Spring Security OAuth2 token权限隔离实例解析

在本文中，将介绍如何使用Spring Security来实现OAuth2 token的权限隔离。我们将阐述基于Spring Boot的实现方式及其持久化方案，并提供两条示例。

情境描述

假设一个应用程序需要提供给多个客户端进行访问，而每个客户端都有自己的用户组并需要访问特定的资源。在这种情况下，通常会使用OAuth2来实现客户端和服务端之间的安全通信以及对资源的访问控制。

但是，传统的OAuth2实现方式，可能无法进行对特定用户组的权限控制，特定用户组所拥有的权限被限制在了固定的范围内。

基于Spring Security OAuth2的实现方式，能够让你对特定用户组进行权限控制，帮助你更好地实现OAuth2。

实现方式

1. 基于Spring Boot的OAuth2实现方式

基于Spring Boot实现OAuth2，你可以使用Spring Security OAuth2的默认配置来实现。在这种情况下，你需要进行以下配置：

添加Spring Security OAuth2依赖

xml <dependency> <groupId>org.springframework.security.oauth</groupId> <artifactId>spring-security-oauth2</artifactId> <version>2.3.4.RELEASE</version> </dependency>
添加Spring Security依赖

xml <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-config</artifactId> <version>5.3.1.RELEASE</version> </dependency>

配置认证服务器

```java
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

private final PasswordEncoder passwordEncoder;
private final AuthenticationManager authenticationManager;
private final DataSource dataSource;

@Autowired
public AuthorizationServerConfig(
        PasswordEncoder passwordEncoder,
        AuthenticationManager authenticationManager,
        DataSource dataSource) {
    this.passwordEncoder = passwordEncoder;
    this.authenticationManager = authenticationManager;
    this.dataSource = dataSource;
}

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.jdbc(dataSource).passwordEncoder(passwordEncoder);
}

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
    endpoints
            .authenticationManager(authenticationManager)
            .tokenStore(tokenStore());
}

@Bean
public TokenStore tokenStore() {
    return new JdbcTokenStore(dataSource);
}

}
```

配置资源服务器

```java
@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

private final TokenStore tokenStore;
private final DataSource dataSource;

@Autowired
public ResourceServerConfig(TokenStore tokenStore, DataSource dataSource) {
    this.tokenStore = tokenStore;
    this.dataSource = dataSource;
}

@Override
public void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/api/public/**").permitAll()
            .antMatchers(HttpMethod.POST, "/api/user").hasRole("ADMIN")
            .antMatchers(HttpMethod.PUT, "/api/user/**").hasRole("ADMIN")
            .antMatchers(HttpMethod.DELETE, "/api/user/**").hasRole("ADMIN")
            .anyRequest().hasRole("USER");
}

@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
    resources.tokenStore(tokenStore);
}

@Bean
public TokenStore tokenStore() {
    return new JdbcTokenStore(dataSource);
}

}
```

上述配置中，我们使用了JdbcTokenStore将token存储到数据库中。

2. OAuth2 token的权限隔离方案

如果你希望对不同的用户组进行不同的资源访问控制，那么基于Spring Security OAuth2实现的权限控制方案，就是你的不二选择。

在这种方案下，我们需要做如下配置：

配置不同用户组的权限

```java
public enum Role {
ADMIN,
USER
}

public class CustomUserDetails extends User {

private final Set<Role> roles;

public CustomUserDetails(String username,
                         String password,
                         boolean enabled,
                         boolean accountNonExpired,
                         boolean credentialsNonExpired,
                         boolean accountNonLocked,
                         Collection<? extends GrantedAuthority> authorities,
                         Set<Role> roles) {
    super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
    this.roles = roles;
}

public Set<Role> getRoles() {
    return roles;
}

}

@Service
public class UserService implements UserDetailsService {

private final PasswordEncoder passwordEncoder;

@Autowired
public UserService(PasswordEncoder passwordEncoder) {
    this.passwordEncoder = passwordEncoder;
}

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    Set<Role> roles = new HashSet<>();
    if ("admin".equals(username)) {
        roles.add(Role.ADMIN);
    } else {
        roles.add(Role.USER);
    }
    return new CustomUserDetails(
            username,
            passwordEncoder.encode("password"),
            true,
            true,
            true,
            true,
            AuthorityUtils.createAuthorityList("ROLE_" + roles.stream().map(Object::toString).collect(Collectors.joining(",ROLE_"))),
            roles);
}

}
```

上述代码中，我们为不同的用户组定义了不同的权限，将不同的用户组和不同的权限关联起来。

配置OAuth2的提供者

OAuth2的提供者需要继承AuthorizationServerConfigurerAdapter并重写configure()方法，如下所示：

```java
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    private final PasswordEncoder passwordEncoder;
    private final AuthenticationManager authenticationManager;
    private final DataSource dataSource;
    private final UserDetailsService userDetailsService;

    @Autowired
    public AuthorizationServerConfig(
            PasswordEncoder passwordEncoder,
            AuthenticationManager authenticationManager,
            DataSource dataSource,
            UserDetailsService userDetailsService) {
        this.passwordEncoder = passwordEncoder;
        this.authenticationManager = authenticationManager;
        this.dataSource = dataSource;
        this.userDetailsService = userDetailsService;
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
        endpoints
                .authenticationManager(authenticationManager)
                .userDetailsService(userDetailsService)
                .tokenServices(tokenServices())
                .tokenStore(tokenStore());
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.jdbc(dataSource).passwordEncoder(passwordEncoder);
    }

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

    @Bean
    public DefaultTokenServices tokenServices() {
        DefaultTokenServices tokenServices = new DefaultTokenServices();
        tokenServices.setTokenStore(tokenStore());
        tokenServices.setSupportRefreshToken(true);
        tokenServices.setAccessTokenValiditySeconds(1800);
        tokenServices.setRefreshTokenValiditySeconds(3600);
        tokenServices.setAuthenticationManager(authenticationManager);
        return tokenServices;
    }
}
```

在上述代码中，我们向AuthorizationServerEndpointsConfigurer中添加了一个UserDetailsService，从而构建了不同的用户组之间的权限关系。

配置资源服务器

```java
@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

private final TokenStore tokenStore;

@Autowired
public ResourceServerConfig(TokenStore tokenStore) {
    this.tokenStore = tokenStore;
}

@Override
public void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/api/public/**").permitAll()
            .antMatchers(HttpMethod.POST, "/api/user").hasAnyRole("ADMIN")
            .antMatchers(HttpMethod.PUT, "/api/user/**").hasAnyRole("ADMIN")
            .antMatchers(HttpMethod.DELETE, "/api/user/**").hasAnyRole("ADMIN")
            .antMatchers(HttpMethod.GET, "/api/user/**").authenticated()
            .anyRequest().authenticated();
}

@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
    resources.tokenStore(tokenStore);
}

}
```

上述代码中，我们使用hasAnyRole()配置不同的用户组，从而完成了OAuth2的权限隔离。

示例

以下是一个使用Spring Security OAuth2进行集成测试的示例：

授权并获取Token

bash curl -X POST \ -H "Content-Type: application/x-www-form-urlencoded" \ -u "client:secret" \ "http://localhost:8080/oauth/token?grant_type=password&username=user&password=password"
刷新Token

bash curl -X POST \ -H "Content-Type: application/x-www-form-urlencoded" \ -u "client:secret" \ "http://localhost:8080/oauth/token?grant_type=refresh_token&refresh_token=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
通过Token访问资源

bash curl -X GET \ -H "Authorization: Bearer XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" \ "http://localhost:8080/api/user/123"

以上是一个使用Spring Security OAuth2进行OAuth2 token权限隔离实现的完整攻略。

本站文章如无特殊说明，均为本站原创，如若转载，请注明出处：Spring Security OAuth2 token权限隔离实例解析 - Python技术站

Spring Security OAuth2 token权限隔离实例解析

Spring Security OAuth2 token权限隔离实例解析

情境描述

实现方式

1. 基于Spring Boot的OAuth2实现方式

2. OAuth2 token的权限隔离方案

示例

相关文章