SpringSecurity OAtu2+JWT实现微服务版本的单点登录的示例

   < dependencies >

        < dependency >

            < groupId >org.springframework.boot</ groupId >

            < artifactId >spring-boot-starter-thymeleaf</ artifactId >

        </ dependency >

        < dependency >

            < groupId >org.springframework.boot</ groupId >

            < artifactId >spring-boot-starter-web</ artifactId >

        </ dependency >

        < dependency >

            < groupId >org.springframework.cloud</ groupId >

            < artifactId >spring-cloud-starter-oauth2</ artifactId >

        </ dependency >

        < dependency >

            < groupId >org.springframework.cloud</ groupId >

            < artifactId >spring-cloud-starter-security</ artifactId >

        </ dependency >

        < dependency >

            < groupId >org.springframework.boot</ groupId >

            < artifactId >spring-boot-starter-test</ artifactId >

            < scope >test</ scope >

            < exclusions >

                < exclusion >

                    < groupId >org.junit.vintage</ groupId >

                    < artifactId >junit-vintage-engine</ artifactId >

                </ exclusion >

            </ exclusions >

        </ dependency >

    </ dependencies >

@Component

public class SheepUserDetailsService implements UserDetailsService {

    @Autowired

    private PasswordEncoder passwordEncoder;

    @Override

    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {

        if ( ! "admin" .equals(s) )

            throw new UsernameNotFoundException( "用户" + s + "不存在" );

        return new User( s, passwordEncoder.encode( "123456" ), AuthorityUtils测试数据maSeparatedStringToAuthorityList( "ROLE_NORMAL,ROLE_MEDIUM" ));

    }

}

@Configuration

@EnableAuthorizationServer

public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired

    AuthenticationManager authenticationManager;

    @Autowired

    SheepUserDetailsService sheepUserDetailsService;

    @Override

    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        // 定义了两个客户端应用的通行证

        clients.inMemory()

                .withClient( "admin" )

                .secret( new BCryptPasswordEncoder().encode( "123456" ))

                .authorizedGrantTypes( "authorization_code" , "refresh_token" , "password" )

                .scopes( "all" )

                .autoApprove( true )

                .redirectUris( "http://192.168.216.1:8001/login" , "http://192.168.216.1:8004/login" );

    }

    @Override

    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        endpoints.tokenStore(jwtTokenStore()).accessTokenConverter(jwtAccessTokenConverter());

        DefaultTokenServices tokenServices = (DefaultTokenServices) endpoints.getDefaultAuthorizationServerTokenServices();

        tokenServices.setTokenStore(endpoints.getTokenStore());

        tokenServices.setSupportRefreshToken( true );

        tokenServices.setClientDetailsService(endpoints.getClientDetailsService());

        tokenServices.setTokenEnhancer(endpoints.getTokenEnhancer());

        tokenServices.setAccessTokenValiditySeconds(( int ) TimeUnit.DAYS.toSeconds( 1 )); // 一天有效期

        endpoints.tokenServices(tokenServices);

        //密码模式配置

        endpoints.authenticationManager(authenticationManager).userDetailsService(sheepUserDetailsService);

    }

    @Override

    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {

        security

                .tokenKeyAccess( "isAuthenticated()" )

                .checkTokenAccess( "permitAll()" )

                .allowFormAuthenticationForClients();

    }

    @Bean

    public TokenStore jwtTokenStore() {

        return new JwtTokenStore(jwtAccessTokenConverter());

    }

    @Bean

    public JwtAccessTokenConverter jwtAccessTokenConverter(){

        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();

        converter.setSigningKey( "testKey" );

        return converter;

    }

}

public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override

    @Bean

    public AuthenticationManager authenticationManager() throws Exception {

        return super .authenticationManager();

    }

    @Autowired

    private UserDetailsService userDetailsService;

    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

    @Autowired

    private CustomLogoutSuccessHandler customLogoutSuccessHandler;

    @Bean

    public DaoAuthenticationProvider authenticationProvider() {

        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();

        authenticationProvider.setUserDetailsService(userDetailsService);

        authenticationProvider.setPasswordEncoder(passwordEncoder());

        authenticationProvider.setHideUserNotFoundExceptions( false );

        return authenticationProvider;

    }

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http.requestMatchers().antMatchers( "/oauth/**" , "/login/**" , "/logout/**" , "/uac/oauth/token" , "/remove" )

                .and()

                .authorizeRequests()

                .antMatchers( "/oauth/**" ).authenticated()

                .and()

                .formLogin().permitAll()

                .and()

                .logout()

                .logoutSuccessHandler(customLogoutSuccessHandler)

                // 无效会话

                .invalidateHttpSession( true )

                // 清除身份验证

                .clearAuthentication( true )

                .permitAll();

    }

    @Override

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.authenticationProvider(authenticationProvider());

    }

}

@Component

public class CustomLogoutSuccessHandler extends AbstractAuthenticationTargetUrlRequestHandler implements LogoutSuccessHandler {

    @Override

    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {

        // 将子系统的cookie删掉

        //建议将token也删除,直接写个controller接口就可以了,可以在前端调用/logout的同时调用删除token接口

        Cookie[] cookies = request.getCookies();

        if (cookies != null && cookies.length> 0 ){

            for (Cookie cookie : cookies){

                cookie.setMaxAge( 0 );

                cookie.setPath( "/" );

                response.addCookie(cookie);

            }

        }

        super .handle(request, response, authentication);

    }

}

        < dependency >

            < groupId >org.springframework.cloud</ groupId >

            < artifactId >spring-cloud-starter-oauth2</ artifactId >

        </ dependency >

        < dependency >

            < groupId >org.springframework.cloud</ groupId >

            < artifactId >spring-cloud-starter-security</ artifactId >

        </ dependency >

auth-server: http://localhost:8085/uac

security:

   oauth2:

     client:

       client-id: admin

       client-secret: 123456

       user-authorization-uri: ${auth-server}/oauth/authorize #认证

       access-token-uri: ${auth-server}/oauth/token #获取token

     resource:

       jwt:

         key-uri: ${auth-server}/oauth/token_key #忘了,反正要写上

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity (prePostEnabled = true )

@EnableOAuth2Sso

public class ClientWebsecurityConfigurer extends WebSecurityConfigurerAdapter {

    @Override

    public void configure(HttpSecurity http) throws Exception {

    //下面表示该模块所有请求都要拦截

    //因为在yml配置了认证中心的各个路径,所以会自动跳转到认证中心去认证

    //如果你想在当前模块排除哪些拦截,可以在下面去排除

        http.antMatcher( "/**" ).authorizeRequests()

                .anyRequest().authenticated();

    }

}

    @GetMapping ( "/get" )

    @PreAuthorize ( "hasAuthority('ROLE_NORMAL')" )

    public String get(HttpServletRequest request){

        System.out.println( "函数进来了" );

        return "uusb1j" ;

    }

}