Spring Cloud入门-Oauth2授权之基于JWT完成单点登录(Hoxton版本)

你的名字 2021-09-21 01:28 372阅读 0赞

### 文章目录 ###

*   *  Spring Cloud入门系列汇总
     *  摘要
     *  单点登录简介
     *  创建oauth2-client模块
     *  修改授权服务器配置
     *  网页单点登录演示
     *  调用接口单点登录演示
     *  oauth2-client添加权限校验
     *  使用到的模块
     *  项目源码地址

> 项目使用的Spring Cloud为Hoxton版本，Spring Boot为2.2.2.RELEASE版本

## Spring Cloud入门系列汇总 ##

<table> 
 <thead> 
  <tr> 
   <th>序号</th> 
   <th>内容</th> 
   <th>链接地址</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>1</td> 
   <td>Spring Cloud入门-十分钟了解Spring Cloud</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103715146" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103715146</a></td> 
  </tr> 
  <tr> 
   <td>2</td> 
   <td>Spring Cloud入门-Eureka服务注册与发现(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103726655" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103726655</a></td> 
  </tr> 
  <tr> 
   <td>3</td> 
   <td>Spring Cloud入门-Ribbon服务消费者(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103729080" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103729080</a></td> 
  </tr> 
  <tr> 
   <td>4</td> 
   <td>Spring Cloud入门-Hystrix断路器(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103732497" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103732497</a></td> 
  </tr> 
  <tr> 
   <td>5</td> 
   <td>Spring Cloud入门-Hystrix Dashboard与Turbine断路器监控(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103734664" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103734664</a></td> 
  </tr> 
  <tr> 
   <td>6</td> 
   <td>Spring Cloud入门-OpenFeign服务消费者(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103735751" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103735751</a></td> 
  </tr> 
  <tr> 
   <td>7</td> 
   <td>Spring Cloud入门-Zuul服务网关(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103738851" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103738851</a></td> 
  </tr> 
  <tr> 
   <td>8</td> 
   <td>Spring Cloud入门-Config分布式配置中心(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103739628" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103739628</a></td> 
  </tr> 
  <tr> 
   <td>9</td> 
   <td>Spring Cloud入门-Bus消息总线(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103753372" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103753372</a></td> 
  </tr> 
  <tr> 
   <td>10</td> 
   <td>Spring Cloud入门-Sleuth服务链路跟踪(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103753896" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103753896</a></td> 
  </tr> 
  <tr> 
   <td>11</td> 
   <td>Spring Cloud入门-Consul服务注册发现与配置中心(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103756139" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103756139</a></td> 
  </tr> 
  <tr> 
   <td>12</td> 
   <td>Spring Cloud入门-Gateway服务网关(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103757927" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103757927</a></td> 
  </tr> 
  <tr> 
   <td>13</td> 
   <td>Spring Cloud入门-Admin服务监控中心(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103758697" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103758697</a></td> 
  </tr> 
  <tr> 
   <td>14</td> 
   <td>Spring Cloud入门-Oauth2授权的使用(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103761687" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103761687</a></td> 
  </tr> 
  <tr> 
   <td>15</td> 
   <td>Spring Cloud入门-Oauth2授权之JWT集成(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103763364" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103763364</a></td> 
  </tr> 
  <tr> 
   <td>16</td> 
   <td>Spring Cloud入门-Oauth2授权之基于JWT完成单点登录(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103766368" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103766368</a></td> 
  </tr> 
  <tr> 
   <td>17</td> 
   <td>Spring Cloud入门-Nacos实现注册和配置中心(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103769680" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103769680</a></td> 
  </tr> 
  <tr> 
   <td>18</td> 
   <td>Spring Cloud入门-Sentinel实现服务限流、熔断与降级(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103770879" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103770879</a></td> 
  </tr> 
  <tr> 
   <td>19</td> 
   <td>Spring Cloud入门-Seata处理分布式事务问题(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103786102" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103786102</a></td> 
  </tr> 
  <tr> 
   <td>20</td> 
   <td>Spring Cloud入门-汇总篇(Hoxton版本)</td> 
   <td><a href="https://blog.csdn.net/ThinkWon/article/details/103786588" rel="nofollow">https://blog.csdn.net/ThinkWon/article/details/103786588</a></td> 
  </tr> 
 </tbody> 
</table>

## 摘要 ##

Spring Cloud Security 为构建安全的SpringBoot应用提供了一系列解决方案，结合Oauth2可以实现单点登录功能，本文将对其单点登录用法进行详细介绍。

## 单点登录简介 ##

单点登录（Single Sign On）指的是当有多个系统需要登录时，用户只需登录一个系统，就可以访问其他需要登录的系统而无需登录。

## 创建oauth2-client模块 ##

> 这里我们创建一个oauth2-client服务作为需要登录的客户端服务，使用上一节中的oauth2-jwt-server服务作为授权服务，当我们在oauth2-jwt-server服务上登录以后，就可以直接访问oauth2-client需要登录的接口，来演示下单点登录功能。

在pom.xml中添加相关依赖：

<dependency>
    	<groupId>org.springframework.boot</groupId>
    	<artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
    	<groupId>org.springframework.cloud</groupId>
    	<artifactId>spring-cloud-starter-oauth2</artifactId>
    </dependency>
    <dependency>
    	<groupId>org.springframework.cloud</groupId>
    	<artifactId>spring-cloud-starter-security</artifactId>
    </dependency>

在application.yml中进行配置：

server:
      port: 9501
      servlet:
        session:
          cookie:
            # 防止cookie冲突，冲突会导致登录验证不通过
            name: OAUTH2-CLIENT-SESSIONID
    
    oauth2-service-url: http://localhost:9401
    
    spring:
      application:
        name: oauth2-client
    
    security:
      # 与oauth2-server对应的配置
      oauth2:
        client:
          client-id: admin
          client-secret: admin123456
          user-authorization-uri: ${ oauth2-service-url}/oauth/authorize
          access-token-uri: ${ oauth2-service-url}/oauth/token
        resource:
          jwt:
            key-uri: ${ oauth2-service-url}/oauth/token_key

在启动类上添加@EnableOAuth2Sso注解来启用单点登录功能：

@EnableOAuth2Sso
    @SpringBootApplication
    public class Oauth2ClientApplication { 
    
        public static void main(String[] args) { 
            SpringApplication.run(Oauth2ClientApplication.class, args);
        }
    
    }

添加接口用于获取当前登录用户信息：

@RestController
    @RequestMapping("/user")
    public class UserController { 
    
        @GetMapping("/getCurrentUser")
        public Object getCurrentUser(Authentication authentication) { 
            return authentication;
        }
    
    }

## 修改授权服务器配置 ##

修改oauth2-jwt-server模块中的AuthorizationServerConfig类，将绑定的跳转路径为[http://localhost:9501/login][http_localhost_9501_login]，并添加获取秘钥时的身份认证。

@Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter { 
        //以上省略一堆代码...
        
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
            clients.inMemory()
                    // 配置client_id
                    .withClient("admin")
                    // 配置client_secret
                    .secret(passwordEncoder.encode("admin123456"))
                    // 配置访问token的有效期
                    .accessTokenValiditySeconds(3600)
                    // 配置刷新token的有效期
                    .refreshTokenValiditySeconds(864000)
                    // 配置redirect_uri,用于授权成功后的跳转
                    // .redirectUris("http://www.baidu.com")
                    // 单点登录时配置
                    .redirectUris("http://localhost:9501/login")
                    // 自动授权配置
                    // .autoApprove(true)
                    // 配置申请的权限范围
                    .scopes("all")
                    // 配置grant_type,表示授权类型
                    .authorizedGrantTypes("authorization_code", "password", "refresh_token");
        }
    
        @Override
        public void configure(AuthorizationServerSecurityConfigurer security) throws Exception { 
            // 获取密钥需要身份认证，使用单点登录时必须配置
            security.tokenKeyAccess("isAuthenticated()");
        }
    }

## 网页单点登录演示 ##

启动oauth2-client服务和oauth2-jwt-server服务；

访问客户端需要授权的接口[http://localhost:9501/user/getCurrentUser][http_localhost_9501_user_getCurrentUser]会跳转到授权服务的登录界面；

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70]

进行登录操作后跳转到授权页面；

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 1]

授权后会跳转到原来需要权限的接口地址，展示登录用户信息；

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 2]

如果需要跳过授权操作进行自动授权可以添加`autoApprove(true)`配置：

@Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter { 
        //以上省略一堆代码...
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
            clients.inMemory()
                    // 配置client_id
                    .withClient("admin")
                    // 配置client_secret
                    .secret(passwordEncoder.encode("admin123456"))
                    // 配置访问token的有效期
                    .accessTokenValiditySeconds(3600)
                    // 配置刷新token的有效期
                    .refreshTokenValiditySeconds(864000)
                    // 配置redirect_uri,用于授权成功后的跳转
                    // .redirectUris("http://www.baidu.com")
                    // 单点登录时配置
                    .redirectUris("http://localhost:9501/login")
                    // 自动授权配置
                    .autoApprove(true)
                    // 配置申请的权限范围
                    .scopes("all")
                    // 配置grant_type,表示授权类型
                    .authorizedGrantTypes("authorization_code", "password", "refresh_token");
        }
    }

## 调用接口单点登录演示 ##

> 这里我们使用Postman来演示下如何使用正确的方式调用需要登录的客户端接口。

访问客户端需要登录的接口：[http://localhost:9501/user/getCurrentUser][http_localhost_9501_user_getCurrentUser]

使用Oauth2认证方式获取访问令牌：

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 3]

输入获取访问令牌的相关信息，点击请求令牌：

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 4]

此时会跳转到授权服务器进行登录操作：

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 5]

登录成功后使用获取到的令牌：

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 6]

最后请求接口可以获取到如下信息：

{ 
    	"authorities": [{ 
    		"authority": "admin"
    	}],
    	"details": { 
    		"remoteAddress": "0:0:0:0:0:0:0:1",
    		"sessionId": "6F5A553BB678C7272145FF9FF2A5D8F4",
    		"tokenValue": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJqb3Vyd29uIiwic2NvcGUiOlsiYWxsIl0sImV4cCI6MTU3NzY4OTc2NiwiYXV0aG9yaXRpZXMiOlsiYWRtaW4iXSwianRpIjoiZjAwYjVkMGUtNjFkYi00YjBmLTkyNTMtOWQxZDYwOWM4ZWZmIiwiY2xpZW50X2lkIjoiYWRtaW4iLCJlbmhhbmNlIjoiZW5oYW5jZSBpbmZvIn0.zdgFTWJt3DnAsjpQRU6rNA_iM7gVHX7E9bCyF73MOSM",
    		"tokenType": "bearer",
    		"decodedDetails": null
    	},
    	"authenticated": true,
    	"userAuthentication": { 
    		"authorities": [{ 
    			"authority": "admin"
    		}],
    		"details": null,
    		"authenticated": true,
    		"principal": "jourwon",
    		"credentials": "N/A",
    		"name": "jourwon"
    	},
    	"clientOnly": false,
    	"oauth2Request": { 
    		"clientId": "admin",
    		"scope": ["all"],
    		"requestParameters": { 
    			"client_id": "admin"
    		},
    		"resourceIds": [],
    		"authorities": [],
    		"approved": true,
    		"refresh": false,
    		"redirectUri": null,
    		"responseTypes": [],
    		"extensions": { },
    		"grantType": null,
    		"refreshTokenRequest": null
    	},
    	"principal": "jourwon",
    	"credentials": "",
    	"name": "jourwon"
    }

## oauth2-client添加权限校验 ##

添加配置开启基于方法的权限校验：

@Configuration
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    @Order(101)
    public class SecurityConfig extends WebSecurityConfigurerAdapter { 
    }

在UserController中添加需要admin权限的接口：

@RestController
    @RequestMapping("/user")
    public class UserController { 
    
        @PreAuthorize("hasAuthority('admin')")
        @GetMapping("/auth/admin")
        public Object adminAuth() { 
            return "Has admin auth!";
        }
    
    }

访问需要admin权限的接口：[http://localhost:9501/user/auth/admin][http_localhost_9501_user_auth_admin]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 7]

使用没有`admin`权限的帐号，比如`andy:123456`获取令牌后访问该接口，会发现没有权限访问。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 8]

## 使用到的模块 ##

springcloud-learning
    ├── oauth2-jwt-server -- 使用jwt的oauth2认证测试服务
    └── oauth2-client -- 单点登录的oauth2客户端服务

## 项目源码地址 ##

[GitHub项目源码地址][GitHub]

[http_localhost_9501_login]: http://localhost:9501/login
[http_localhost_9501_user_getCurrentUser]: http://localhost:9501/user/getCurrentUser
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70]: /images/20210920/15388c267c9b42b68858f1e8cbfdc9d7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 1]: /images/20210920/cbee44e01a9346c0a9d8675158408977.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 2]: /images/20210920/a4dd8080292549a9bd2672ab400fdc81.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 3]: /images/20210920/416d86401e5d4031addc56ac3414a233.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 4]: /images/20210920/fbc0c39b9aa044b895ed55a9d481eabb.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 5]: /images/20210920/f55b81da0fb34c039b247570e52cf0ea.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 6]: /images/20210920/ce9de73e43dc428e9c4987fea3cf76bf.png
[http_localhost_9501_user_auth_admin]: http://localhost:9501/user/auth/admin
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 7]: /images/20210920/8882a61730e441afbeae126d55d25cf5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly90aGlua3dvbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 8]: /images/20210920/716d736ad87a41419dfa5222c4d7db09.png
[GitHub]: https://github.com/JourWon/springcloud-learning