1、什么是Spring Cloud OAuth2
    当我们平台向其他平台开放一些接口，允许某些应用可以调用，这时候应用OAuth2.0协议进行用户身份验证和获取用户授权，一般都是先向开发接口平台提出申请，审批之后会给申请的应用分配一个唯一的appID,appkey,当客户端访问开发接口平台，先根据appid和appkey获取授权码，在根据授权码与appid获取到accessToken,然后客户端将accessToken放到请求头中去请求开放平台的接口就可以了，当请求到达开发平台的时候，开发平台会将向验权中心发出请求，验证此accessToken是否有效，如果有效才能继续访问；

    qq联合登录中访问获取用户信息的接口步骤
    **

    1. 1、生成授权CODE链接，获取授权码  ----用户点击
    3. https://graph.qq.com/oauth2.0/authorize?response_type=code&client_id=101462456&state=888&redirect_uri=http://mayikt.s1.natapp.cc/qqLoginBack
    5. 2、使用用户获取的授权码，获取对应的accessToken
    7. https://graph.qq.com/oauth2.0/token?grant_type=authorization_code&client_id=101462456&client_secret=4488033be77331e7cdcaed8ceadc10d5&code=E91DF5B0E2455A6B2AF25CD9FA1C7582&
    8. redirect_uri=http://mayikt.s1.natapp.cc/qqLoginBack
    10. 3、使用accessToken获取用户openid
    12. https://graph.qq.com/oauth2.0/me?access_token=B2FD1997D149313F16C93D91C75AC75E
    13. 4、使用openid获取用户信息
    16. https://graph.qq.com/user/get_user_info?access_token=B2FD1997D149313F16C93D91C75AC75E&oauth_consumer_key=101462456&openid=4B1717CBBFE1E900D2A1482C4A18B3BD

    2、搭建Spring Cloud OAuth2

    Oauth2角色划分
    1、Resource Server:被授权访问的资源
    2、Authotization Server：OAUTH2认证授权中心
    3、Resource Owner： 用户
    4、Client：使用API的客户端(如Android 、IOS、web app)

    搭建OAuth2认证授权中心：

    1. <parent>
    2.         <groupId>org.springframework.boot</groupId>
    3.         <artifactId>spring-boot-starter-parent</artifactId>
    4.         <version>2.0.1.RELEASE</version>
    5.     </parent>
    6.     <!-- 管理依赖 -->
    7.     <dependencyManagement>
    8.         <dependencies>
    9.             <dependency>
    10.                 <groupId>org.springframework.cloud</groupId>
    11.                 <artifactId>spring-cloud-dependencies</artifactId>
    12.                 <version>Finchley.M7</version>
    13.                 <type>pom</type>
    14.                 <scope>import</scope>
    15.             </dependency>
    16.         </dependencies>
    17.     </dependencyManagement>
    18.     <dependencies>
    19.         <!-- SpringBoot整合Web组件 -->
    20.         <dependency>
    21.             <groupId>org.springframework.boot</groupId>
    22.             <artifactId>spring-boot-starter-web</artifactId>
    23.         </dependency>
    24.         <dependency>
    25.             <groupId>org.projectlombok</groupId>
    26.             <artifactId>lombok</artifactId>
    27.         </dependency>
    29.         <!-- springboot整合freemarker -->
    30.         <dependency>
    31.             <groupId>org.springframework.boot</groupId>
    32.             <artifactId>spring-boot-starter-freemarker</artifactId>
    33.         </dependency>
    35.         <!-->spring-boot 整合security -->
    36.         <dependency>
    37.             <groupId>org.springframework.boot</groupId>
    38.             <artifactId>spring-boot-starter-security</artifactId>
    39.         </dependency>
    40.         <!-- spring-cloud-starter-oauth2 -->
    41.         <dependency>
    42.             <groupId>org.springframework.cloud</groupId>
    43.             <artifactId>spring-cloud-starter-oauth2</artifactId>
    44.         </dependency>
    46.         <dependency>
    47.             <groupId>org.springframework.boot</groupId>
    48.             <artifactId>spring-boot-starter-jdbc</artifactId>
    49.         </dependency>
    51.         <dependency>
    52.             <groupId>mysql</groupId>
    53.             <artifactId>mysql-connector-java</artifactId>
    54.         </dependency>
    56.     </dependencies>
    57.     <!-- 注意： 这里必须要添加， 否者各种依赖有问题 -->
    58.     <repositories>
    59.         <repository>
    60.             <id>spring-milestones</id>
    61.             <name>Spring Milestones</name>
    62.             <url>https://repo.spring.io/libs-milestone</url>
    63.             <snapshots>
    64.                 <enabled>false</enabled>
    65.             </snapshots>
    66.         </repository>
    67.     </repositories>
    1. spring:
    2.   datasource:
    3.     hikari:
    4.       connection-test-query: SELECT 1
    5.       minimum-idle: 1
    6.       maximum-pool-size: 5
    7.       pool-name: dbcp1
    8.     driver-class-name: com.mysql.jdbc.Driver
    9.     url: jdbc:mysql://localhost:3306/alan-oauth?autoReconnect=true&useSSL=false
    10.     username: root
    11.     password: root
    3. // 授权认证服务中心配置
    4. @Configuration
    5. @EnableAuthorizationServer
    6. public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    8.     // @EnableAuthorizationServer 开启 授权认证服务中心
    9.     // accessToken 有效期 2小时
    10.     private static final int ACCESSTOKENVALIDITYSECONDS = 7200;// 两小时
    11.     private static final int REFRESHTOKENVALIDITYSECONDS = 7200;// 两小时
    12.     // 配置 appid、appkey 、回调地址、token有效期
    14.     // 思考问题：accessToken 怎么办？ 使用刷新令牌获取新的accessToken 至少提前10分钟调用刷新令牌接口进行刷新
    15.     @Override
    16.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    18.         // 思考： 如果合作机构需要做oauth2认证的话 第一步操作的是什么？
    19.         // 1.申请获取到appid 和 appkey 写死的
    20.         // clients.inMemory().withClient("client_1").secret(passwordEncoder().encode("123456"))
    21.         // .redirectUris("http://www.mayikt.com")
    22.         // .authorizedGrantTypes("authorization_code", "password",
    23.         // "refresh_token").scopes("all")
    24.         // .accessTokenValiditySeconds(ACCESSTOKENVALIDITYSECONDS)
    25.         // .refreshTokenValiditySeconds(REFRESHTOKENVALIDITYSECONDS);// 授权类型
    26.         // 为授权码类型
    27.         // 密码授权模式 使用用户名称和密码进行获取accessToken
    28.         // 如果clientid appid 同时使用密码模式和授权code 获取accessToken 为发生什么问题
    29.         // a 相同
    30.         // b 覆盖
    31.         // c 不一致性
    32.         // d 报错
    33.         // 密码模式 660fa8e0-f8db-422d-8891-906db021ded8
    34.         // 授权模式 660fa8e0-f8db-422d-8891-906db021ded8
    35.         // accessToken 和appid关联
    37.     }
    39.     // 设置token类型
    40.     public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
    41.         endpoints.authenticationManager(authenticationManager()).allowedTokenEndpointRequestMethods(HttpMethod.GET,
    42.                 HttpMethod.POST);
    43.         // 必须加上他，不然刷新令牌接口会报错
    44.         endpoints.authenticationManager(authenticationManager());
    45.         endpoints.userDetailsService(userDetailsService());
    46.         // 之前的accessToken b55c980c-31f7-4498-a783-bd905608fb18
    47.         // 刷新之后accessToken d40f7915-dd06-4503-83c8-2815915c9368
    48.     }
    50.     @Override
    51.     public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
    52.         // 允许表单认证
    53.         oauthServer.allowFormAuthenticationForClients();
    54.         // 允许check_token访问
    55.         oauthServer.checkTokenAccess("permitAll()");
    56.     }
    58.     @Bean
    59.     AuthenticationManager authenticationManager() {
    60.         AuthenticationManager authenticationManager = new AuthenticationManager() {
    62.             public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    63.                 return daoAuhthenticationProvider().authenticate(authentication);
    64.             }
    65.         };
    66.         return authenticationManager;
    67.     }
    69.     @Bean
    70.     public AuthenticationProvider daoAuhthenticationProvider() {
    71.         DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
    72.         daoAuthenticationProvider.setUserDetailsService(userDetailsService());
    73.         daoAuthenticationProvider.setHideUserNotFoundExceptions(false);
    74.         daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
    75.         return daoAuthenticationProvider;
    76.     }
    78.     // 设置添加用户信息,正常应该从数据库中读取
    79.     @Bean
    80.     UserDetailsService userDetailsService() {
    81.         InMemoryUserDetailsManager userDetailsService = new InMemoryUserDetailsManager();
    82.         userDetailsService.createUser(User.withUsername("user_1").password(passwordEncoder().encode("123456"))
    83.                 .authorities("ROLE_USER").build());
    84.         userDetailsService.createUser(User.withUsername("user_2").password(passwordEncoder().encode("1234567"))
    85.                 .authorities("ROLE_USER").build());
    86.         return userDetailsService;
    87.     }
    89.     @Bean
    90.     PasswordEncoder passwordEncoder() {
    91.         // 加密方式
    92.         PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
    93.         return passwordEncoder;
    94.     }
    96. }


    1. // 配置授权中心信息
    2. @Configuration
    3. @EnableAuthorizationServer // 开启认证授权中心
    4. public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    6.     @Autowired
    7.     // @Qualifier("authenticationManagerBean")
    8.     private AuthenticationManager authenticationManager;
    10.     @Autowired
    11.     @Qualifier("dataSource")
    12.     private DataSource dataSource;
    14.     // @Autowired
    15.     // private UserDetailsService userDetailsService;
    17.     @Bean
    18.     public TokenStore tokenStore() {
    19.         // return new InMemoryTokenStore(); //使用内存中的 token store
    20.         return new JdbcTokenStore(dataSource); /// 使用Jdbctoken store
    21.     }
    23.     @Override
    24.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    26.         // 添加授权用户
    27.         clients.jdbc(dataSource).withClient("client_1").secret(new BCryptPasswordEncoder().encode("123456"))
    28.                 .authorizedGrantTypes("password", "refresh_token", "authorization_code")// 允许授权范围
    29.                 .redirectUris("http://www.mayikt.com").authorities("ROLE_ADMIN", "ROLE_USER")// 客户端可以使用的权限
    30.                 .scopes("all").accessTokenValiditySeconds(7200).refreshTokenValiditySeconds(7200);
    31.         // 自动往数据插入该应用id信息
    32.     }
    34.     @Override
    35.     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    36.         endpoints.tokenStore(tokenStore()).authenticationManager(authenticationManager)
    37.                 .userDetailsService(userDetailsService());// 必须设置
    38.                                                             // UserDetailsService
    39.                                                             // 否则刷新token 时会报错
    40.     }
    42.     // 已经讲过UserDetailsService 写读数据
    43.     @Bean
    44.     UserDetailsService userDetailsService() {
    45.         InMemoryUserDetailsManager userDetailsService = new InMemoryUserDetailsManager();
    46.         userDetailsService.createUser(User.withUsername("user_1").password(new BCryptPasswordEncoder().encode("123456"))
    47.                 .authorities("ROLE_USER").build());
    48.         userDetailsService.createUser(User.withUsername("user_2")
    49.                 .password(new BCryptPasswordEncoder().encode("1234567")).authorities("ROLE_USER").build());
    50.         return userDetailsService;
    51.     }
    53.     @Override
    54.     public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    55.         security.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()")
    56.                 .allowFormAuthenticationForClients();// 允许表单登录
    58.     }
    60.     @Bean
    61.     AuthenticationManager authenticationManager() {
    62.         AuthenticationManager authenticationManager = new AuthenticationManager() {
    64.             public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    65.                 return daoAuhthenticationProvider().authenticate(authentication);
    66.             }
    67.         };
    68.         return authenticationManager;
    69.     }
    71.     @Bean
    72.     public AuthenticationProvider daoAuhthenticationProvider() {
    73.         DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
    74.         daoAuthenticationProvider.setUserDetailsService(userDetailsService());
    75.         daoAuthenticationProvider.setHideUserNotFoundExceptions(false);
    76.         daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
    77.         return daoAuthenticationProvider;
    78.     }
    80.     @Bean
    81.     PasswordEncoder passwordEncoder() {
    82.         // 加密方式
    83.         PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
    84.         return passwordEncoder;
    85.     }
    86.     // 6个git 关于oauth2 五个是 1.5版本 1个 2.0
    88. }


    1. @Component
    2. public class SecurityConfig extends WebSecurityConfigurerAdapter {
    4.     // 拦截所有请求,使用httpBasic方式登陆
    5.     @Override
    6.     protected void configure(HttpSecurity http) throws Exception {
    8.         http.authorizeRequests().antMatchers("/**").fullyAuthenticated().and().httpBasic();
    9.     }
    10. }

    搭建资源中心与客户端

    1. <parent>
    2.         <groupId>org.springframework.boot</groupId>
    3.         <artifactId>spring-boot-starter-parent</artifactId>
    4.         <version>2.0.1.RELEASE</version>
    5.     </parent>
    6.     <!-- 管理依赖 -->
    7.     <dependencyManagement>
    8.         <dependencies>
    9.             <dependency>
    10.                 <groupId>org.springframework.cloud</groupId>
    11.                 <artifactId>spring-cloud-dependencies</artifactId>
    12.                 <version>Finchley.M7</version>
    13.                 <type>pom</type>
    14.                 <scope>import</scope>
    15.             </dependency>
    16.         </dependencies>
    17.     </dependencyManagement>
    18.     <dependencies>
    19.         <!-- SpringBoot整合Web组件 -->
    20.         <dependency>
    21.             <groupId>org.springframework.boot</groupId>
    22.             <artifactId>spring-boot-starter-web</artifactId>
    23.         </dependency>
    24.         <dependency>
    25.             <groupId>org.projectlombok</groupId>
    26.             <artifactId>lombok</artifactId>
    27.         </dependency>
    29.         <!-- springboot整合freemarker -->
    30.         <dependency>
    31.             <groupId>org.springframework.boot</groupId>
    32.             <artifactId>spring-boot-starter-freemarker</artifactId>
    33.         </dependency>
    35.         <!-->spring-boot 整合security -->
    36.         <dependency>
    37.             <groupId>org.springframework.boot</groupId>
    38.             <artifactId>spring-boot-starter-security</artifactId>
    39.         </dependency>
    40.         <dependency>
    41.             <groupId>org.springframework.cloud</groupId>
    42.             <artifactId>spring-cloud-starter-oauth2</artifactId>
    43.         </dependency>
    46.     </dependencies>
    47.     <!-- 注意： 这里必须要添加， 否者各种依赖有问题 -->
    48.     <repositories>
    49.         <repository>
    50.             <id>spring-milestones</id>
    51.             <name>Spring Milestones</name>
    52.             <url>https://repo.spring.io/libs-milestone</url>
    53.             <snapshots>
    54.                 <enabled>false</enabled>
    55.             </snapshots>
    56.         </repository>
    57.     </repositories>
    #### 客户端 应用端角色

server:
  port: 8081


logging:
  level:
    org.springframework.security: DEBUG

security:
  oauth2:
    resource:
      ####从认证授权中心上验证token
      tokenInfoUri: http://localhost:8080/oauth/check_token
      preferTokenInfo: true
    client:
      accessTokenUri: http://localhost:8080/oauth/token
      userAuthorizationUri: http://localhost:8080/oauth/authorize
#      ###appid
#      clientId: client_1
#      ###appSecret
#      clientSecret: 123456



    @Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    // @EnableResourceServer 开启资源服务中心
    @Override
    public void configure(HttpSecurity http) throws Exception {
        // 对 api/order 请求进行拦截 验证 accessToken
        http.authorizeRequests().antMatchers("/api/order/**").authenticated();
    }
    // public
    // 拦截资源 网关里面做 开放接口和内部接口一定要独立出来可以封转该业务逻辑相同

}



    @RestController
@RequestMapping("/api/order")
public class OrderController {

    @RequestMapping("/addOrder")
    public String addOrder() {
        return "addOrder";
    }

}


    11.15.pptx基于SpringCloud-OAuth2搭建微服务开放平台.doc上课代码.zip新建 DOC 文档.doc新建 DOCX 文档.docx