Spring security oauth2 password flow

Spring security oauth2 包含以下两个endpoint来实现Authorization Server:

AuthorizationEndpoint: 授权请求访问端点， 默认url: /oauth/authorize

TokenEndpoint: 获取access token的请求的访问端点， 默认url: /oauth/token

添加依赖

<dependency>
    <groupId>org.springframework.security.oauth</groupId>
    <artifactId>spring-security-oauth2</artifactId>
</dependency>

配置Authorization Server

@EnableAuthprizationServer注解， 配合实现了AuthorizationServerConfigurer的配置类来配置Authorization Server。

AuthorizationServerConfigurer中主要的配置有三个， 覆盖对应的方法即可：

ClientDetailsServiceConfigurer:

定义了client detail service, 可以简单的指定几个client， 或者指向数据库中的表。

可以存储client信息到内存中或数据库中， 即in-memory和JDBC两种实现。

AuthorizationServerSecurityConfigurer:

定义了token端点的安全策略

其中有两个重要的端点：

/oauth/check_token: 检查token的有效性

/oauth/token_key: 获取token的key

AuthorizationServerEndpointsConfigurer:

定义authorization endpoint, token endpoint以及token service。token service管理token相关的一切， 除了token的持久化是委托给TokenStore来实现， 默认的实现是DefaultTokenServices.

有三种类型的TokenStore:

InMemoryTokenStore: 默认实现， 存储在内存中。

JdbcTokenStore: token数据存储在关系型数据库中。

JWT 类型的TokenStore， 典型的是JwtTokenStore， 不存储到任何地方， 把所有的数据编码到token中， 因此token的撤回(revoke)实现起来优点麻烦。

配置：

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpHeaders;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.common.exceptions.OAuth2Exception;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.error.DefaultWebResponseExceptionTranslator;
import org.springframework.security.oauth2.provider.error.WebResponseExceptionTranslator;
import org.springframework.security.oauth2.provider.token.TokenEnhancerChain;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;

import java.util.Arrays;

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

  @Value("${security.oauth2.client.client-id}")
  private String clientId;

  @Value("${security.oauth2.client.client-secret}")
  private String clientCredentials;

  private final PasswordEncoder passwordEncoder;

  private final AuthenticationManager authenticationManager;

  private final DefaultTokenEnhancer defaultTokenEnhancer;
  
  private final UserDetailsService userDetailsService;

  @Autowired
  public AuthorizationServerConfig(PasswordEncoder passwordEncoder, AuthenticationManager authenticationManager,
                                   DefaultTokenEnhancer defaultTokenEnhancer,
                                   UserDetailsService userDetailsService) {
    this.passwordEncoder = passwordEncoder;
    this.authenticationManager = authenticationManager;
    this.defaultTokenEnhancer = defaultTokenEnhancer;
    this.userDetailsService = userDetailsService;
  }

  public void configure(ClientDetailsServiceConfigurer configurer) throws Exception {
    configurer
        .inMemory()
        .withClient(clientId)
        .secret(passwordEncoder.encode(clientCredentials))
        .authorizedGrantTypes("password", "refresh_token")
        .accessTokenValiditySeconds(3600);
  }

  @Override
  public void configure(final AuthorizationServerSecurityConfigurer oauthServer) {
    oauthServer.tokenKeyAccess("permitAll()")
        .checkTokenAccess("isAuthenticated()")
        .allowFormAuthenticationForClients(); // 默认通过basic authentication， 即加一个header为Authorization: Basic base64(username:password), 指定这个可以设置form提交， 把client-id, client-secret放到post参数中。
  }

  @Bean
  TokenStore tokenStore() {
    return new JwtTokenStore(jwtAccessTokenConverter());
  }

  @Bean
  public JwtAccessTokenConverter jwtAccessTokenConverter() {
    JwtAccessTokenConverter jwtConverter = new JwtAccessTokenConverter();
    jwtConverter.setSigningKey("your-sign-key");
    return jwtConverter;
  }

  @Bean
  public WebResponseExceptionTranslator loggingExceptionTranslator() {
    return new DefaultWebResponseExceptionTranslator() {
      @Override
      public ResponseEntity<OAuth2Exception> translate(Exception e) throws Exception {
        e.printStackTrace();
        ResponseEntity<OAuth2Exception> responseEntity = super.translate(e);
        HttpHeaders headers = new HttpHeaders();
        headers.setAll(responseEntity.getHeaders().toSingleValueMap());
        OAuth2Exception excBody = responseEntity.getBody();
        return new ResponseEntity<>(excBody, headers, responseEntity.getStatusCode());
      }
    };
  }

  public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
    TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
    tokenEnhancerChain.setTokenEnhancers(Arrays.asList(defaultTokenEnhancer, jwtAccessTokenConverter()));

    endpoints.authenticationManager(authenticationManager)
    .userDetailsService(userDetailsService)
    .tokenStore(tokenStore())
    .tokenEnhancer(tokenEnhancerChain)
    .exceptionTranslator(loggingExceptionTranslator());
  }

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
@Order(1)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  @Bean
  public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder(10);
  }

  @Bean
  public AuthenticationManager authenticationManagerBean() throws Exception {
    return this.authenticationManager();
  }

  protected void configure(HttpSecurity http) throws Exception {
    http
        .formLogin().permitAll()
        .and()
        .csrf().disable()
        .cors().disable()
        .authorizeRequests()
        .antMatchers(HttpMethod.OPTIONS).permitAll()
        .antMatchers("/oauth/**").permitAll()
        .anyRequest().authenticated();
  }
}

formLogin().permitAll()对password flow不是必须的， 只对implicit flow有影响。

当时测试implicit flow的时候确实是这样， 在访问/oauth/authorize之后， 需要登录， 登录后一直提示错误， 但没有错误信息， 从而获取不到token， 加了formLogin().permitAll()选项后就正常返回token了。

获取access token:

访问地址： POST localhost:8080/oauth/token

参数：client_id=clientId&client_secret=clientSecret&grant_type=password&username=username&password=password

刷新access token:

POST localhost:8080/oauth/token

参数：

client_id=clientId&client_secret=clientSecret&grant_type=refresh_token&scope=any&refresh_token=refreshToken

顺便介绍一下其他的grant type:

grant type授权类型一般有client credentials, password, implicit, authorization code, refresh。

client credentials是直接访问/oauth/token端点带grant_type

password 访问/oauth/token端点带grant_type

implicit 访问/oauth/authorize端点带response_type参数， 值为token， 然后会直接重定向到你指定的redirect_uri, url中带access_token参数

authorize code 先访问/oauth/authorize端点带response_type参数， 值为code， 然后它会返回一个code参数; 带上code参数访问/oauth/token端点获取access token。

refer:

https://www.baeldung.com/rest-api-spring-oauth2-angular

https://dzone.com/articles/spring-boot-oauth2-getting-the-authorization-code

https://walkingtree.tech/securing-microservices-oauth2/

https://projects.spring.io/spring-security-oauth/docs/oauth2.html