SpringSecurity OAuth2单点登录和登出的实现

一、前言

本文主要介绍如何使用Spring Security OAuth2实现单点登录和登出的功能，同时提供两个完整的示例，让读者更加容易的理解和实践。

二、单点登录和登出的实现

2.1 单点登录

在Spring Security OAuth2中实现单点登录的功能需要涉及到以下几个组件：

1. OAuth2认证服务器：负责认证用户并颁发令牌
2. OAuth2客户端：使用令牌访问资源服务器
3. 资源服务器：根据令牌适当的向客户端提供资源

步骤如下：

1. 配置OAuth2认证服务器

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private DataSource dataSource;

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.jdbc(dataSource);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
                .authenticationManager(authenticationManager)
                .tokenStore(tokenStore());
    }
}

上述代码使用了JdbcTokenStore来保存令牌，将客户端信息保存在数据的oauth_client_details表中。

1. 配置OAuth2客户端

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private ClientDetailsService clientDetailsService;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService)
                .passwordEncoder(passwordEncoder());
    }

    @Bean
    public JdbcClientDetailsService jdbcClientDetailsService() {
        return new JdbcClientDetailsService(dataSource);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/oauth/**").permitAll()
                .antMatchers("/login/**").permitAll()
                .anyRequest().authenticated()
                .and().formLogin()
                .and().logout().logoutSuccessUrl("/login").permitAll()
                .and().rememberMe();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.parentAuthenticationManager(authenticationManagerBean());
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService)
                .passwordEncoder(passwordEncoder());
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    @Bean
    public UserDetailsService userDetailsServiceBean() throws Exception {
        return super.userDetailsServiceBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/login", "/oauth/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .logoutUrl("/logout")
                .deleteCookies("JSESSIONID")
                .clearAuthentication(true)
                .invalidateHttpSession(true)
                .logoutSuccessUrl("/login")
                .permitAll()
                .and()
                .rememberMe();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService())
                .passwordEncoder(passwordEncoder());
    }

    @Override
    protected UserDetailsService userDetailsService() {
        return new JdbcUserDetailsManager(dataSource);
    }

    @Override
    protected void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.withClientDetails(jdbcClientDetailsService());
    }

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }
}

上述代码中，formLogin()方法表示使用表单登录，任何人都可以登录（permitAll()），logout()方法表示使用默认退出功能。

1. 配置资源服务器

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    private static final String RESOURCE_ID = "resource";

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId(RESOURCE_ID);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers(HttpMethod.GET, "/api/**").access("#oauth2.hasScope('read')")
                .antMatchers(HttpMethod.POST, "/api/**").access("#oauth2.hasScope('write')")
                .anyRequest().authenticated();
    }
}

上述代码中，ResourceServerSecurityConfigurer将RESOURCE_ID设置为资源服务器的标识符，authorizeRequests()方法设置安全策略，access()方法用于根据OAuth2令牌中的权限判断客户端是否允许访问。

2.2 单点登出

在实现单点登出的功能时需要以下步骤：

1. 添加jwt和spring-session依赖

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-jwt</artifactId>
    <version>1.0.10.RELEASE</version>
</dependency>

<dependency>
    <groupId>org.springframework.session</groupId>
    <artifactId>spring-session-core</artifactId>
    <version>2.5.0</version>
</dependency>

jwt用于生成token，spring-session用于管理session。

1. 添加JwtTokenStore

@Configuration
public class TokenStoreConfig {

    @Value("${jwt.signing.key}")
    private String signingKey;

    @Autowired
    private RedisConnectionFactory redisConnectionFactory;

    @Bean
    public JwtAccessTokenConverter jwtAccessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey(signingKey);
        return converter;
    }

    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(jwtAccessTokenConverter());
    }

    @Bean
    public RedisOperationsSessionRepository sessionRepository() {
        RedisOperationsSessionRepository sessionRepository = new RedisOperationsSessionRepository(redisConnectionFactory);
        sessionRepository.setDefaultMaxInactiveInterval(1800);
        sessionRepository.setDefaultSerializer(new Jackson2JsonRedisSerializer<>(Object.class));
        return sessionRepository;
    }

    @Bean
    public HttpSessionStrategy httpSessionStrategy() {
        return new HeaderHttpSessionStrategy();
    }

    @Bean
    public SessionRegistry sessionRegistry() {
        return new SpringSessionBackedSessionRegistry<>(sessionRepository());
    }
}

上述代码中，JwtTokenStore用于创建token，同时使用redis来管理session。

1. 配置单点登出

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private RedisConnectionFactory redisConnectionFactory;

    @Autowired
    private SessionRegistry sessionRegistry;

    private RememberMeTokenRepository rememberMeTokenRepository() {
        JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
        tokenRepository.setDataSource(dataSource);
        return tokenRepository;
    }

    private PersistentTokenBasedRememberMeServices rememberMeServices() {
        PersistentTokenBasedRememberMeServices services = new PersistentTokenBasedRememberMeServices("rememberMe", userDetailsService(), rememberMeTokenRepository());
        services.setTokenValiditySeconds(5 * 24 * 60 * 60);
        return services;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/login", "/oauth/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .logoutUrl("/logout")
                .deleteCookies("JSESSIONID")
                .clearAuthentication(true)
                .invalidateHttpSession(true)
                .addLogoutHandler(tokenClearLogoutHandler())
                .addLogoutHandler(cookieClearLogoutHandler())
                .logoutSuccessUrl("/login")
                .permitAll()
                .and()
                .rememberMe()
                .rememberMeServices(rememberMeServices())
                .key("mySignature");
    }

    private LogoutHandler tokenClearLogoutHandler() {
        ServicesLogoutHandler logoutHandler = new ServicesLogoutHandler(tokenServices());
        logoutHandler.setTokenStore(tokenStore());
        logoutHandler.setClientDetailsService(clientDetailsService());
        return logoutHandler;
    }

    private LogoutHandler cookieClearLogoutHandler() {
        CookieClearingLogoutHandler logoutHandler = new CookieClearingLogoutHandler(AbstractRememberMeServices.SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY);
        return logoutHandler;
    }

    private TokenStore tokenStore() {
        return new RedisTokenStore(redisConnectionFactory);
    }

    private AuthorizationServerTokenServices tokenServices() {
        DefaultTokenServices services = new DefaultTokenServices();
        services.setTokenStore(tokenStore());
        services.setClientDetailsService(clientDetailsService());
        services.setAccessTokenValiditySeconds(3600);
        services.setTokenEnhancer(tokenEnhancer());
        return services;
    }

    private TokenEnhancer tokenEnhancer() {
        return new JwtTokenEnhancer();
    }

    @Bean
    public AuthorizationCodeServices authorizationCodeServices() {
        return new RedisAuthorizationCodeServices(redisConnectionFactory);
    }
}

上述代码中，添加了两个LogoutHandler用于清除token，同时还配置了cookieClearLogoutHandler清除Rememer-Me的cookie。

三、示例

以下提供两个示例的实现代码，分别是：

1. 使用Spring Boot和Spring Security OAuth2实现的单点登录和登出
2. 使用Spring Cloud Gateway和Spring Security OAuth2实现的单点登录和登出

这两个示例均包含单点登录和单点登出的功能。

代码示例详见以下链接：

1. 使用Spring Boot和Spring Security OAuth2实现的单点登录和登出
2. 使用Spring Cloud Gateway和Spring Security OAuth2实现的单点登录和登出

以上内容便是“Spring Security OAuth2单点登录和登出的实现”的完整攻略，希望对你有所帮助。