Spring OAuth2 Resource Server 配置

news/2024/7/27 8:42:58/文章来源:https://blog.csdn.net/semicolon_hello/article/details/137147058

Spring OAuth2 Resource Server 是 Spring Security 中的一个模块，用于保护资源服务器上的API资源，确保只有持有合法访问令牌（access token）的客户端才能访问受保护的资源。以下是一个简化的Spring Boot应用中如何配置OAuth2 Resource Server的基本步骤和示例：

依赖引入

首先，在pom.xml或build.gradle中引入相应的依赖：

<!-- Maven -->
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency><!-- Gradle -->
dependencies {implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
}

配置资源服务器

使用JWT令牌验证

如果你的Authorization Server使用的是JWT令牌，则需要配置资源服务器来验证这种令牌：

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
import org.springframework.security.oauth2.core.OAuth2Error;
import org.springframework.security.oauth2.jose.jws.JwsAlgorithms;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.JwtValidators;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;import java.util.Arrays;@Configuration
@EnableWebSecurity
public class ResourceServerConfig extends WebSecurityConfigurerAdapter {@Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")private String issuerUri;@Overrideprotected void configure(HttpSecurity http) throws Exception {http.authorizeRequests().anyRequest().authenticated().and().oauth2ResourceServer().jwt().decoder(jwtDecoder()).jwtAuthenticationConverter(jwtAuthenticationConverter());}// 创建JWT解码器private JwtDecoder jwtDecoder() {NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(issuerUri).build();jwtDecoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(Arrays.asList(JwtValidators.createDefaultWithIssuer(issuerUri),new CustomJwtValidator() // 如果有自定义验证逻辑，可以添加自定义验证器)));return jwtDecoder;}// 自定义JWT转换器（如有必要）private Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter() {JwtAuthenticationConverter converter = new JwtAuthenticationConverter();// 可能需要映射JWT声明到角色或其他属性OAuth2AuthenticatedPrincipal authoritiesExtractor = new AuthoritiesExtractor();converter.setJwtAuthoritiesConverter(authoritiesExtractor);return converter;}// 示例自定义验证器private static class CustomJwtValidator implements OAuth2TokenValidator<Jwt> {@Overridepublic OAuth2TokenValidatorResult validate(Jwt jwt) {// 这里添加额外的JWT验证逻辑// ...return OAuth2TokenValidatorResult.success(); // 如果验证成功}}// 示例JWT声明转角色的提取器private static class AuthoritiesExtractor implements Converter<Jwt, Collection<GrantedAuthority>> {@Overridepublic Collection<GrantedAuthority> convert(Jwt jwt) {// 从JWT声明中获取角色并转换成GrantedAuthority对象// ...return Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")); // 示例}}
}

使用opaque令牌验证

如果使用的是opaque类型的访问令牌，则通常需要配置远程Token服务来验证：

// 配置opaque令牌验证
private RemoteTokenServices tokenService() {RemoteTokenServices tokenService = new RemoteTokenServices();tokenService.setCheckTokenEndpointUrl("http://auth-server/oauth/check_token");tokenService.setClientId("your-client-id");tokenService.setClientSecret("your-client-secret");return tokenService;
}// 在configure(HttpSecurity)方法中添加配置
.and()
.oauth2ResourceServer()
.authenticationManager(new DefaultOAuth2AuthenticationManager(tokenService()));