Spring Boot与Spring Security的OAuth2客户端凭证流

Spring Boot和Spring Security集成OAuth2客户端凭证流可以帮助您轻松地在应用程序中实现安全的API访问。以下是配置Spring Boot应用程序以使用OAuth2客户端凭证流的步骤：

1. 添加依赖项

在您的pom.xml文件中添加以下依赖项：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-client</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-jose</artifactId>
</dependency>

2. 配置OAuth2客户端

在application.yml或application.properties文件中配置OAuth2客户端的详细信息，例如客户端ID、客户端密钥和授权服务器URL：

spring:
  security:
    oauth2:
      client:
        registration:
          my-client:
            client-id: your-client-id
            client-secret: your-client-secret
            authorization-grant-type: client_credentials
            scope: read,write
        provider:
          my-provider:
            issuer-uri: https://your-auth-server.com/auth

3. 配置Spring Security

创建一个配置类来设置Spring Security以使用OAuth2客户端凭证流。在这个类中，您需要配置WebSecurityConfigurerAdapter的子类，并覆盖configure(HttpSecurity http)方法：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http, ClientRegistrationRepository clientRegistrations,
                                                  OAuth2AuthorizedClientRepository authorizedClients) throws Exception {
        http
            .authorizeRequests(authorizeRequests ->
                authorizeRequests
                    .antMatchers("/api/**").authenticated()
            )
            .oauth2Login(oauth2Login ->
                oauth2Login
                    .clientRegistrationRepository(clientRegistrations)
                    .authorizedClientRepository(authorizedClients)
            );
        return http.build();
    }
}

4. 使用OAuth2客户端凭证流

现在您可以在应用程序中使用OAuth2客户端凭证流访问受保护的资源。例如，您可以使用RestTemplate或WebClient发起请求：

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.web.reactive.function.client.WebClient;

@Service
public class ApiClientService {

    @Autowired
    private WebClient.Builder webClientBuilder;

    public String callApi() {
        WebClient webClient = webClientBuilder
                .clientRegistrationRepository(clientRegistrations)
                .authorizedClientRepository(authorizedClients)
                .build();

        return webClient.get()
                .uri("https://your-api-server.com/api/data")
                .attributes(clientRegistrationId("my-client"))
                .retrieve()
                .bodyToMono(String.class)
                .block();
    }
}

在这个例子中，我们首先创建了一个WebClient实例，并使用clientRegistrationRepository和authorizedClientRepository配置了OAuth2客户端凭证流。然后，我们使用WebClient发起一个请求到受保护的API资源，并通过attributes方法传递了客户端注册ID。最后，我们使用retrieve()方法获取响应并将其转换为字符串。