Spring Boot 整合 OAuth2 安全框架是一个常见的需求，特别是在构建现代 Web 应用时。以下是一个基本的步骤指南，帮助你整合 Spring Boot 和 OAuth2。
首先，在你的 pom.xml 文件中添加必要的依赖项。你需要 Spring Security 和 Spring Boot 的 OAuth2 支持。
<dependencies>
<!-- Spring Security -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!-- Spring Security OAuth2 -->
<dependency>
<groupId>org.springframework.security.oauth.boot</groupId>
<artifactId>spring-security-oauth2-autoconfigure</artifactId>
</dependency>
<!-- Spring Boot Starter Web for creating RESTful services -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
</dependencies>
在你的 application.yml 或 application.properties 文件中配置 OAuth2 客户端信息。
spring:
security:
oauth2:
client:
registration:
my-client:
client-id: your-client-id
client-secret: your-client-secret
authorization-grant-type: password
scope: read,write
provider:
my-provider:
issuer-uri: https://your-auth-server/oauth/token
spring.security.oauth2.client.registration.my-client.client-id=your-client-id
spring.security.oauth2.client.registration.my-client.client-secret=your-client-secret
spring.security.oauth2.client.registration.my-client.authorization-grant-type=password
spring.security.oauth2.client.registration.my-client.scope=read,write
spring.security.oauth2.provider.my-provider.issuer-uri=https://your-auth-server/oauth/token
创建一个配置类来设置 Spring Security 和 OAuth2。
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
import org.springframework.security.oauth2.server.resource.authentication.JwtBearerAuthenticationConverter;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.authorizeRequests(authorize -> authorize
.antMatchers("/actuator/**").permitAll()
.anyRequest().authenticated()
)
.oauth2Login(oauth2 -> oauth2
.loginPage("/login")
.defaultSuccessUrl("/home")
);
return http.build();
}
}
创建一个简单的登录页面 src/main/resources/templates/login.html。
<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
<title>Login</title>
</head>
<body>
<h1>Login</h1>
<form method="post" action="/login">
<label for="username">Username:</label>
<input type="text" id="username" name="username" required><br><br>
<label for="password">Password:</label>
<input type="password" id="password" name="password" required><br><br>
<button type="submit">Login</button>
</form>
</body>
</html>
创建一个简单的 RESTful 服务来测试保护资源。
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class MyController {
@GetMapping("/home")
public String home() {
return "Welcome to the home page!";
}
@GetMapping("/protected")
public String protectedResource(OAuth2AuthorizedClient authorizedClient) {
return "This is a protected resource. User: " + authorizedClient.getName();
}
}
启动你的 Spring Boot 应用，并尝试访问受保护的资源。你应该会被重定向到 OAuth2 登录页面，登录成功后可以访问受保护的资源。
以上步骤涵盖了 Spring Boot 整合 OAuth2 的基本流程。你可以根据需要进一步扩展和定制配置，例如添加更多的授权类型、配置客户端凭证授权等。
免责声明：本站发布的内容（图片、视频和文字）以原创、转载和分享为主，文章观点不代表本网站立场，如果涉及侵权请联系站长邮箱：is@yisu.com进行举报，并提供相关证据，一经查实，将立刻删除涉嫌侵权内容。
