spring security oauth2 client_credentials模式

左手的ㄟ右手 2022-01-17 09:37 449阅读 0赞

[为什么80%的码农都做不了架构师？>>> ][80_] ![hot3.png][]

## 序 ##

本文主要简单介绍一下spring security oauth2的client\_credentials模式

## maven ##

<dependency>
    			<groupId>org.springframework.security.oauth</groupId>
    			<artifactId>spring-security-oauth2</artifactId>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-security</artifactId>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-web</artifactId>
    		</dependency>

## auth server config ##

@Configuration
    @EnableAuthorizationServer //提供/oauth/authorize,/oauth/token,/oauth/check_token,/oauth/confirm_access,/oauth/error
    public class OAuth2ServerConfig extends AuthorizationServerConfigurerAdapter {
    
    
        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer
                    .tokenKeyAccess("permitAll()")
                    .checkTokenAccess("isAuthenticated()") //allow check token
                    .allowFormAuthenticationForClients();
        }
    
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                    .withClient("demoApp")
                    .secret("demoAppSecret")
                    .authorizedGrantTypes("client_credentials", "password", "refresh_token")
                    .scopes("all")
                    .resourceIds("oauth2-resource")
                    .accessTokenValiditySeconds(1200)
                    .refreshTokenValiditySeconds(50000);
        }
    
    }

## resource server config ##

@Configuration
    @EnableResourceServer
    public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    
    }

## demo controller ##

@RestController
    @RequestMapping("/api")
    public class DemoController {
    
        @GetMapping("/blog/{id}")
        public String getBlogById(@PathVariable long id) {
            return "this is blog "+id;
        }
    }

## 验证 ##

### 没有token请求资源 ###

curl -i -H "Accept: application/json" -X GET http://localhost:8080/api/blog/1

HTTP/1.1 401
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-Frame-Options: DENY
    Cache-Control: no-store
    Pragma: no-cache
    WWW-Authenticate: Bearer realm="oauth2-resource", error="unauthorized", error_description="Full authentication is required to access this resource"
    Content-Type: application/json;charset=UTF-8
    Transfer-Encoding: chunked
    Date: Sat, 02 Dec 2017 14:31:51 GMT
    
    {"error":"unauthorized","error_description":"Full authentication is required to access this resource"}

### client\_credentials请求授权 ###

curl -H "Accept: application/json" demoApp:demoAppSecret@localhost:8080/oauth/token -d grant_type=client_credentials

或者

curl -H "Accept: application/json" http://localhost:8080/oauth/token -d "grant_type=client_credentials&client_id=demoApp&client_secret=demoAppSecret"

{"access_token":"6d0ee2b2-c803-49bf-a813-a25bfb59a976","token_type":"bearer","expires_in":1199,"scope":"all"}

### 携带token请求资源 ###

curl -i -H "Accept: application/json" -H "Authorization: Bearer 6d0ee2b2-c803-49bf-a813-a25bfb59a976" -X GET http://localhost:8080/api/blog/1

或者

curl -i -X GET http://localhost:8080/api/blog/1?access_token=fe8bcab3-1d33-4ef1-b1d0-bd142a480af2

> 不过这种把token暴露在url中不是太安全

HTTP/1.1 200
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-Frame-Options: DENY
    X-Application-Context: application
    Content-Type: application/json;charset=UTF-8
    Content-Length: 14
    Date: Sat, 02 Dec 2017 14:31:09 GMT
    
    this is blog 1

### check token ###

curl -i -X POST -H "Accept: application/json" -u "demoApp:demoAppSecret" http://localhost:8080/oauth/check_token?token=3d47e053-de16-4e6f-8ec7-f9247f425a8e

HTTP/1.1 403
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-Frame-Options: DENY
    Content-Type: application/json;charset=UTF-8
    Transfer-Encoding: chunked
    Date: Sat, 02 Dec 2017 14:50:32 GMT
    
    {"timestamp":1512226232386,"status":403,"error":"Forbidden","message":"Access is denied","path":"/oauth/check_token"}

需要配置

@Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer
                    .tokenKeyAccess("permitAll()")
                    .checkTokenAccess("isAuthenticated()") //allow check token
                    .allowFormAuthenticationForClients();
        }

成功返回

HTTP/1.1 200
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-Frame-Options: DENY
    X-Application-Context: application
    Content-Type: application/json;charset=UTF-8
    Transfer-Encoding: chunked
    Date: Sat, 02 Dec 2017 14:48:33 GMT
    
    {"aud":["oauth2-resource"],"scope":["read"],"exp":1512227200,"client_id":"demoApp"}

token非法

HTTP/1.1 400
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: 0
    X-Frame-Options: DENY
    X-Application-Context: application
    Cache-Control: no-store
    Pragma: no-cache
    Content-Type: application/json;charset=UTF-8
    Transfer-Encoding: chunked
    Date: Sat, 02 Dec 2017 14:51:33 GMT
    Connection: close
    
    {"error":"invalid_token","error_description":"Token was not recognised"}

## doc ##

*  [Trying out OAuth2 via CURL][]
 *  [403 Forbidden on /oauth/check\_token \#28][403 Forbidden on _oauth_check_token _28]
 *  [How to obtain refresh token when using client credentials? \#195][How to obtain refresh token when using client credentials_ _195]
 *  [Spring OAuth Authorization Server Requires Scope][]
 *  [Spring Security OAuth2 – Simple Token Revocation][Spring Security OAuth2 _ Simple Token Revocation]

转载于:https://my.oschina.net/go4it/blog/1583970

[80_]: https://my.oschina.net/u/2663968/blog/3051541
[hot3.png]: /images/20220117/ea014245717748d09fda763e2edf1aab.png
[Trying out OAuth2 via CURL]: https://labs.hybris.com/2012/06/18/trying-out-oauth2-via-curl/
[403 Forbidden on _oauth_check_token _28]: https://github.com/royclarkson/spring-rest-service-oauth/issues/28
[How to obtain refresh token when using client credentials_ _195]: https://github.com/bshaffer/oauth2-server-php/issues/195
[Spring OAuth Authorization Server Requires Scope]: https://stackoverflow.com/questions/39756748/spring-oauth-authorization-server-requires-scope
[Spring Security OAuth2 _ Simple Token Revocation]: http://www.baeldung.com/spring-security-oauth-revoke-tokens