Spring Cloud下基于OAUTH2认证授权的实现示例

Redis:
 image: sameersbn/redis:latest
 ports:
 - "6379:6379"
 volumes:
 - /srv/docker/redis:/var/lib/redis:Z
 restart: always

PostgreSQL:
 restart: always
 image: sameersbn/postgresql:9.6-2
 ports:
 - "5432:5432"
 environment:
 - DEBUG=false

 - DB_USER=wang
 - DB_PASS=yunfei
 - DB_NAME=order
 volumes:
 - /srv/docker/postgresql:/var/lib/postgresql:Z

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
 @Autowired
 private AuthenticationManager authenticationManager;
 @Autowired
 private RedisConnectionFactory connectionFactory;


 @Bean
 public RedisTokenStore tokenStore() {
  return new RedisTokenStore(connectionFactory);
 }


 @Override
 public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  endpoints
    .authenticationManager(authenticationManager)
    .tokenStore(tokenStore());
 }

 @Override
 public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
  security
    .tokenKeyAccess("permitAll()")
    .checkTokenAccess("isAuthenticated()");
 }

 @Override
 public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  clients.inMemory()
    .withClient("android")
    .scopes("xx") //此处的scopes是无用的，可以随意设置
    .secret("android")
    .authorizedGrantTypes("password", "authorization_code", "refresh_token")
   .and()
    .withClient("webapp")
    .scopes("xx")
    .authorizedGrantTypes("implicit");
 }
}

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

 @Override
 public void configure(HttpSecurity http) throws Exception {
  http
    .csrf().disable()
    .exceptionHandling()
    .authenticationEntryPoint((request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
   .and()
    .authorizeRequests()
    .anyRequest().authenticated()
   .and()
    .httpBasic();
 }
}

@RestController
public class UserController {

 @GetMapping("/user")
 public Principal user(Principal user){
  return user;
 }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {



 @Bean
 public UserDetailsService userDetailsService(){
  return new DomainUserDetailsService();
 }

 @Bean
 public PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder();
 }

 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  auth
    .userDetailsService(userDetailsService())
    .passwordEncoder(passwordEncoder());
 }

 @Bean
 public SecurityEvaluationContextExtension securityEvaluationContextExtension() {
  return new SecurityEvaluationContextExtension();
 }

 //不定义没有password grant_type
 @Override
 @Bean
 public AuthenticationManager authenticationManagerBean() throws Exception {
  return super.authenticationManagerBean();
 }

}

spring:
 profiles:
 active: ${SPRING_PROFILES_ACTIVE:dev}
 application:
  name: auth-server

 jpa:
 open-in-view: true
 database: POSTGRESQL
 show-sql: true
 hibernate:
  ddl-auto: update
 datasource:
 platform: postgres
 url: jdbc:postgresql://192.168.1.140:5432/auth
 username: wang
 password: yunfei
 driver-class-name: org.postgresql.Driver
 redis:
 host: 192.168.1.140

server:
 port: 9999


eureka:
 client:
 serviceUrl:
  defaultZone: http://${eureka.host:localhost}:${eureka.port:8761}/eureka/



logging.level.org.springframework.security: DEBUG

logging.leve.org.springframework: DEBUG

##很重要
security:
 oauth2:
 resource:
  filter-order: 3

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter{

 @Override
 public void configure(HttpSecurity http) throws Exception {
  http
    .csrf().disable()
    .exceptionHandling()
    .authenticationEntryPoint((request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
   .and()
    .authorizeRequests()
    .anyRequest().authenticated()
   .and()
    .httpBasic();
 }
}

security:
 oauth2:
 resource:
  id: order-service
  user-info-uri: http://localhost:8080/uaa/user
  prefer-token-info: false

@RestController
public class DemoController {
 @GetMapping("/demo")
 @PreAuthorize("hasAuthority('query-demo')")
 public String getDemo(){
  return "good";
 }
}

@Configuration
@EnableOAuth2Sso
public class SecurityConfig extends WebSecurityConfigurerAdapter{
 @Override
 protected void configure(HttpSecurity http) throws Exception {

  http.csrf().disable();
 }
}

zuul:
 routes:
 uaa:
  path: /uaa/**
  sensitiveHeaders:
  serviceId: auth-server
 order:
  path: /order/**
  sensitiveHeaders:
  serviceId: order-service
 add-proxy-headers: true

security:
 oauth2:
 client:
  access-token-uri: http://localhost:8080/uaa/oauth/token
  user-authorization-uri: http://localhost:8080/uaa/oauth/authorize
  client-id: webapp
 resource:
  user-info-uri: http://localhost:8080/uaa/user
  prefer-token-info: false