menu
  • 首页 首页 icon
  • 工具库 工具库 icon
    • IP查询 IP查询 icon
  • 内容库 内容库 icon
    • 快讯库 快讯库 icon
    • 精品库 精品库 icon
    • 问答库 问答库 icon
  • 更多 更多 icon
    • 服务条款 服务条款 icon

Oauth2.0学习内容

武飞扬头像
唂雨云
帮助1人

oauth2.0的四种授权模式和四种存储token方式

https://blog.csdn.net/weixin_39526238/article/details/111204785

四种授权模式

密码模式（password）
授权码模式（authorization_code）
简化模式（implicit）
客户端模式（client_credentials）
总结:四种模式有哪些区别

四种存储token模式

1.基于内存的方式存储token
2.基于JWT方式存储token
3.基于redis方式存储token
4.基于数据库存储token(mysql,oracle)
总结：四种存储token有哪些区别及其使用场景

1. 客户端模式（client_credentials）

1.1 客户端模式的特点：

  1. 无刷token,是最简单的一种方式，同时也是最不安全的一种方式

认证流程图

基于内存的方式实现客端模式：

package com.guyu.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;

@Configuration
@EnableAuthorizationServer
public class AuthorzationClientConfig extends AuthorizationServerConfigurerAdapter {
    /**
     * Springboot2.x需要配置密码加密，否则报错：Encoded password does not look like BCrypt
     *
     * @return
     */
    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("clientApp")// clientID ： 客户端ID
                .secret(passwordEncoder().encode("secretApp"))//secretID : 连接凭证
                .authorizedGrantTypes("authorization_code","password","client_credentials","implicit","refresh_token")//简化模式
                .scopes("all", "write")
                .redirectUris("http://localhost:8001/public/hello");
    }
    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
        oauthServer.tokenKeyAccess("permitAll()")
                .checkTokenAccess("isAuthenticated()")
                .allowFormAuthenticationForClients();
    }
}
学新通

1.2.使用postman测试客户端模式

localhost:9000/oauth/token
学新通

2.授权码模式（authorization_code）

2.1.客户端模式的特点：

1.有刷新token，是四种模式中最安全的一种

授权码代码

package com.heartsuit.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;

/**
 * oauth2.0基于内存授权码模式
 */
@Configuration
@EnableAuthorizationServer
public class AuthorizationCodeConfig extends AuthorizationServerConfigurerAdapter {

        /**
     * Springboot2.x需要配置密码加密，否则报错：Encoded password does not look like BCrypt
     *
     * @return
     */
    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // http://localhost:9000/oauth/authorize?client_id=client&response_type=code
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("clientApp")// clientID ： 客户端ID
                .secret(passwordEncoder().encode("secretApp"))//secretID : 连接凭证
                .authorizedGrantTypes("authorization_code","refresh_token")//简化模式
                .scopes("all", "write")
                .redirectUris("http://localhost:8001/public/hello");//重定向到第三服务地址
    }

    /**
     * [{"timestamp":"2021-01-08T05:56:40.950 0000","status":403,"error":"Forbidden","message":"Forbidden","path":"/oauth/check_token"}]
     */
    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
        oauthServer.tokenKeyAccess("permitAll()")
                .checkTokenAccess("isAuthenticated()")
                .allowFormAuthenticationForClients();
    }
}
学新通

使用postman测试授权码模式

1.获取授权码

1.在浏览器访问如下链接

 http://localhost:9000/oauth/authorize?client_id=clientApp&response_type=code

输入账号密码：admin/123456
学新通
登录后点击授权码，再点击Authrozation认证授权并登录
学新通
看到如下图，说明已经登录到第三方服务地址
学新通

2.获取access_token

使用postman获取access_token,根据授权码获取token

1.第一步配置Authrozation
学新通
第二步，配置请求参数
学新通

表示授权码失效了：

{
    "error": "invalid_grant",
    "error_description": "Invalid authorization code: HYOKNp"
}
3.获取刷新access_token

3密码模式

密码模式代码：

package com.heartsuit.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;

/**
 * oauth2.0基于内存密码模式
 */
@Configuration
@EnableAuthorizationServer
public class AuthorizationPasaWordConfig extends AuthorizationServerConfigurerAdapter {

        /**
     * Springboot2.x需要配置密码加密，否则报错：Encoded password does not look like BCrypt
     *
     * @return
     */
    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    
    //内存存储方式
    private TokenStore tokenStore = new InMemoryTokenStore();

    @Autowired
    private AuthenticationManager authenticationManager;

    // http://localhost:9000/oauth/authorize?client_id=clientApp&response_type=code
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("clientApp")// clientID ： 客户端ID
                .secret(passwordEncoder().encode("secretApp"))//secretID : 连接凭证
//                .authorizedGrantTypes("authorization_code","refresh_token")//授权码模式
                .authorizedGrantTypes("password","refresh_token")// 密码模式
                .scopes("all", "write")
                .redirectUris("http://localhost:8001/public/hello");//重定向到第三服务地址
    }

    /**
     * [{"timestamp":"2021-01-08T05:56:40.950 0000","status":403,"error":"Forbidden","message":"Forbidden","path":"/oauth/check_token"}]
     */
    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
        oauthServer.tokenKeyAccess("permitAll()")
                .checkTokenAccess("isAuthenticated()")
                .allowFormAuthenticationForClients();
    }

    /**
     * Spring security5中新增加了加密方式，并把原有的spring security的密码存储格式改了
     *
     * @param endpoints
     * @throws Exception
     */
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore)
        .authenticationManager(authenticationManager);
    }
}
学新通

SecurityConfig配置类

package com.heartsuit.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

/**
 * @Author Heartsuit
 * @Date 2021-01-08
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    BCryptPasswordEncoder passwordEncoder;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("admin").password(passwordEncoder.encode("123456")).roles("ADMIN")
                .and()
                .withUser("user").password(passwordEncoder.encode("123456")).roles("USER");
    }
    
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}
学新通

密码模式访问错误解决办法：
https://www.freesion.com/article/5996123135/
错误提示：
学新通

使用postman测试密码模式

1.获取access_token

params方式获取token

http://localhost:9000/oauth/token?client_id=clientApp&client_secret=secretApp&password=123456&grant_type=password&username=admin

学新通
Body方式获取token
学新通

2.获取刷新token(刷新令牌)

4.简化模式

学新通
简化模式代码

package com.heartsuit.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;

/**
 * oauth2.0基于内存简化模式
 */
@Configuration
@EnableAuthorizationServer
public class AuthorizationImplConfig extends AuthorizationServerConfigurerAdapter {

        /**
     * Springboot2.x需要配置密码加密，否则报错：Encoded password does not look like BCrypt
     *
     * @return
     */
    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // http://localhost:9000/oauth/authorize?client_id=clientApp&response_type=token&scope=all&redirect_uri=http://www.百度.com
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("clientApp")// clientID ： 客户端ID
                .secret(passwordEncoder().encode("secretApp"))//secretID : 连接凭证
                .authorizedGrantTypes("implicit","refresh_token")//授权码模式
                .scopes("all", "write")
                 .redirectUris("http://www.百度.com");
    }

    /**
     * [{"timestamp":"2021-01-08T05:56:40.950 0000","status":403,"error":"Forbidden","message":"Forbidden","path":"/oauth/check_token"}]
     */
    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
        oauthServer.tokenKeyAccess("permitAll()")
                .checkTokenAccess("isAuthenticated()")
                .allowFormAuthenticationForClients();
    }

}
学新通
1.获取access_token

复制链接在浏览器访问，

http://localhost:9000/oauth/authorize?client_id=clientApp&response_type=token&scope=all&redirect_uri=http://www.百度.com

第一次访问输入用户名密码
admin/123456
学新通

第二同意认证授权

学新通
第三跳转百度页面，附带assess_token
学新通

这篇好文章是转载于：学新通技术网

  • 版权申明： 本站部分内容来自互联网，仅供学习及演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系，请提供相关证据及您的身份证明，我们将在收到邮件后48小时内删除。
  • 本站站名： 学新通技术网
  • 本文地址： /boutique/detail/tanhgfjhch
系列文章
更多 icon
同类精品
更多 icon
继续加载
友情链接: 申请要求：权重≥3，IP≥1000，内容属同类网站; 申请邮件： luke.wu●vfv.cc 友情链接交换群： 友情链接交换群
外链价格: 【首页 30/月 - 300/年】【内页 50/月 - 500/年】【全站 70/月 - 700/年】 购买外链请加QQ群： 站长交流群