Spring Security OAuth2 SSO 单点登录

2023-02-23 21:06:35

基于 Spring Security OAuth2 SSO 单点登录系统

SSO简介

单点登录（英语：Single sign-on，缩写为 SSO），又译为单一签入，一种对于许多相互关连，但是又是各自独立的软件系统，提供访问控制的属性。当拥有这项属性时，当用户登录时，就可以获取所有系统的访问权限，不用对每个单一系统都逐一登录。这项功能通常是以轻型目录访问协议（LDAP）来实现，在服务器上会将用户信息存储到LDAP数据库中。相同的，单一退出（single sign-off）就是指，只需要单一的退出动作，就可以结束对于多个系统的访问权限。

Spring Security OAuth

Spring Security OAuth使用标准的Spring和Spring Security编程模型和配置惯例，为使用Spring Security with OAuth（1a）和OAuth2提供支持。OAuth协议

案例介绍

此工程分为三个模块：授权服务器（sso-auth-server）、web应用a（sso-client-a）、web应用b（sso-client-b），想达到的目的是：某一个用户在a系统登陆后在跳往b系统后不用在重复登录。

sso-auth-server:

pom:

<dependencies>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-security</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-web</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.security.oauth</groupId>

        <artifactId>spring-security-oauth2</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.security</groupId>

        <artifactId>spring-security-jwt</artifactId>

    </dependency>

</dependencies>

yml:

server:

  port: 8082

  context-path: /auth_server

SsoServerApplication.java

/**

 * @author Leone

 * @since 2018-05-07

 **/

@SpringBootApplication

public class SsoServerApplication {

    public static void main(String[] args) {

        SpringApplication.run(SsoServerApplication.class, args);

    }

    /**

     * 为测试环境添加相关的 Request Dumper information，便于调试

     *

     * @return

     */

    @Profile("!cloud")

    @Bean

    RequestDumperFilter requestDumperFilter() {

        return new RequestDumperFilter();

    }

}

userDetailsService.java

/**

 * @author Leone

 * @since 2018-05-07

 **/

@Component

public class SsoUserDetailsService implements UserDetailsService {

    @Autowired

    private PasswordEncoder passwordEncoder;

    @Override

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        return new User(username, passwordEncoder.encode("admin"), AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_USER"));

    }

}

SsoSecurityConfig.java

/**

 * @author Leone

 * @since 2018-05-07

 **/

@Configuration

public class SsoSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired

    private UserDetailsService userDetailsService;

    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http.formLogin()

                .and().authorizeRequests()

                .antMatchers("/**/*.js", "/**/*.css", "/**/*.jpg", "/**/*.png")

                .permitAll()

                .anyRequest().authenticated()

                .and()

                .csrf().disable();

        //  http.formLogin().and().authorizeRequests().anyRequest().authenticated();

    }

    @Override

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());

    }

}

SsoAuthServerConfig.java

/**

 * @author Leone

 * @since 2018-05-07

 **/

@Configuration

@EnableAuthorizationServer

public class SsoAuthServerConfig extends AuthorizationServerConfigurerAdapter {

    /**

     * 客户端一些配置

     *

     * @param clients

     * @throws Exception

     */

    @Override

    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients.inMemory()

                .withClient("client1")

                .secret("secret1")

                .authorizedGrantTypes("authorization_code", "refresh_token")

                .scopes("all", "read", "write")

                .autoApprove(true)

                .and()

                .withClient("client2")

                .secret("secret2")

                .authorizedGrantTypes("authorization_code", "refresh_token")

                .scopes("all", "read", "write")

                .autoApprove(true);

    }

    /**

     * 配置jwtTokenStore

     *

     * @param endpoints

     * @throws Exception

     */

    @Override

    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        endpoints.tokenStore(jwtTokenStore()).accessTokenConverter(jwtAccessTokenConverter());

    }

    /**

     * springSecurity 授权表达式

     *

     * @param security

     * @throws Exception

     */

    @Override

    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {

        security.tokenKeyAccess("isAuthenticated()");

    }

    /**

     * JwtTokenStore

     *

     * @return

     */

    @Bean

    public TokenStore jwtTokenStore() {

        return new JwtTokenStore(jwtAccessTokenConverter());

    }

    /**

     * 生成JTW token

     *

     * @return

     */

    @Bean

    public JwtAccessTokenConverter jwtAccessTokenConverter() {

        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();

        converter.setSigningKey("andy");

        return converter;

    }

}

sso-client-a

pom:

<dependencies>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-security</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-web</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.security.oauth</groupId>

        <artifactId>spring-security-oauth2</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.security</groupId>

        <artifactId>spring-security-jwt</artifactId>

    </dependency>

</dependencies>

yml:

server:

  port: 8080

  context-path: /clienta

security:

  oauth2:

    client:

      clientId: client1

      clientSecret: secret1

      access-token-uri: http://127.0.0.1:8082/auth_server/oauth/token    #请求令牌的地址

      user-authorization-uri: http://127.0.0.1:8082/auth_server/oauth/authorize    #请求认证的地址

    resource:

      jwt:

        key-uri: http://127.0.0.1:8082/auth_server/oauth/token_key   #解析jwt令牌所需要密钥的地址

index.html

<!DOCTYPE html>

<html lang="en">

<head>

    <meta charset="UTF-8">

    <title>sso-client-A</title>

</head>

<body>

    <h1>sso demo client-A</h1>

    <a href="http://127.0.0.1:8081/clientb/index.html">访问client-b</a>

</body>

</html>

SsoClientA.java

/**

 * @author Leone

 * @since 2018-05-07

 **/

@EnableOAuth2Sso

@SpringBootApplication

public class SsoClientA {

    public static void main(String[] args) {

        SpringApplication.run(SsoClientA.class, args);

    }

}

sso-client-b

pom:

<dependencies>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-security</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-web</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.security.oauth</groupId>

        <artifactId>spring-security-oauth2</artifactId>

    </dependency>

    <dependency>

        <groupId>org.springframework.security</groupId>

        <artifactId>spring-security-jwt</artifactId>

    </dependency>

</dependencies>

yml:

server:

  port: 8081

  context-path: /clientb

security:

  oauth2:

    client:

      clientId: client2

      clientSecret: secret2

      access-token-uri: http://127.0.0.1:8082/auth_server/oauth/token

      user-authorization-uri: http://127.0.0.1:8082/auth_server/oauth/authorize

    resource:

      jwt:

        key-uri: http://127.0.0.1:8082/auth_server/oauth/token_key

index.html

<!DOCTYPE html>

<html lang="en">

<head>

    <meta charset="UTF-8">

    <title>sso-client-B</title>

</head>

<body>

    <h1>sso demo client-B</h1>

    <a href="http://127.0.0.1:8080/clienta/index.html">访问client-a</a>

</body>

</html>

SsoClientA.java

/**

 * @author Leone

 * @since 2018-05-07

 **/

@RestController

@EnableOAuth2Sso

@SpringBootApplication

public class SsoClientB {

    @Autowired

    private OAuth2RestTemplate oAuth2RestTemplate;

    public static void main(String[] args) {

        SpringApplication.run(SsoClientB.class, args);

    }

    @GetMapping("/user")

    public Authentication user(Authentication user) {

        return user;

    }

    @Bean

    public OAuth2RestTemplate oAuth2RestTemplate(OAuth2ClientContext oAuth2ClientContext, OAuth2ProtectedResourceDetails details){

        return new OAuth2RestTemplate(details,oAuth2ClientContext);

    }

}

项目源码:git@github.com:janlle/sso-server.git

码农公寓

基于 Spring Security OAuth2 SSO 单点登录系统

相关文章