{"id":1416,"date":"2023-03-19T11:43:28","date_gmt":"2023-03-19T03:43:28","guid":{"rendered":"https:\/\/www.appblog.cn\/?p=1416"},"modified":"2023-04-28T21:06:43","modified_gmt":"2023-04-28T13:06:43","slug":"spring-security-oauth2-redis-resource-server-configuration","status":"publish","type":"post","link":"https:\/\/www.appblog.cn\/index.php\/2023\/03\/19\/spring-security-oauth2-redis-resource-server-configuration\/","title":{"rendered":"Spring Security OAuth2 Redis \u8d44\u6e90\u670d\u52a1\u5668\u914d\u7f6e"},"content":{"rendered":"

\u8d44\u6e90\u670d\u52a1\u5668\u76f8\u5173\u4f9d\u8d56<\/h2>\n
<dependency>\n    <groupId>org.springframework.boot<\/groupId>\n    <artifactId>spring-boot-starter-security<\/artifactId>\n<\/dependency>\n<dependency>\n    <groupId>org.springframework.boot<\/groupId>\n    <artifactId>spring-boot-starter-web<\/artifactId>\n<\/dependency>\n<dependency>\n    <groupId>org.springframework.security.oauth<\/groupId>\n    <artifactId>spring-security-oauth2<\/artifactId>\n    <version>2.3.6.RELEASE<\/version>\n<\/dependency>\n<dependency>\n    <groupId>org.springframework.boot<\/groupId>\n    <artifactId>spring-boot-starter-data-redis<\/artifactId>\n<\/dependency><\/code><\/pre>\n
<\/p>\n
\u8d44\u6e90\u670d\u52a1\u5668\u914d\u7f6e\u7c7b<\/h2>\n
\/**\n * @Description: @EnableResourceServer\u6ce8\u89e3\u5b9e\u9645\u4e0a\u76f8\u5f53\u4e8e\u52a0\u4e0aOAuth2AuthenticationProcessingFilter\u8fc7\u6ee4\u5668\n * @Package: cn.appblog.security.oauth2.config.ResServerConfig\n * @Version: 1.0\n *\/\n@Configuration\n@EnableResourceServer\npublic class ResourceServerConfig extends ResourceServerConfigurerAdapter {\n\n    @Autowired\n    private RedisConnectionFactory redisConnectionFactory;\n    @Autowired\n    private UserAuthenticationEntryPoint userAuthenticationEntryPoint;\n    @Autowired\n    private UserAccessDeniedHandler userAccessDeniedHandler;\n    @Autowired\n    private UserAuthenticationSuccessHandler userAuthenticationSuccessHandler;\n\n    @Override\n    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {\n        resources\n                .tokenServices(tokenServices())\n                \/\/\u8d44\u6e90ID\n                .resourceId("resource_password_id")\n                \/\/\u7528\u6765\u89e3\u51b3\u533f\u540d\u7528\u6237\u8bbf\u95ee\u65e0\u6743\u9650\u8d44\u6e90\u65f6\u7684\u5f02\u5e38\n                .authenticationEntryPoint(userAuthenticationEntryPoint)\n                \/\/\u8bbf\u95ee\u8d44\u6e90\u6743\u9650\u76f8\u5173\u5f02\u5e38\u5904\u7406\n                .accessDeniedHandler(userAccessDeniedHandler);\n    }\n\n    @Override\n    public void configure(HttpSecurity http) throws Exception {\n        http.csrf().disable();\n        http\n            .authorizeRequests()\n            .antMatchers("\/resource\/auth")\n            .denyAll()\n            .and()\n            .authorizeRequests()\n            .anyRequest()\n            .permitAll();\n    }\n\n    \/**\n     * OAuth2 token\u6301\u4e45\u5316\u63a5\u53e3\n     *\/\n    @Bean\n    public TokenStore tokenStore() {\n        return new RedisTokenStore(redisConnectionFactory);\n    }\n\n    \/**\n     * \u4ee4\u724c\u670d\u52a1\n     *\/\n    @Bean\n    public DefaultTokenServices tokenServices() {\n        DefaultTokenServices defaultTokenServices = new DefaultTokenServices();\n        defaultTokenServices.setTokenStore(tokenStore());\n        return defaultTokenServices;\n    }\n\n    \/**\n     * \u52a0\u5bc6\u65b9\u5f0f\n     *\/\n    @Bean\n    public PasswordEncoder passwordEncoder() {\n        return new BCryptPasswordEncoder();\n    }\n}<\/code><\/pre>\n
\u914d\u7f6e\u6587\u4ef6<\/h2>\n
server.port=9004\n##\u5355\u673a\u5e94\u7528\u73af\u5883\u914d\u7f6e\nspring.redis.host=127.0.0.1\nspring.redis.port=6379\n#spring.redis.password=\nspring.redis.database=0\n#spring.redis.timeout=\n\n##redis\u8fde\u63a5\u6c60\u914d\u7f6e\n## \u8fde\u63a5\u6c60\u4e2d\u7684\u6700\u5c0f\u7a7a\u95f2\u8fde\u63a5\uff0c\u9ed8\u8ba40\nspring.redis.jedis.pool.min-idle=0\n## \u8fde\u63a5\u6c60\u4e2d\u7684\u6700\u5927\u7a7a\u95f2\u8fde\u63a5\uff0c\u9ed8\u8ba48\nspring.redis.jedis.pool.max-idle=8\n## \u8fde\u63a5\u6c60\u6700\u5927\u963b\u585e\u7b49\u5f85\u65f6\u95f4\uff08\u4f7f\u7528\u8d1f\u503c\u8868\u793a\u6ca1\u6709\u9650\u5236\uff09\uff0c\u9ed8\u8ba4-1ms\nspring.redis.jedis.pool.max-wait=-1ms\n##\u8fde\u63a5\u6c60\u6700\u5927\u8fde\u63a5\u6570\uff08\u4f7f\u7528\u8d1f\u503c\u8868\u793a\u6ca1\u6709\u9650\u5236\uff09\uff0c\u9ed8\u8ba48\nspring.redis.jedis.pool.max-active=8\n\noauth.token.uri=http:\/\/127.0.0.1:9003\/oauth\/token\noauth.resource.id=resource_password_id\noauth.resource.client.id=client_password\noauth.resource.client.secret=secret\noauth.resource.user.id=user\noauth.resource.user.password=123456<\/code><\/pre>\n
\u8d44\u6e90\u63a7\u5236\u5668<\/h2>\n
\/**\n * @Description: \u8d44\u6e90\u670d\u52a1\u5668\n * @Package: cn.appblog.security.oauth2.api.ResourceController\n * @Version: 1.0\n *\/\n@Slf4j\n@RestController\n@RequestMapping("\/resource")\npublic class ResourceController {\n\n    @RequestMapping(value = "context", method = RequestMethod.GET)\n    public ResponseEntity<Object> get(@RequestParam String username, @RequestParam int age) {\n        SecurityContext ctx = SecurityContextHolder.getContext();\n        log.info(JSON.toJSONString(ctx));\n        if (!"anonymousUser".equals(ctx.getAuthentication().getPrincipal())) {\n            return new ResponseEntity<>(ctx, HttpStatus.OK);\n        }\n        return new ResponseEntity<>(ctx, HttpStatus.OK);\n    }\n\n    @RequestMapping(value = "auth", method = RequestMethod.GET)\n    @ResponseBody\n    public Object getAuth() {\n        SecurityContext ctx = SecurityContextHolder.getContext();\n        return ctx.getAuthentication();\n    }\n}<\/code><\/pre>\n
\u8bbf\u95ee\u6d4b\u8bd5<\/h2>\n
\uff081\uff09\u8bbf\u95ee\uff1ahttp:\/\/127.0.0.1:9004\/resource\/context?username=joe&age=20<\/a><\/p>\n
{\n    "authentication":{\n        "authorities":[\n            {\n                "authority":"ROLE_ANONYMOUS"\n            }\n        ],\n        "details":{\n            "remoteAddress":"127.0.0.1",\n            "sessionId":null\n        },\n        "authenticated":true,\n        "principal":"anonymousUser",\n        "keyHash":-872685687,\n        "credentials":"",\n        "name":"anonymousUser"\n    }\n}<\/code><\/pre>\n
\uff082\uff09\u8bbf\u95ee\uff1ahttp:\/\/127.0.0.1:9004\/resource\/context?username=joe&age=20&access_token=b970020dc0e942d0ae4a0e01232ff05f<\/a><\/p>\n
{\n    "authentication":{\n        "authenticated":true,\n        "authorities":[\n            {\n                "authority":"{"interfaces":["\/a\/b","\/a\/c","\/oauth\/token"]}"\n            },\n            {\n                "authority":"{"username":"user"}"\n            }\n        ],\n        "clientOnly":false,\n        "credentials":"",\n        "details":{\n            "remoteAddress":"127.0.0.1",\n            "tokenType":"Bearer",\n            "tokenValue":"b970020dc0e942d0ae4a0e01232ff05f"\n        },\n        "name":"user",\n        "oAuth2Request":{\n            "approved":true,\n            "authorities":[\n\n            ],\n            "clientId":"client_password",\n            "extensions":{\n\n            },\n            "grantType":"password",\n            "refresh":false,\n            "requestParameters":{\n                "grant_type":"password",\n                "client_id":"client_password",\n                "username":"user"\n            },\n            "resourceIds":[\n                "resource_password_id"\n            ],\n            "responseTypes":[\n\n            ],\n            "scope":[\n                "all"\n            ]\n        },\n        "principal":{\n            "accountNonExpired":true,\n            "accountNonLocked":true,\n            "authorities":[\n                {\n                    "$ref":"$.authentication.authorities[0]"\n                },\n                {\n                    "$ref":"$.authentication.authorities[1]"\n                }\n            ],\n            "credentialsNonExpired":true,\n            "enabled":true,\n            "username":"user"\n        },\n        "userAuthentication":{\n            "authenticated":true,\n            "authorities":[\n                {\n                    "$ref":"$.authentication.authorities[0]"\n                },\n                {\n                    "$ref":"$.authentication.authorities[1]"\n                }\n            ],\n            "details":{\n                "client_secret":"secret",\n                "grant_type":"password",\n                "client_id":"client_password",\n                "username":"user"\n            },\n            "name":"user",\n            "principal":{\n                "$ref":"$.authentication.principal"\n            }\n        }\n    }\n}<\/code><\/pre>\n
{\n    "status": 300,\n    "message": "\u767b\u5f55\u5f02\u5e38\uff0c\u8bf7\u68c0\u67e5\u767b\u5f55\u4fe1\u606f...,org.springframework.security.authentication.InsufficientAuthenticationException: Invalid access token: b970020dc0e942d0ae4a0e01232ff05f"\n}<\/code><\/pre>\n
\u672c\u6587\u8f6c\u8f7d\u53c2\u8003 \u539f\u6587<\/a> \u5e76\u52a0\u4ee5\u8c03\u8bd5<\/p>\n","protected":false},"excerpt":{"rendered":"
\u8d44\u6e90\u670d\u52a1\u5668\u76f8\u5173\u4f9d\u8d56 <dependency> <groupId>org.springf […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[354],"tags":[353,153],"class_list":["post-1416","post","type-post","status-publish","format-standard","hentry","category-spring-security","tag-oauth2","tag-redis"],"_links":{"self":[{"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/posts\/1416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/comments?post=1416"}],"version-history":[{"count":0,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/posts\/1416\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/media?parent=1416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/categories?post=1416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/tags?post=1416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}