\u522b\u53eb\u6211\u5927\u795e，\u53eb\u6211 Alex \u5c31\u597d\u3002<\/p>\n
\u5927\u5bb6\u597d，\u6211\u662f Alex\u3002\u5728\u5fae\u670d\u52a1\u67b6\u6784\u4e2d，\u670d\u52a1\u95f4\u7684\u5b89\u5168\u901a\u4fe1\u662f\u4e00\u4e2a\u6838\u5fc3\u95ee\u9898\u3002Spring Security 6 \u5bf9 OAuth2 \u8d44\u6e90\u670d\u52a1\u5668\u7684\u652f\u6301\u6709\u4e86\u91cd\u5927\u6539\u8fdb\u3002\u4eca\u5929，\u6211\u60f3\u548c\u5927\u5bb6\u5206\u4eab\u4e00\u4e0b\u5982\u4f55\u4f7f\u7528 Spring Security OAuth2 \u6784\u5efa\u5b89\u5168\u7684\u8d44\u6e90\u670d\u52a1\u5668\u3002<\/p>\n
{
\n "header": {
\n "alg": "RS256",
\n "typ": "JWT"
\n },
\n "payload": {
\n "sub": "user123",
\n "iss": "https:\/\/auth.example.com",
\n "aud": "resource-server",
\n "exp": 1699999999,
\n "scope": "read write",
\n "roles": ["USER", "ADMIN"]
\n }
\n}<\/p>\n
@Configuration
\n@EnableWebSecurity
\npublic class ResourceServerConfig {<\/p>\n
@Bean
\n public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
\n http
\n .authorizeHttpRequests(authorize -> authorize
\n .requestMatchers("\/api\/public\/**").permitAll()
\n .requestMatchers("\/api\/admin\/**").hasRole("ADMIN")
\n .requestMatchers("\/api\/user\/**").hasAnyRole("USER", "ADMIN")
\n .anyRequest().authenticated()
\n )
\n .oauth2ResourceServer(oauth2 -> oauth2
\n .jwt(jwt -> jwt
\n .jwtAuthenticationConverter(jwtAuthenticationConverter())
\n )
\n );
\n return http.build();
\n }<\/p>\n
@Bean
\n public JwtAuthenticationConverter jwtAuthenticationConverter() {
\n JwtGrantedAuthoritiesConverter authoritiesConverter = new JwtGrantedAuthoritiesConverter();
\n authoritiesConverter.setAuthorityPrefix("ROLE_");
\n authoritiesConverter.setAuthoritiesClaimName("roles");<\/p>\n
JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
\n converter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
\n converter.setPrincipalClaimName("sub");
\n return converter;
\n }
\n}<\/p>\n
@Configuration
\npublic class JwtConfig {<\/p>\n
@Bean
\n public JwtDecoder jwtDecoder() {
\n \/\/ \u4f7f\u7528 JWKS \u7aef\u70b9
\n NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(
\n "https:\/\/auth.example.com\/.well-known\/jwks.json"
\n ).build();<\/p>\n
\/\/ \u914d\u7f6e\u9a8c\u8bc1\u5668
\n OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(
\n "https:\/\/auth.example.com"
\n );
\n OAuth2TokenValidator<Jwt> withAudience = audienceValidator();<\/p>\n
jwtDecoder.setJwtValidator(withIssuer.and(withAudience));
\n return jwtDecoder;
\n }<\/p>\n
private OAuth2TokenValidator<Jwt> audienceValidator() {
\n return jwt -> {
\n List<String> audience = jwt.getAudience();
\n if (audience != null && audience.contains("resource-server")) {
\n return OAuth2TokenValidatorResult.success();
\n }
\n return OAuth2TokenValidatorResult.failure(
\n new OAuth2Error("invalid_token", "Invalid audience", null)
\n );
\n };
\n }
\n}<\/p>\n
@Service
\npublic class OrderService {<\/p>\n
@PreAuthorize("hasRole('USER')")
\n public Order getOrder(Long orderId) {
\n \/\/ \u67e5\u8be2\u8ba2\u5355
\n return orderRepository.findById(orderId).orElse(null);
\n }<\/p>\n
@PreAuthorize("hasRole('ADMIN') or @orderSecurity.isOwner(#orderId, authentication)")
\n public void updateOrder(Long orderId, OrderUpdateRequest request) {
\n \/\/ \u66f4\u65b0\u8ba2\u5355
\n }<\/p>\n
@PostAuthorize("returnObject == null or returnObject.customerId == authentication.name")
\n public Order getOrderDetail(Long orderId) {
\n \/\/ \u67e5\u8be2\u8ba2\u5355\u8be6\u60c5
\n return orderRepository.findById(orderId).orElse(null);
\n }
\n}<\/p>\n
@Component("orderSecurity")
\npublic class OrderSecurity {<\/p>\n
@Autowired
\n private OrderRepository orderRepository;<\/p>\n
public boolean isOwner(Long orderId, Authentication authentication) {
\n Order order = orderRepository.findById(orderId).orElse(null);
\n return order != null &&
\n order.getCustomerId().equals(authentication.getName());
\n }
\n}<\/p>\n
@Component
\npublic class CustomPermissionEvaluator implements PermissionEvaluator {<\/p>\n
@Override
\n public boolean hasPermission(Authentication authentication, Object targetDomain, Object permission) {
\n if (authentication == null || !authentication.isAuthenticated()) {
\n return false;
\n }<\/p>\n
String targetType = targetDomain.getClass().getSimpleName();
\n return checkPermission(authentication, targetType, permission.toString());
\n }<\/p>\n
@Override
\n public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
\n \/\/ \u5b9e\u73b0\u903b\u8f91
\n return false;
\n }<\/p>\n
private boolean checkPermission(Authentication authentication, String targetType, String permission) {
\n \/\/ \u81ea\u5b9a\u4e49\u6743\u9650\u68c0\u67e5\u903b\u8f91
\n return authentication.getAuthorities().stream()
\n .anyMatch(auth -> auth.getAuthority().equals(targetType + ":" + permission));
\n }
\n}<\/p>\n
@Component
\npublic class TenantContext {<\/p>\n
private static final ThreadLocal<String> CURRENT_TENANT = new ThreadLocal<>();<\/p>\n
public static void setCurrentTenant(String tenant) {
\n CURRENT_TENANT.set(tenant);
\n }<\/p>\n
public static String getCurrentTenant() {
\n return CURRENT_TENANT.get();
\n }<\/p>\n
public static void clear() {
\n CURRENT_TENANT.remove();
\n }
\n}<\/p>\n
@Component
\npublic class TenantJwtDecoder implements JwtDecoder {<\/p>\n
@Autowired
\n private TenantRepository tenantRepository;<\/p>\n
@Override
\n public Jwt decode(String token) throws JwtException {
\n Jwt jwt = JwtDecoders.fromIssuerLocation("https:\/\/auth.example.com").decode(token);<\/p>\n
String tenantId = jwt.getClaimAsString("tenant_id");
\n TenantContext.setCurrentTenant(tenantId);<\/p>\n
return jwt;
\n }
\n}<\/p>\n
@SpringBootTest
\n@AutoConfigureMockMvc
\npublic class ResourceServerTest {<\/p>\n
@Autowired
\n private MockMvc mockMvc;<\/p>\n
@Test
\n void testPublicEndpoint() throws Exception {
\n mockMvc.perform(get("\/api\/public\/info"))
\n .andExpect(status().isOk());
\n }<\/p>\n
@Test
\n void testProtectedEndpointWithoutToken() throws Exception {
\n mockMvc.perform(get("\/api\/user\/profile"))
\n .andExpect(status().isUnauthorized());
\n }<\/p>\n
@Test
\n @WithMockJwt(roles = "USER", subject = "user123")
\n void testProtectedEndpointWithToken() throws Exception {
\n mockMvc.perform(get("\/api\/user\/profile"))
\n .andExpect(status().isOk());
\n }<\/p>\n
@Test
\n @WithMockJwt(roles = "USER")
\n void testAdminEndpointWithUserRole() throws Exception {
\n mockMvc.perform(get("\/api\/admin\/users"))
\n .andExpect(status().isForbidden());
\n }
\n}<\/p>\n
@Retention(RetentionPolicy.RUNTIME)
\n@WithSecurityContext(factory = WithMockJwtSecurityContextFactory.class)
\npublic @interface WithMockJwt {
\n String[] roles() default {};
\n String subject() default "user";
\n String[] scopes() default {};
\n}<\/p>\n
public class WithMockJwtSecurityContextFactory implements WithSecurityContextFactory<WithMockJwt> {<\/p>\n
@Override
\n public SecurityContext createSecurityContext(WithMockJwt annotation) {
\n SecurityContext context = SecurityContextHolder.createEmptyContext();<\/p>\n
List<GrantedAuthority> authorities = new ArrayList<>();
\n for (String role : annotation.roles()) {
\n authorities.add(new SimpleGrantedAuthority("ROLE_" + role));
\n }
\n for (String scope : annotation.scopes()) {
\n authorities.add(new SimpleGrantedAuthority("SCOPE_" + scope));
\n }<\/p>\n
Jwt jwt = Jwt.withTokenValue("mock-token")
\n .header("alg", "none")
\n .subject(annotation.subject())
\n .claim("roles", Arrays.asList(annotation.roles()))
\n .claim("scope", String.join(" ", annotation.scopes()))
\n .build();<\/p>\n
JwtAuthenticationToken authentication = new JwtAuthenticationToken(jwt, authorities);
\n context.setAuthentication(authentication);<\/p>\n
return context;
\n }
\n}<\/p>\n
spring:
\n security:
\n oauth2:
\n resourceserver:
\n jwt:
\n issuer-uri: https:\/\/auth.example.com
\n jwk-set-uri: https:\/\/auth.example.com\/.well-known\/jwks.json
\n audiences:
\n – resource-server<\/p>\n
@Component
\npublic class CustomJwtAuthenticationEntryPoint implements AuthenticationEntryPoint {<\/p>\n
@Override
\n public void commence(HttpServletRequest request, HttpServletResponse response,
\n AuthenticationException authException) throws IOException {<\/p>\n
response.setContentType(MediaType.APPLICATION_JSON_VALUE);
\n response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);<\/p>\n
Map<String, Object> error = new HashMap<>();
\n error.put("error", "Unauthorized");
\n error.put("message", authException.getMessage());
\n error.put("path", request.getRequestURI());<\/p>\n
new ObjectMapper().writeValue(response.getOutputStream(), error);
\n }
\n}<\/p>\n
@Component
\npublic class CustomAccessDeniedHandler implements AccessDeniedHandler {<\/p>\n
@Override
\n public void handle(HttpServletRequest request, HttpServletResponse response,
\n AccessDeniedException accessDeniedException) throws IOException {<\/p>\n
response.setContentType(MediaType.APPLICATION_JSON_VALUE);
\n response.setStatus(HttpServletResponse.SC_FORBIDDEN);<\/p>\n
Map<String, Object> error = new HashMap<>();
\n error.put("error", "Forbidden");
\n error.put("message", "You don't have permission to access this resource");
\n error.put("path", request.getRequestURI());<\/p>\n
new ObjectMapper().writeValue(response.getOutputStream(), error);
\n }
\n}<\/p>\n
Spring Security OAuth2 \u8d44\u6e90\u670d\u52a1\u5668\u4e3a\u6211\u4eec\u63d0\u4f9b\u4e86\u5f3a\u5927\u7684\u5b89\u5168\u4fdd\u62a4\u80fd\u529b\u3002\u901a\u8fc7\u5408\u7406\u914d\u7f6e，\u6211\u4eec\u53ef\u4ee5\u6784\u5efa\u51fa\u65e2\u5b89\u5168\u53c8\u7075\u6d3b\u7684\u5fae\u670d\u52a1\u67b6\u6784\u3002<\/p>\n
\u8fd9\u5176\u5b9e\u53ef\u4ee5\u66f4\u4f18\u96c5\u4e00\u70b9\u3002<\/p>\n
\u5e0c\u671b\u8fd9\u7bc7\u6587\u7ae0\u80fd\u5e2e\u52a9\u5927\u5bb6\u66f4\u597d\u5730\u7406\u89e3\u548c\u4f7f\u7528 Spring Security OAuth2\u3002\u5982\u679c\u4f60\u6709\u4efb\u4f55\u95ee\u9898，\u6b22\u8fce\u5728\u8bc4\u8bba\u533a\u7559\u8a00\u3002<\/p>\n
\u5173\u4e8e\u4f5c\u8005：\u6211\u662f Alex，\u4e00\u4e2a\u5728 CSDN \u5199 Java \u67b6\u6784\u601d\u8003\u7684\u6696\u7537\u3002\u559c\u6b22\u624b\u51b2\u5496\u5561，\u517b\u4e86\u4e00\u53ea\u53eb"Java"\u7684\u62c9\u5e03\u62c9\u591a\u3002\u5982\u679c\u6211\u7684\u6587\u7ae0\u5bf9\u4f60\u6709\u5e2e\u52a9，\u6b22\u8fce\u5173\u6ce8\u6211，\u4e00\u8d77\u63a2\u8ba8 Java \u6280\u672f\u7684\u4f18\u96c5\u4e4b\u9053\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
Spring Security OAuth2 \u8d44\u6e90\u670d\u52a1\u5668：\u6784\u5efa\u5b89\u5168\u7684\u5fae\u670d\u52a1\u67b6\u6784\u522b\u53eb\u6211\u5927\u795e，\u53eb\u6211 Alex \u5c31\u597d\u3002\u4e00\u3001\u5f15\u8a00
\n\u5927\u5bb6\u597d，\u6211\u662f Alex\u3002\u5728\u5fae\u670d\u52a1\u67b6\u6784\u4e2d，\u670d\u52a1\u95f4\u7684\u5b89\u5168\u901a\u4fe1\u662f\u4e00\u4e2a\u6838\u5fc3\u95ee\u9898\u3002Spring Security 6 \u5bf9 OAuth2 \u8d44\u6e90\u670d\u52a1\u5668\u7684\u652f\u6301\u6709\u4e86\u91cd\u5927\u6539\u8fdb\u3002\u4eca\u5929，\u6211\u60f3\u548c\u5927\u5bb6\u5206\u4eab\u4e00\u4e0b\u5982\u4f55\u4f7f\u7528 Spring Security OAuth2 \u6784\u5efa\u5b89\u5168\u7684\u8d44\u6e90\u670d\u52a1\u5668\u3002
\n\u4e8c\u3001OAuth2 \u8d44\u6e90\u670d\u52a1\u5668<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[99,101,1348],"topic":[],"class_list":["post-95961","post","type-post","status-publish","format-standard","hentry","category-server","tag-java","tag-spring","tag-1348"],"yoast_head":"\n