书接上文 oauth2 认证服务器 ，结合认证服务器配置一个业务服务，在调用业务的接口时通过远程的 oauth2 认证服务器（RemoteTokenServices） 进行鉴权。

虽然在实现上应用到了 ResourceServerConfigurerAdapter，这里暂时还是先不用“资源服务器“的概念

源代码链接

认证服务的数据库配置信息

image.png

image.png

以下的所有说明都属于业务服务，或者说微服务的内容

创建Web项目

http -d https://start.spring.io/starter.zip javaVersion==17 groupId==com.my.demo artifactId==projectService name==project-service baseDir==project-service bootVersion==2.6.6.RELEASE dependencies==web

image.png

解压缩，然后导入到sts

image.png

修改POM文件，添加如下配置

               <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter</artifactId>
            <version>3.1.1</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-oauth2</artifactId>
            <version>2.2.5.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>3.1.0</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>javax.xml.bind</groupId>
            <artifactId>jaxb-api</artifactId>
            <version>2.3.1</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jaxb</groupId>
            <artifactId>jaxb-runtime</artifactId>
            <version>2.3.1</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-impl</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-core</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>javax.activation</groupId>
            <artifactId>activation</artifactId>
            <version>1.1.1</version>
        </dependency>

注意要包含spring-cloud-starter 否则报 config等编译错误

        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter</artifactId>
            <version>3.1.1</version>
        </dependency>

修改 application.properties 配置文件

server.port=8601
spring.application.name=project-service

security.oauth2.client.scope=server
security.oauth2.client.client-id=client
security.oauth2.client.client-secret=123456
security.oauth2.client.access-token-uri=http://localhost:8509/oauth/token
security.oauth2.client.user-authorization-uri=http://localhost:8509/oauth/authorize
 
security.oauth2.authorization.check-token-access=http://localhost:8509/oauth/check_token

security.oauth2.resource.token-info-uri=http://localhost:8509/oauth/check_token
security.oauth2.resource.user-info-uri=http://localhost:8509/oauth/check_user
security.oauth2.resource.prefer-token-info=true

添加一个配置文件到config目录，添加两个controller文件到主目录

image.png

HelloWorldController

package com.my.demo.projectService;
import org.springframework.web.bind.annotation.*;
@RestController
@RequestMapping("/hello")
public class HelloWorldController {
    @RequestMapping("/say")
    public String say() {
        return "Hello World project";
    }

    @RequestMapping("/get")
    public String get() {
        return "Hello project get";
    }
}

ConfigController 注意这里 @PreAuthorize("hasAuthority('PROJECT')")是一个数据库里没有的角色，测试用

package com.my.demo.projectService;

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetails;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/config")
public class ConfigController {

    @RequestMapping("/set")
    @PreAuthorize("hasAuthority('USER')")
    public Object set(Authentication authentication) {
        authentication.getAuthorities();
        OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) authentication.getDetails();
        String token = details.getTokenValue();
        return token + "config project have authorization";
    }

    @RequestMapping("/get")
    @PreAuthorize("hasAuthority('PROJECT')")
    public String get() {
        return "config project";
    }
}

image.png

ResourceServerConfig

package com.my.demo.projectService.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.RemoteTokenServices;

@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Autowired
    private RemoteTokenServices remoteTokenServices;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.tokenServices(remoteTokenServices);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/config/**").authenticated();
    }
}

image.png

启动服务，测试

首先从认证服务器获取token

image.png

访问Hello接口，无需授权

image.png

访问/config/get接口，不传递token信息，提示没有授权

image.png

访问/config/get接口，传递token信息，提示访问被拒

image.png

访问角色定义正确的接口成功

image.png

可以在 ResourceServerConfig 上 做一些定制，本项目里没有使用

配置 RESOURCE_ID 和数据库对应
配置 RemoteTokenServices 的详细信息， 通过此配置可以做动态的修改

    @Value("${security.oauth2.client.client-id}")
    private String clientId;

    @Value("${security.oauth2.client.client-secret}")
    private String clientSecret;

    @Value("${security.oauth2.authorization.check-token-access}")
    private String checkTokenEndpointUrl;

    @Autowired
    private RedisConnectionFactory redisConnectionFactory;

    private static final String RESOURCE_ID = "project-resource";

    @Bean("redisTokenStore")
    public TokenStore redisTokenStore() {
        return new RedisTokenStore(redisConnectionFactory);
    }

    //@Bean
    public RemoteTokenServices tokenService() {
        RemoteTokenServices tokenService = new RemoteTokenServices();

        System.out.print("\r\n");
        System.out.print(clientId);
        System.out.print("\r\n");

        System.out.print("\r\n");
        System.out.print(checkTokenEndpointUrl);
        System.out.print("\r\n");

        tokenService.setClientId(clientId);
        tokenService.setClientSecret(clientSecret);
        tokenService.setCheckTokenEndpointUrl(checkTokenEndpointUrl);
        return tokenService;
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId(RESOURCE_ID).tokenServices(tokenService());
    }

以下内容为后续的补充

注意 hasRole与hasAuthority的区别 ，如果采用hasAnyRole 的方式，则需要放开GrantedAuthorityDefaults 的注释，采用 hasAnyRole 的方式 代码里为 USER 数据库里需要保存成 ROLE_USER。

hasAnyRole 站在角色的角度，hasAuthority站在权限的角度

Controller里的 @PreAuthorize("hasAuthority('PROJECT')") 配置仍然器作用

public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    /*
    @Bean
    GrantedAuthorityDefaults grantedAuthorityDefaults() {
        return new GrantedAuthorityDefaults(""); // Remove the ROLE_ prefix
    }
    */
    
    @Autowired
    private RemoteTokenServices remoteTokenServices;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.tokenServices(remoteTokenServices);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        // http.authorizeRequests().antMatchers("/config/**","/hello/**").authenticated();
        //http.authorizeRequests().antMatchers("/config/**", "/hello/**").hasAnyRole("USER").anyRequest().authenticated();
        http.authorizeRequests().antMatchers("/config/**", "/hello/**").hasAuthority("USER").anyRequest().authenticated();
    }
}

application.properties配置项里有如下内容即可

security.oauth2.client.scope=server
security.oauth2.client.client-id=client
security.oauth2.client.client-secret=123456

security.oauth2.resource.token-info-uri=http://localhost:8509/oauth/check_token
security.oauth2.resource.prefer-token-info=true

源代码链接