\u6388\u6743\u65b9\u5f0f –>
\n\u00a0 \u00a0\u00a0<div\u00a0style="margin-transform: translateY( 30px; border-top: 1px solid\u00a0#eee; padding-top: 20px;">
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<h4>\u652f\u6301\u7684\u6388\u6743\u65b9\u5f0f：<\/h4>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<ul>
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<li>\u6388\u6743\u7801\u6a21\u5f0f：\/oauth2\/authorize?response_type=code&client_id=my-client&redirect_uri=http:\/\/127.0.0.1:8080\/authorized&scope=read<\/li>
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<li>\u5ba2\u6237\u7aef\u6a21\u5f0f：\/oauth2\/token (\u4f7f\u7528 client_credentials)<\/li>
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/ul>
\n\u00a0 \u00a0\u00a0<\/div>
\n<\/body>
\n<\/html><\/p>\n \u521b\u5efa\u767b\u5f55\u63a7\u5236\u5668：<\/p>\n @Controller
\npublic\u00a0class\u00a0LoginController\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@GetMapping("\/login")
\n\u00a0 \u00a0\u00a0public\u00a0String\u00a0login()\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0"login";
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@GetMapping("\/authorized")
\n\u00a0 \u00a0\u00a0@ResponseBody
\n\u00a0 \u00a0\u00a0public\u00a0String\u00a0authorized(@RequestParam(required = false)\u00a0String code,\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0@RequestParam(required = false)\u00a0String error)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0if\u00a0(error !=\u00a0null) {
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0"\u6388\u6743\u5931\u8d25: "\u00a0+ error;
\n\u00a0 \u00a0 \u00a0 \u00a0 }
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0"\u6388\u6743\u6210\u529f！\u6388\u6743\u7801: "\u00a0+ code +\u00a0"<br>"
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 +\u00a0"\u8bf7\u4f7f\u7528\u6b64\u6388\u6743\u7801\u83b7\u53d6\u8bbf\u95ee\u4ee4\u724c\u3002";
\n\u00a0 \u00a0 }
\n}<\/p>\n
\n\u56db\u3001\u8d44\u6e90\u670d\u52a1\u5668\u5b9e\u73b0<\/h3>\n\u8d44\u6e90\u670d\u52a1\u5668\u8d1f\u8d23\u9a8c\u8bc1 Token \u5e76\u4fdd\u62a4 API \u8d44\u6e90\u3002<\/p>\n 4.1 \u8d44\u6e90\u670d\u52a1\u5668\u914d\u7f6e<\/h4>\n@Configuration
\n@EnableWebSecurity
\n@EnableMethodSecurity(prePostEnabled = true)\u00a0\u00a0\/\/ \u542f\u7528\u65b9\u6cd5\u7ea7\u5b89\u5168\u63a7\u5236
\npublic\u00a0class\u00a0ResourceServerConfig\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u8d44\u6e90\u670d\u52a1\u5668\u7684\u5b89\u5168\u914d\u7f6e
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0@Order(2)
\n\u00a0 \u00a0\u00a0public\u00a0SecurityFilterChain\u00a0resourceServerFilterChain(HttpSecurity http)\u00a0throws\u00a0Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 http
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .securityMatcher("\/api\/**") \u00a0\/\/ \u53ea\u4fdd\u62a4 \/api \u5f00\u5934\u7684\u8def\u5f84
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorizeHttpRequests(authorize -> authorize
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .anyRequest().authenticated() \u00a0\/\/ \u9700\u8981\u8ba4\u8bc1
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .oauth2ResourceServer(oauth2 -> oauth2
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .jwt(Customizer.withDefaults()) \u00a0\/\/ \u4f7f\u7528JWT\u4ee4\u724c
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .csrf(csrf -> csrf.disable()); \u00a0\/\/ API\u901a\u5e38\u7981\u7528CSRF
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0http.build();
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u914d\u7f6e JWT \u89e3\u7801\u5668
\n\u00a0 \u00a0 \u00a0* \u8fd9\u91cc\u9700\u8981\u548c\u6388\u6743\u670d\u52a1\u5668\u7684\u914d\u7f6e\u4e00\u81f4
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0JwtDecoder\u00a0jwtDecoder()\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u4ece\u6388\u6743\u670d\u52a1\u5668\u83b7\u53d6\u516c\u94a5\u6765\u9a8c\u8bc1JWT
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u5b9e\u9645\u9879\u76ee\u4e2d，\u6388\u6743\u670d\u52a1\u5668\u5e94\u8be5\u63d0\u4f9b jwks_uri
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0String\u00a0jwkSetUri\u00a0=\u00a0"http:\/\/localhost:8080\/oauth2\/jwks";
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
\n\u00a0 \u00a0 }
\n}<\/p>\n 4.2 \u53d7\u4fdd\u62a4\u7684 API \u8d44\u6e90<\/h4>\n@RestController
\n@RequestMapping("\/api")
\npublic\u00a0class\u00a0ResourceController\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u83b7\u53d6\u7528\u6237\u4fe1\u606f（\u9700\u8981\u8ba4\u8bc1）
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@GetMapping("\/user\/info")
\n\u00a0 \u00a0\u00a0@PreAuthorize("hasAuthority('SCOPE_read')")\u00a0\u00a0\/\/ \u9700\u8981 read \u6743\u9650
\n\u00a0 \u00a0\u00a0public\u00a0ResponseEntity<?> getUserInfo(@AuthenticationPrincipal\u00a0Jwt jwt) {
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u4eceJWT\u4e2d\u63d0\u53d6\u7528\u6237\u4fe1\u606f
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0String\u00a0username\u00a0=\u00a0jwt.getClaim("sub");
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0String\u00a0email\u00a0=\u00a0jwt.getClaim("email");
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0 Map<String, Object> userInfo =\u00a0new\u00a0HashMap<>();
\n\u00a0 \u00a0 \u00a0 \u00a0 userInfo.put("username", username);
\n\u00a0 \u00a0 \u00a0 \u00a0 userInfo.put("email", email !=\u00a0null\u00a0? email : username +\u00a0"@example.com");
\n\u00a0 \u00a0 \u00a0 \u00a0 userInfo.put("userId", jwt.getClaim("user_id"));
\n\u00a0 \u00a0 \u00a0 \u00a0 userInfo.put("authorities", jwt.getClaim("scope"));
\n\u00a0 \u00a0 \u00a0 \u00a0 userInfo.put("issuedAt", jwt.getIssuedAt());
\n\u00a0 \u00a0 \u00a0 \u00a0 userInfo.put("expiresAt", jwt.getExpiresAt());
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0ResponseEntity.ok(Map.of(
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"code",\u00a0200,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"message",\u00a0"\u83b7\u53d6\u7528\u6237\u4fe1\u606f\u6210\u529f",
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"data", userInfo
\n\u00a0 \u00a0 \u00a0 \u00a0 ));
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u521b\u5efa\u8d44\u6e90（\u9700\u8981 write \u6743\u9650）
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@PostMapping("\/resource")
\n\u00a0 \u00a0\u00a0@PreAuthorize("hasAuthority('SCOPE_write')")\u00a0\u00a0\/\/ \u9700\u8981 write \u6743\u9650
\n\u00a0 \u00a0\u00a0public\u00a0ResponseEntity<?> createResource(@RequestBody\u00a0Map<String, Object> resource,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0@AuthenticationPrincipal\u00a0Jwt jwt) {
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0String\u00a0username\u00a0=\u00a0jwt.getClaim("sub");
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0 Map<String, Object> response =\u00a0new\u00a0HashMap<>();
\n\u00a0 \u00a0 \u00a0 \u00a0 response.put("id", UUID.randomUUID().toString());
\n\u00a0 \u00a0 \u00a0 \u00a0 response.put("name", resource.get("name"));
\n\u00a0 \u00a0 \u00a0 \u00a0 response.put("creator", username);
\n\u00a0 \u00a0 \u00a0 \u00a0 response.put("createdAt",\u00a0new\u00a0Date());
\n\u00a0 \u00a0 \u00a0 \u00a0 response.put("message",\u00a0"\u8d44\u6e90\u521b\u5efa\u6210\u529f");
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0ResponseEntity.status(HttpStatus.CREATED).body(Map.of(
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"code",\u00a0201,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"message",\u00a0"\u8d44\u6e90\u521b\u5efa\u6210\u529f",
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"data", response
\n\u00a0 \u00a0 \u00a0 \u00a0 ));
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u516c\u5f00\u63a5\u53e3（\u4e0d\u9700\u8981\u8ba4\u8bc1）
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@GetMapping("\/public\/hello")
\n\u00a0 \u00a0\u00a0public\u00a0ResponseEntity<?> publicHello() {
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0ResponseEntity.ok(Map.of(
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"code",\u00a0200,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"message",\u00a0"\u8fd9\u662f\u4e00\u4e2a\u516c\u5f00\u63a5\u53e3，\u65e0\u9700\u8ba4\u8bc1",
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"timestamp",\u00a0new\u00a0Date()
\n\u00a0 \u00a0 \u00a0 \u00a0 ));
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u7ba1\u7406\u63a5\u53e3（\u9700\u8981 ADMIN \u89d2\u8272）
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@GetMapping("\/admin\/dashboard")
\n\u00a0 \u00a0\u00a0@PreAuthorize("hasRole('ADMIN')")
\n\u00a0 \u00a0\u00a0public\u00a0ResponseEntity<?> adminDashboard(@AuthenticationPrincipal\u00a0Jwt jwt) {
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0ResponseEntity.ok(Map.of(
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"code",\u00a0200,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"message",\u00a0"\u6b22\u8fce\u6765\u5230\u7ba1\u7406\u540e\u53f0，\u7ba1\u7406\u5458："\u00a0+ jwt.getClaim("sub"),
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"adminData", Map.of(
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"totalUsers",\u00a01500,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"activeSessions",\u00a042,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"systemStatus",\u00a0"\u6b63\u5e38"
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 \u00a0 \u00a0 ));
\n\u00a0 \u00a0 }
\n}<\/p>\n 4.3 \u5168\u5c40\u5f02\u5e38\u5904\u7406<\/h4>\n@RestControllerAdvice
\npublic\u00a0class\u00a0GlobalExceptionHandler\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u5904\u7406\u8ba4\u8bc1\u5f02\u5e38
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@ExceptionHandler(AuthenticationException.class)
\n\u00a0 \u00a0\u00a0public\u00a0ResponseEntity<?> handleAuthenticationException(AuthenticationException e) {
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(Map.of(
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"code",\u00a0401,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"message",\u00a0"\u8ba4\u8bc1\u5931\u8d25："\u00a0+ e.getMessage(),
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"timestamp",\u00a0new\u00a0Date()
\n\u00a0 \u00a0 \u00a0 \u00a0 ));
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u5904\u7406\u8bbf\u95ee\u88ab\u62d2\u7edd\u5f02\u5e38
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@ExceptionHandler(AccessDeniedException.class)
\n\u00a0 \u00a0\u00a0public\u00a0ResponseEntity<?> handleAccessDeniedException(AccessDeniedException e) {
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0ResponseEntity.status(HttpStatus.FORBIDDEN).body(Map.of(
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"code",\u00a0403,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"message",\u00a0"\u6743\u9650\u4e0d\u8db3，\u65e0\u6cd5\u8bbf\u95ee\u6b64\u8d44\u6e90",
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"timestamp",\u00a0new\u00a0Date()
\n\u00a0 \u00a0 \u00a0 \u00a0 ));
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0\/**
\n\u00a0 \u00a0 \u00a0* \u5904\u7406 Token \u8fc7\u671f\u6216\u65e0\u6548
\n\u00a0 \u00a0 \u00a0*\/
\n\u00a0 \u00a0\u00a0@ExceptionHandler(JwtException.class)
\n\u00a0 \u00a0\u00a0public\u00a0ResponseEntity<?> handleJwtException(JwtException e) {
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(Map.of(
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"code",\u00a0401,
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"message",\u00a0"Token\u65e0\u6548\u6216\u5df2\u8fc7\u671f",
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"error", e.getMessage(),
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0"timestamp",\u00a0new\u00a0Date()
\n\u00a0 \u00a0 \u00a0 \u00a0 ));
\n\u00a0 \u00a0 }
\n}<\/p>\n
\n\u4e94\u3001\u6d4b\u8bd5\u5b8c\u6574\u7684 OAuth2.0 \u6d41\u7a0b<\/h3>\n5.1 \u542f\u52a8\u5e94\u7528<\/h4>\n\u542f\u52a8\u5e94\u7528\u540e，\u8bbf\u95ee：http:\/\/localhost:8080<\/p>\n 5.2 \u6388\u6743\u7801\u6a21\u5f0f\u6d4b\u8bd5<\/h4>\n\u6b65\u9aa4 1：\u83b7\u53d6\u6388\u6743\u7801<\/p>\n \u6d4f\u89c8\u5668\u8bbf\u95ee\u6388\u6743\u7aef\u70b9：<\/p>\n http:\/\/localhost:8080\/oauth2\/authorize?response_type=code&client_id=my-client&redirect_uri=http:\/\/127.0.0.1:8080\/authorized&scope=read<\/p>\n \u7cfb\u7edf\u4f1a\u8df3\u8f6c\u5230\u767b\u5f55\u9875\u9762，\u4f7f\u7528\u4ee5\u4e0b\u4efb\u4e00\u8d26\u53f7\u767b\u5f55：<\/p>\n \n- \n
\u2022 \u7528\u6237\u540d：admin，\u5bc6\u7801：admin123<\/p>\n<\/li>\n - \n
\u2022 \u7528\u6237\u540d：user，\u5bc6\u7801：user123<\/p>\n<\/li>\n<\/ul>\n \u767b\u5f55\u6210\u529f\u540e，\u4f1a\u770b\u5230\u6388\u6743\u786e\u8ba4\u9875\u9762，\u70b9\u51fb"\u786e\u8ba4\u6388\u6743"\u540e，\u4f1a\u8df3\u8f6c\u5230\u56de\u8c03\u5730\u5740\u5e76\u663e\u793a\u6388\u6743\u7801\u3002<\/p>\n \u6b65\u9aa4 2：\u7528\u6388\u6743\u7801\u83b7\u53d6\u8bbf\u95ee\u4ee4\u724c<\/p>\n \u4f7f\u7528 Postman \u6216 curl：<\/p>\n curl –location\u00a0'http:\/\/localhost:8080\/oauth2\/token'\u00a0\\\\
\n–header\u00a0'Content-Type: application\/x-www-form-urlencoded'\u00a0\\\\
\n–header\u00a0'Authorization: Basic bXktY2xpZW50Om15LXNlY3JldA=='\u00a0\\\\
\n–data-urlencode\u00a0'grant_type=authorization_code'\u00a0\\\\
\n–data-urlencode\u00a0'code=YOUR_AUTHORIZATION_CODE'\u00a0\\\\
\n–data-urlencode\u00a0'redirect_uri=http:\/\/127.0.0.1:8080\/authorized'<\/p>\n \u6ce8\u610f：Authorization\u00a0\u5934\u662f\u00a0client_id:client_secret\u00a0\u7684 Base64 \u7f16\u7801\u3002<\/p>\n \u6b65\u9aa4 3：\u4f7f\u7528\u8bbf\u95ee\u4ee4\u724c\u8c03\u7528 API<\/p>\n curl –location\u00a0'http:\/\/localhost:8080\/api\/user\/info'\u00a0\\\\
\n–header\u00a0'Authorization: Bearer YOUR_ACCESS_TOKEN'<\/p>\n 5.3 \u5ba2\u6237\u7aef\u6a21\u5f0f\u6d4b\u8bd5<\/h4>\ncurl –location\u00a0'http:\/\/localhost:8080\/oauth2\/token'\u00a0\\\\
\n–header\u00a0'Content-Type: application\/x-www-form-urlencoded'\u00a0\\\\
\n–header\u00a0'Authorization: Basic bXktY2xpZW50Om15LXNlY3JldA=='\u00a0\\\\
\n–data-urlencode\u00a0'grant_type=client_credentials'\u00a0\\\\
\n–data-urlencode\u00a0'scope=read'<\/p>\n 5.4 \u5237\u65b0\u4ee4\u724c<\/h4>\n\u8bbf\u95ee\u4ee4\u724c\u8fc7\u671f\u540e，\u53ef\u4ee5\u4f7f\u7528\u5237\u65b0\u4ee4\u724c\u83b7\u53d6\u65b0\u7684\u8bbf\u95ee\u4ee4\u724c：<\/p>\n curl –location\u00a0'http:\/\/localhost:8080\/oauth2\/token'\u00a0\\\\
\n–header\u00a0'Content-Type: application\/x-www-form-urlencoded'\u00a0\\\\
\n–header\u00a0'Authorization: Basic bXktY2xpZW50Om15LXNlY3JldA=='\u00a0\\\\
\n–data-urlencode\u00a0'grant_type=refresh_token'\u00a0\\\\
\n–data-urlencode\u00a0'refresh_token=YOUR_REFRESH_TOKEN'<\/p>\n
\n\u516d\u3001\u9ad8\u7ea7\u914d\u7f6e\u4e0e\u4f18\u5316<\/h3>\n6.1 \u4f7f\u7528\u6570\u636e\u5e93\u5b58\u50a8\u5ba2\u6237\u7aef\u4fe1\u606f<\/h4>\n\u4e0a\u9762\u7684\u4f8b\u5b50\u4f7f\u7528\u4e86\u5185\u5b58\u5b58\u50a8，\u5b9e\u9645\u9879\u76ee\u4e2d\u5e94\u8be5\u4f7f\u7528\u6570\u636e\u5e93：<\/p>\n @Entity
\n@Table(name = "oauth2_clients")
\n@Data
\npublic\u00a0class\u00a0OAuth2Client\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Id
\n\u00a0 \u00a0\u00a0private\u00a0String id;
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Column(nullable = false, unique = true)
\n\u00a0 \u00a0\u00a0private\u00a0String clientId;
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0String clientSecret;
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0String authenticationMethods; \u00a0\/\/ \u9017\u53f7\u5206\u9694
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0String authorizationGrantTypes; \u00a0\/\/ \u9017\u53f7\u5206\u9694
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0String redirectUris; \u00a0\/\/ \u9017\u53f7\u5206\u9694
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0String scopes; \u00a0\/\/ \u9017\u53f7\u5206\u9694
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0Boolean\u00a0requireProofKey\u00a0=\u00a0false;
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0Boolean\u00a0requireAuthorizationConsent\u00a0=\u00a0false;
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@CreationTimestamp
\n\u00a0 \u00a0\u00a0private\u00a0LocalDateTime createTime;
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@UpdateTimestamp
\n\u00a0 \u00a0\u00a0private\u00a0LocalDateTime updateTime;
\n}@Service
\n@Transactional
\npublic\u00a0class\u00a0JpaRegisteredClientRepository\u00a0implements\u00a0RegisteredClientRepository\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Autowired
\n\u00a0 \u00a0\u00a0private\u00a0OAuth2ClientRepository clientRepository;
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Override
\n\u00a0 \u00a0\u00a0public\u00a0void\u00a0save(RegisteredClient registeredClient)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u4fdd\u5b58\u5230\u6570\u636e\u5e93
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Override
\n\u00a0 \u00a0\u00a0public\u00a0RegisteredClient\u00a0findById(String id)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u4ece\u6570\u636e\u5e93\u67e5\u8be2
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Override
\n\u00a0 \u00a0\u00a0public\u00a0RegisteredClient\u00a0findByClientId(String clientId)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u4ece\u6570\u636e\u5e93\u67e5\u8be2
\n\u00a0 \u00a0 }
\n}<\/p>\n 6.2 \u81ea\u5b9a\u4e49 Token \u589e\u5f3a\u5668<\/h4>\n\u53ef\u4ee5\u5728 JWT Token \u4e2d\u6dfb\u52a0\u81ea\u5b9a\u4e49\u58f0\u660e：<\/p>\n @Component
\npublic\u00a0class\u00a0CustomTokenEnhancer\u00a0implements\u00a0OAuth2TokenCustomizer<JwtEncodingContext> {
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Override
\n\u00a0 \u00a0\u00a0public\u00a0void\u00a0customize(JwtEncodingContext context)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0if\u00a0(context.getPrincipal()\u00a0instanceof\u00a0UsernamePasswordAuthenticationToken) {
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u6dfb\u52a0\u7528\u6237ID\u548c\u89d2\u8272\u5230Token
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0Authentication\u00a0authentication\u00a0=\u00a0context.getPrincipal();
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0UserDetails\u00a0userDetails\u00a0=\u00a0(UserDetails) authentication.getPrincipal();
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 context.getClaims().claims(claims -> {
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 claims.put("user_id", generateUserId(userDetails.getUsername()));
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 claims.put("email", userDetails.getUsername() +\u00a0"@company.com");
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u6dfb\u52a0\u81ea\u5b9a\u4e49\u58f0\u660e
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 claims.put("company",\u00a0"MyCompany");
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 claims.put("department",\u00a0"IT");
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 });
\n\u00a0 \u00a0 \u00a0 \u00a0 }
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0String\u00a0generateUserId(String username)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u751f\u6210\u7528\u6237ID\u7684\u903b\u8f91
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0"user_"\u00a0+ username.hashCode();
\n\u00a0 \u00a0 }
\n}<\/p>\n \u5728\u914d\u7f6e\u4e2d\u6ce8\u518c：<\/p>\n @Bean
\npublic\u00a0OAuth2AuthorizationServerConfiguration.OAuth2AuthorizationServerConfigurer\u00a0authorizationServerConfigurer(
\n\u00a0 \u00a0 \u00a0 \u00a0 RegisteredClientRepository registeredClientRepository,
\n\u00a0 \u00a0 \u00a0 \u00a0 CustomTokenEnhancer customTokenEnhancer)\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0return\u00a0OAuth2AuthorizationServerConfiguration
\n\u00a0 \u00a0 \u00a0 \u00a0 .authorizationServerConfigurer(registeredClientRepository)
\n\u00a0 \u00a0 \u00a0 \u00a0 .tokenEnhancer(customTokenEnhancer);
\n}<\/p>\n 6.3 \u914d\u7f6e Token \u6709\u6548\u671f<\/h4>\n@Bean
\npublic\u00a0AuthorizationServerSettings\u00a0authorizationServerSettings()\u00a0{
\n\u00a0 \u00a0\u00a0return\u00a0AuthorizationServerSettings.builder()
\n\u00a0 \u00a0 \u00a0 \u00a0 .tokenEndpoint("\/oauth2\/token")
\n\u00a0 \u00a0 \u00a0 \u00a0 .authorizationEndpoint("\/oauth2\/authorize")
\n\u00a0 \u00a0 \u00a0 \u00a0 .tokenIntrospectionEndpoint("\/oauth2\/introspect")
\n\u00a0 \u00a0 \u00a0 \u00a0 .tokenRevocationEndpoint("\/oauth2\/revoke")
\n\u00a0 \u00a0 \u00a0 \u00a0 .jwkSetEndpoint("\/oauth2\/jwks")
\n\u00a0 \u00a0 \u00a0 \u00a0 .oidcUserInfoEndpoint("\/connect\/userinfo")
\n\u00a0 \u00a0 \u00a0 \u00a0 .build();
\n}<\/p>\n @Bean
\npublic\u00a0TokenSettings\u00a0tokenSettings()\u00a0{
\n\u00a0 \u00a0\u00a0return\u00a0TokenSettings.builder()
\n\u00a0 \u00a0 \u00a0 \u00a0 .accessTokenTimeToLive(Duration.ofHours(2)) \u00a0\/\/ \u8bbf\u95ee\u4ee4\u724c2\u5c0f\u65f6\u8fc7\u671f
\n\u00a0 \u00a0 \u00a0 \u00a0 .refreshTokenTimeToLive(Duration.ofDays(7)) \u00a0\/\/ \u5237\u65b0\u4ee4\u724c7\u5929\u8fc7\u671f
\n\u00a0 \u00a0 \u00a0 \u00a0 .authorizationCodeTimeToLive(Duration.ofMinutes(5)) \u00a0\/\/ \u6388\u6743\u78015\u5206\u949f\u8fc7\u671f
\n\u00a0 \u00a0 \u00a0 \u00a0 .reuseRefreshTokens(false) \u00a0\/\/ \u4e0d\u91cd\u590d\u4f7f\u7528\u5237\u65b0\u4ee4\u724c
\n\u00a0 \u00a0 \u00a0 \u00a0 .build();
\n}<\/p>\n
\n\u4e03\u3001\u6ce8\u610f\u4e8b\u9879<\/h3>\n7.1 \u5b89\u5168\u6700\u4f73\u5b9e\u8df5<\/h4>\n - \n
1.\u00a0\u4e0d\u8981\u4f7f\u7528 {noop} \u5bc6\u7801\u7f16\u7801\u5668<\/p>\n @Bean
\npublic\u00a0PasswordEncoder\u00a0passwordEncoder()\u00a0{
\n\u00a0 \u00a0\u00a0return\u00a0new\u00a0BCryptPasswordEncoder(); \u00a0\/\/ \u751f\u4ea7\u73af\u5883\u4f7f\u7528
\n}<\/li>\n - \n
2.\u00a0\u4f7f\u7528 HTTPS\u751f\u4ea7\u73af\u5883\u5fc5\u987b\u4f7f\u7528 HTTPS，\u9632\u6b62 Token \u88ab\u7a83\u53d6\u3002<\/p>\n<\/li>\n - \n
3.\u00a0\u9650\u5236\u91cd\u5b9a\u5411 URI<\/p>\n RegisteredClient\u00a0client\u00a0=\u00a0RegisteredClient.withId("1")
\n\u00a0 \u00a0 .clientId("web-app")
\n\u00a0 \u00a0 .redirectUris(uris -> {
\n\u00a0 \u00a0 \u00a0 \u00a0 uris.add("https:\/\/production.com\/callback");
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0\/\/ \u4e0d\u8981\u4f7f\u7528\u901a\u914d\u7b26\u6216\u8fc7\u4e8e\u5bbd\u677e\u7684\u89c4\u5219
\n\u00a0 \u00a0 })
\n\u00a0 \u00a0 .build();<\/li>\n - \n
4.\u00a0\u5b9a\u671f\u8f6e\u6362\u5bc6\u94a5JWK \u7b7e\u540d\u5bc6\u94a5\u5e94\u5b9a\u671f\u8f6e\u6362\u3002<\/p>\n<\/li>\n 7.2 \u76d1\u63a7\u4e0e\u65e5\u5fd7<\/h4>\n@Component
\npublic\u00a0class\u00a0OAuth2AuditLogger\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0private\u00a0static\u00a0final\u00a0Logger\u00a0log\u00a0=\u00a0LoggerFactory.getLogger("OAUTH2_AUDIT");
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@EventListener
\n\u00a0 \u00a0\u00a0public\u00a0void\u00a0onAuthorizationSuccess(AuthorizationSuccessEvent event)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0 log.info("\u6388\u6743\u6210\u529f – \u5ba2\u6237\u7aef: {}, \u7528\u6237: {}, \u8303\u56f4: {}",
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 event.getAuthorization().getRegisteredClientId(),
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 event.getAuthorization().getPrincipalName(),
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 event.getAuthorization().getAuthorizedScopes());
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@EventListener
\n\u00a0 \u00a0\u00a0public\u00a0void\u00a0onAuthorizationFailure(AuthorizationErrorEvent event)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0 log.warn("\u6388\u6743\u5931\u8d25 – \u9519\u8bef: {}, \u5ba2\u6237\u7aef: {}",
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 event.getError(),
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 event.getAuthorization().getRegisteredClientId());
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@EventListener
\n\u00a0 \u00a0\u00a0public\u00a0void\u00a0onTokenIssued(OAuth2TokenIssuedEvent event)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0 log.info("Token\u7b7e\u53d1 – \u7c7b\u578b: {}, \u5ba2\u6237\u7aef: {}",
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 event.getToken().getClass().getSimpleName(),
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 event.getAuthorization().getRegisteredClientId());
\n\u00a0 \u00a0 }
\n}<\/p>\n 7.3 \u6027\u80fd\u4f18\u5316<\/h4>\n - \n
1.\u00a0\u4f7f\u7528 Redis \u7f13\u5b58\u4ee4\u724c<\/p>\n @Bean
\npublic\u00a0OAuth2AuthorizationService\u00a0authorizationService(
\n\u00a0 \u00a0 \u00a0 \u00a0 RegisteredClientRepository registeredClientRepository,
\n\u00a0 \u00a0 \u00a0 \u00a0 RedisConnectionFactory redisConnectionFactory)\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0return\u00a0new\u00a0RedisOAuth2AuthorizationService(
\n\u00a0 \u00a0 \u00a0 \u00a0 redisConnectionFactory,
\n\u00a0 \u00a0 \u00a0 \u00a0 registeredClientRepository);
\n}<\/li>\n - \n
2.\u00a0\u542f\u7528\u54cd\u5e94\u5f0f\u652f\u6301<\/p>\n @Configuration
\n@EnableWebFluxSecurity
\npublic\u00a0class\u00a0ReactiveResourceServerConfig\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0SecurityWebFilterChain\u00a0springSecurityFilterChain(ServerHttpSecurity http)\u00a0{
\n\u00a0 \u00a0 \u00a0 \u00a0 http
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorizeExchange(exchanges -> exchanges
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .anyExchange().authenticated()
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .oauth2ResourceServer(oauth2 -> oauth2
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .jwt(Customizer.withDefaults())
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 );
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0http.build();
\n\u00a0 \u00a0 }
\n}<\/li>\n
\n\u516b\u3001\u5e38\u89c1\u95ee\u9898\u4e0e\u89e3\u51b3\u65b9\u6848<\/h3>\nQ1: \u5982\u4f55\u652f\u6301\u591a\u79cd\u8ba4\u8bc1\u65b9\u5f0f？<\/h4>\nA: \u5728\u00a0RegisteredClient\u00a0\u4e2d\u914d\u7f6e\u591a\u79cd\u8ba4\u8bc1\u65b9\u6cd5：<\/p>\n .clientAuthenticationMethods(methods -> {
\n\u00a0 \u00a0 methods.add(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
\n\u00a0 \u00a0 methods.add(ClientAuthenticationMethod.CLIENT_SECRET_POST);
\n\u00a0 \u00a0 methods.add(ClientAuthenticationMethod.CLIENT_SECRET_JWT);
\n\u00a0 \u00a0 methods.add(ClientAuthenticationMethod.PRIVATE_KEY_JWT);
\n})<\/p>\n Q2: \u5982\u4f55\u5b9e\u73b0\u5355\u70b9\u767b\u5f55（SSO）？<\/h4>\nA: Spring Security \u652f\u6301 OAuth2 \u5355\u70b9\u767b\u5f55：<\/p>\n @Configuration
\n@EnableWebSecurity
\npublic\u00a0class\u00a0OAuth2LoginConfig\u00a0{
\n\u00a0 \u00a0\u00a0
\n\u00a0 \u00a0\u00a0@Bean
\n\u00a0 \u00a0\u00a0public\u00a0SecurityFilterChain\u00a0filterChain(HttpSecurity http)\u00a0throws\u00a0Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 http
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .oauth2Login(oauth2 -> oauth2
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .loginPage("\/login")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .defaultSuccessUrl("\/home")
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .authorizeHttpRequests(authz -> authz
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .anyRequest().authenticated()
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 );
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0return\u00a0http.build();
\n\u00a0 \u00a0 }
\n}<\/p>\n Q3: \u5982\u4f55\u96c6\u6210\u7b2c\u4e09\u65b9\u767b\u5f55（\u5fae\u4fe1\u3001GitHub\u7b49）？<\/h4>\nA: \u6dfb\u52a0\u5bf9\u5e94\u7684\u4f9d\u8d56\u548c\u914d\u7f6e：<\/p>\n spring:
\n\u00a0\u00a0security:
\n\u00a0 \u00a0\u00a0oauth2:
\n\u00a0 \u00a0 \u00a0\u00a0client:
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0registration:
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0github:
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0client-id:\u00a0YOUR_GITHUB_CLIENT_ID
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0client-secret:\u00a0YOUR_GITHUB_CLIENT_SECRET
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0wechat:
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0client-id:\u00a0YOUR_WECHAT_APPID
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0client-secret:\u00a0YOUR_WECHAT_SECRET
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0authorization-grant-type:\u00a0authorization_code
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0scope:\u00a0snsapi_userinfo
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0client-name:\u00a0\u5fae\u4fe1
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0provider:\u00a0wechat
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0provider:
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0wechat:
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0authorization-uri:\u00a0https:\/\/open.weixin.qq.com\/connect\/oauth2\/authorize
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0token-uri:\u00a0https:\/\/api.weixin.qq.com\/sns\/oauth2\/access_token
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0user-info-uri:\u00a0https:\/\/api.weixin.qq.com\/sns\/userinfo<\/p>\n
\n\u5199\u5728\u6700\u540e<\/h3>\n\u901a\u8fc7\u4eca\u5929\u7684\u6587\u7ae0，\u6211\u4eec\u5b8c\u6574\u5b9e\u73b0\u4e86 SpringBoot \u96c6\u6210 OAuth2.0 \u7684\u6388\u6743\u670d\u52a1\u5668\u548c\u8d44\u6e90\u670d\u52a1\u5668\u3002\u603b\u7ed3\u4e00\u4e0b\u5173\u952e\u70b9：<\/p>\n - \n
1.\u00a0\u6388\u6743\u670d\u52a1\u5668\u8d1f\u8d23\u9881\u53d1 Token，\u652f\u6301\u591a\u79cd\u6388\u6743\u6a21\u5f0f<\/p>\n<\/li>\n - \n
2.\u00a0\u8d44\u6e90\u670d\u52a1\u5668\u8d1f\u8d23\u9a8c\u8bc1 Token \u5e76\u4fdd\u62a4 API<\/p>\n<\/li>\n - \n
3.\u00a0JWT Token\u00a0\u662f\u65e0\u72b6\u6001\u7684，\u9002\u5408\u5206\u5e03\u5f0f\u7cfb\u7edf<\/p>\n<\/li>\n - \n
4.\u00a0Spring Security OAuth2\u00a0\u63d0\u4f9b\u4e86\u5b8c\u6574\u7684\u89e3\u51b3\u65b9\u6848<\/p>\n<\/li>\n OAuth2.0 \u770b\u4f3c\u590d\u6742，\u4f46\u7406\u89e3\u4e86\u6838\u5fc3\u6982\u5ff5\u540e，\u7ed3\u5408 Spring Security \u7684\u81ea\u52a8\u5316\u914d\u7f6e，\u5b9e\u73b0\u8d77\u6765\u5e76\u4e0d\u56f0\u96be\u3002\u5efa\u8bae\u4f60\u5148\u5728\u672c\u5730\u8fd0\u884c\u8fd9\u4e2a\u793a\u4f8b，\u7136\u540e\u6839\u636e\u5b9e\u9645\u4e1a\u52a1\u9700\u6c42\u8fdb\u884c\u8c03\u6574\u3002<\/p>\n
\n\u539f\u521b\u4e0d\u6613，\u5982\u679c\u89c9\u5f97\u6709\u5e2e\u52a9，\u6b22\u8fce\u70b9\u8d5e\u3001\u5728\u770b\u6216\u5206\u4eab\u7ed9\u4f60\u7684\u5c0f\u4f19\u4f34~<\/p>\n","protected":false},"excerpt":{"rendered":" \u4e0a\u5468\u6709\u4f4d\u8bfb\u8005\u5728\u540e\u53f0\u63d0\u95ee：\u201c\u6211\u4eec\u516c\u53f8\u7684\u7cfb\u7edf\u8981\u5bf9\u5916\u63d0\u4f9b API \u63a5\u53e3，\u5ba2\u6237\u8981\u6c42\u7528 OAuth2.0 \u505a\u5b89\u5168\u8ba4\u8bc1，\u8fd9\u8be5\u600e\u4e48\u5b9e\u73b0\u5462？\u201d\u8fd9\u786e\u5b9e\u662f\u4e2a\u5f88\u5b9e\u9645\u7684\u9700\u6c42\u3002\u968f\u7740\u5fae\u670d\u52a1\u548c\u5f00\u653e\u5e73\u53f0\u7684\u5174\u8d77，OAuth2.0 \u5df2\u7ecf\u6210\u4e3a API \u5b89\u5168\u7684\u4e8b\u5b9e\u6807\u51c6\u3002\u4eca\u5929，\u6211\u5c31\u4ece\u96f6\u5f00\u59cb，\u624b\u628a\u624b\u5e26\u4f60\u5b9e\u73b0 SpringBoot \u4e2d\u7684 OAuth2.0 \u5b8c\u6574\u65b9\u6848\u3002\u4e00\u3001OAuth2.0\u4e3a\u4ec0\u4e48\u662f\u201c\u884c\u4e1a\u6807\u51c6\u201d？\u5728\u5f00<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[99,101,98,292,43],"topic":[],"class_list":["post-81573","post","type-post","status-publish","format-standard","hentry","category-server","tag-java","tag-spring","tag-spring-boot","tag-292","tag-43"],"yoast_head":"\n SpringBoot \u96c6\u6210 OAuth2.0 \u8d44\u6e90\u670d\u52a1\u5668\u4e0e\u6388\u6743\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/81573.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SpringBoot \u96c6\u6210 OAuth2.0 \u8d44\u6e90\u670d\u52a1\u5668\u4e0e\u6388\u6743\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u4e0a\u5468\u6709\u4f4d\u8bfb\u8005\u5728\u540e\u53f0\u63d0\u95ee：\u201c\u6211\u4eec\u516c\u53f8\u7684\u7cfb\u7edf\u8981\u5bf9\u5916\u63d0\u4f9b API \u63a5\u53e3，\u5ba2\u6237\u8981\u6c42\u7528 OAuth2.0 \u505a\u5b89\u5168\u8ba4\u8bc1，\u8fd9\u8be5\u600e\u4e48\u5b9e\u73b0\u5462？\u201d\u8fd9\u786e\u5b9e\u662f\u4e2a\u5f88\u5b9e\u9645\u7684\u9700\u6c42\u3002\u968f\u7740\u5fae\u670d\u52a1\u548c\u5f00\u653e\u5e73\u53f0\u7684\u5174\u8d77，OAuth2.0 \u5df2\u7ecf\u6210\u4e3a API \u5b89\u5168\u7684\u4e8b\u5b9e\u6807\u51c6\u3002\u4eca\u5929，\u6211\u5c31\u4ece\u96f6\u5f00\u59cb，\u624b\u628a\u624b\u5e26\u4f60\u5b9e\u73b0 SpringBoot \u4e2d\u7684 OAuth2.0 \u5b8c\u6574\u65b9\u6848\u3002\u4e00\u3001OAuth2.0\u4e3a\u4ec0\u4e48\u662f\u201c\u884c\u4e1a\u6807\u51c6\u201d？\u5728\u5f00\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/81573.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-24T18:59:13+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/81573.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/81573.html\",\"name\":\"SpringBoot \u96c6\u6210 OAuth2.0 \u8d44\u6e90\u670d\u52a1\u5668\u4e0e\u6388\u6743\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-07-24T18:59:13+00:00\",\"dateModified\":\"2026-07-24T18:59:13+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/81573.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/81573.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/81573.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SpringBoot \u96c6\u6210 OAuth2.0 \u8d44\u6e90\u670d\u52a1\u5668\u4e0e\u6388\u6743\u670d\u52a1\u5668\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SpringBoot \u96c6\u6210 OAuth2.0 \u8d44\u6e90\u670d\u52a1\u5668\u4e0e\u6388\u6743\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/81573.html","og_locale":"zh_CN","og_type":"article","og_title":"SpringBoot \u96c6\u6210 OAuth2.0 \u8d44\u6e90\u670d\u52a1\u5668\u4e0e\u6388\u6743\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u4e0a\u5468\u6709\u4f4d\u8bfb\u8005\u5728\u540e\u53f0\u63d0\u95ee：\u201c\u6211\u4eec\u516c\u53f8\u7684\u7cfb\u7edf\u8981\u5bf9\u5916\u63d0\u4f9b API \u63a5\u53e3，\u5ba2\u6237\u8981\u6c42\u7528 OAuth2.0 \u505a\u5b89\u5168\u8ba4\u8bc1，\u8fd9\u8be5\u600e\u4e48\u5b9e\u73b0\u5462？\u201d\u8fd9\u786e\u5b9e\u662f\u4e2a\u5f88\u5b9e\u9645\u7684\u9700\u6c42\u3002\u968f\u7740\u5fae\u670d\u52a1\u548c\u5f00\u653e\u5e73\u53f0\u7684\u5174\u8d77，OAuth2.0 \u5df2\u7ecf\u6210\u4e3a API \u5b89\u5168\u7684\u4e8b\u5b9e\u6807\u51c6\u3002\u4eca\u5929，\u6211\u5c31\u4ece\u96f6\u5f00\u59cb，\u624b\u628a\u624b\u5e26\u4f60\u5b9e\u73b0 SpringBoot \u4e2d\u7684 OAuth2.0 \u5b8c\u6574\u65b9\u6848\u3002\u4e00\u3001OAuth2.0\u4e3a\u4ec0\u4e48\u662f\u201c\u884c\u4e1a\u6807\u51c6\u201d？\u5728\u5f00","og_url":"https:\/\/www.wsisp.com\/helps\/81573.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-07-24T18:59:13+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"10 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/81573.html","url":"https:\/\/www.wsisp.com\/helps\/81573.html","name":"SpringBoot \u96c6\u6210 OAuth2.0 \u8d44\u6e90\u670d\u52a1\u5668\u4e0e\u6388\u6743\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-07-24T18:59:13+00:00","dateModified":"2026-07-24T18:59:13+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/81573.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/81573.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/81573.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"SpringBoot \u96c6\u6210 OAuth2.0 \u8d44\u6e90\u670d\u52a1\u5668\u4e0e\u6388\u6743\u670d\u52a1\u5668"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/81573","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=81573"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/81573\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=81573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=81573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=81573"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=81573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |