這篇文章是對我以前的文章的增強，該文章討論了如何使用Spring security oauth2保護REST API。

萬一您錯過了它，可以在這里領取： http : //blog.rajithdelantha.com/2015/09/secure-your-rest-api-with-spring.html

Spring Boot是Spring框架的一項新發明，它使開發人員在構建大規模應用程序時的工作更加輕松。 這是抓住概念的好地方。

如果您查看我之前有關oauth2安全的文章，那么您知道在Spring端需要做一些配置。 但是另一方面，Spring boot將完成所有艱苦的工作，我們只需要通過簡單的注釋告訴他們該怎么做。

因此，本文是關于如何使用Spring安全性和Oauth2配置Spring引導項目的。 實際上，我們不能真正說出configure，因為所有大多數配置都是由Spring boot本身完成的。

• 源代碼： https : //github.com/rajithd/spring-boot-oauth2

步驟1

對于這個項目，我在內存數據庫中使用H2。 因此，您無需在運行時創建任何數據庫和表。 但是，如果您希望該項目使用MySQL作為數據源，則首先創建數據庫，然后創建表。

CREATE TABLE user ( username VARCHAR(50) NOT NULL PRIMARY KEY, email VARCHAR(50), password VARCHAR(500), activated BOOLEAN DEFAULT FALSE, activationkey VARCHAR(50) DEFAULT NULL, resetpasswordkey VARCHAR(50) DEFAULT NULL ); CREATE TABLE authority ( name VARCHAR(50) NOT NULL PRIMARY KEY ); CREATE TABLE user_authority ( username VARCHAR(50) NOT NULL, authority VARCHAR(50) NOT NULL, FOREIGN KEY (username) REFERENCES user (username), FOREIGN KEY (authority) REFERENCES authority (name), UNIQUE INDEX user_authority_idx_1 (username, authority) ); CREATE TABLE oauth_access_token ( token_id VARCHAR(256) DEFAULT NULL, token BLOB, authentication_id VARCHAR(256) DEFAULT NULL, user_name VARCHAR(256) DEFAULT NULL, client_id VARCHAR(256) DEFAULT NULL, authentication BLOB, refresh_token VARCHAR(256) DEFAULT NULL ); CREATE TABLE oauth_refresh_token ( token_id VARCHAR(256) DEFAULT NULL, token BLOB, authentication BLOB );

• 用戶表–系統用戶
• 權威–角色
• user_authority –用戶和角色的多對多表
• oauth_access_token –存放access_token
• oauth_refresh_token –保持refresh_token

添加一些種子數據。

INSERT INTO user (username,email, password, activated) VALUES ('admin', 'admin@mail.me', 'b8f57d6d6ec0a60dfe2e20182d4615b12e321cad9e2979e0b9f81e0d6eda78ad9b6dcfe53e4e22d1', true); INSERT INTO user (username,email, password, activated) VALUES ('user', 'user@mail.me', 'd6dfa9ff45e03b161e7f680f35d90d5ef51d243c2a8285aa7e11247bc2c92acde0c2bb626b1fac74', true); INSERT INTO user (username,email, password, activated) VALUES ('rajith', 'rajith@abc.com', 'd6dfa9ff45e03b161e7f680f35d90d5ef51d243c2a8285aa7e11247bc2c92acde0c2bb626b1fac74', true); INSERT INTO authority (name) VALUES ('ROLE_USER'); INSERT INTO authority (name) VALUES ('ROLE_ADMIN'); INSERT INTO user_authority (username,authority) VALUES ('rajith', 'ROLE_USER'); INSERT INTO user_authority (username,authority) VALUES ('user', 'ROLE_USER'); INSERT INTO user_authority (username,authority) VALUES ('admin', 'ROLE_USER'); INSERT INTO user_authority (username,authority) VALUES ('admin', 'ROLE_ADMIN');

第2步

配置WebSecurityAdapter

@Configuration @EnableWebSecurity public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Autowired private UserDetailsService userDetailsService; @Bean public PasswordEncoder passwordEncoder() { return new StandardPasswordEncoder(); } @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { auth .userDetailsService(userDetailsService) .passwordEncoder(passwordEncoder()); } @Override public void configure(WebSecurity web) throws Exception { web .ignoring() .antMatchers("/h2console/**") .antMatchers("/api/register") .antMatchers("/api/activate") .antMatchers("/api/lostpassword") .antMatchers("/api/resetpassword"); } @Override @Bean public AuthenticationManager authenticationManagerBean() throws Exception { return super.authenticationManagerBean(); } @EnableGlobalMethodSecurity(prePostEnabled = true, jsr250Enabled = true) private static class GlobalSecurityConfiguration extends GlobalMethodSecurityConfiguration { @Override protected MethodSecurityExpressionHandler createExpressionHandler() { return new OAuth2MethodSecurityExpressionHandler(); } } }

第三步

Oauth2的配置

@Configuration public class OAuth2Configuration { @Configuration @EnableResourceServer protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter { @Autowired private CustomAuthenticationEntryPoint customAuthenticationEntryPoint; @Autowired private CustomLogoutSuccessHandler customLogoutSuccessHandler; @Override public void configure(HttpSecurity http) throws Exception { http .exceptionHandling() .authenticationEntryPoint(customAuthenticationEntryPoint) .and() .logout() .logoutUrl("/oauth/logout") .logoutSuccessHandler(customLogoutSuccessHandler) .and() .csrf() .requireCsrfProtectionMatcher(new AntPathRequestMatcher("/oauth/authorize")) .disable() .headers() .frameOptions().disable() .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() .authorizeRequests() .antMatchers("/hello/**").permitAll() .antMatchers("/secure/**").authenticated(); } } @Configuration @EnableAuthorizationServer protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter implements EnvironmentAware { private static final String ENV_OAUTH = "authentication.oauth."; private static final String PROP_CLIENTID = "clientid"; private static final String PROP_SECRET = "secret"; private static final String PROP_TOKEN_VALIDITY_SECONDS = "tokenValidityInSeconds"; private RelaxedPropertyResolver propertyResolver; @Autowired private DataSource dataSource; @Bean public TokenStore tokenStore() { return new JdbcTokenStore(dataSource); } @Autowired @Qualifier("authenticationManagerBean") private AuthenticationManager authenticationManager; @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { endpoints .tokenStore(tokenStore()) .authenticationManager(authenticationManager); } @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { clients .inMemory() .withClient(propertyResolver.getProperty(PROP_CLIENTID)) .scopes("read", "write") .authorities(Authorities.ROLE_ADMIN.name(), Authorities.ROLE_USER.name()) .authorizedGrantTypes("password", "refresh_token") .secret(propertyResolver.getProperty(PROP_SECRET)) .accessTokenValiditySeconds(propertyResolver.getProperty(PROP_TOKEN_VALIDITY_SECONDS, Integer.class, 1800)); } @Override public void setEnvironment(Environment environment) { this.propertyResolver = new RelaxedPropertyResolver(environment, ENV_OAUTH); } } }

就是這個。 嘗試通過mvn spring-boot：run運行Spring Boot應用程序

然后通過執行以下curl檢查oauth2的安全性：

• https://github.com/rajithd/spring-boot-oauth2

翻譯自: https://www.javacodegeeks.com/2015/10/spring-boot-oauth2-security.html

總結

以上是生活随笔為你收集整理的Spring Boot Oauth2安全性的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。