Spring Security OAuth2 SSO 单点登录

**

基于 Spring Security OAuth2 SSO 单点登录系统

**
SSO简介

单点登录（英语：Single sign-on，缩写为 SSO），又译为单一签入，一种对于许多相互关连，但是又是各自独立的软件系统，提供访问控制的属性。当拥有这项属性时，当用户登录时，就可以获取所有系统的访问权限，不用对每个单一系统都逐一登录。这项功能通常是以轻型目录访问协议（LDAP）来实现，在服务器上会将用户信息存储到LDAP数据库中。相同的，单一退出（single sign-off）就是指，只需要单一的退出动作，就可以结束对于多个系统的访问权限。

Spring Security OAuth

Spring Security OAuth使用标准的Spring和Spring Security编程模型和配置惯例，为使用Spring Security with OAuth（1a）和OAuth2提供支持。OAuth协议

案例介绍

此工程分为三个模块：授权服务器（sso-auth-server）、web应用a（sso-client-a）、web应用b（sso-client-b），想达到的目的是：某一个用户在a系统登陆后在跳往b系统后不用在重复登录。

sso-auth-server:

pom:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.security.oauth</groupId>
        <artifactId>spring-security-oauth2</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-jwt</artifactId>
    </dependency>
</dependencies>

yml:

server:
  port: 8082
  context-path: /auth_server

SsoServerApplication.java

/**
 * @author Leone
 * @since 2018-05-07
 **/
@SpringBootApplication
public class SsoServerApplication {

    public static void main(String[] args) {
        SpringApplication.run(SsoServerApplication.class, args);
    }

    /**
     * 为测试环境添加相关的 Request Dumper information，便于调试
     *
     * @return
     */
    @Profile("!cloud")
    @Bean
    RequestDumperFilter requestDumperFilter() {
        return new RequestDumperFilter();
    }

}

userDetailsService.java

/**
 * @author Leone
 * @since 2018-05-07
 **/
@Component
public class SsoUserDetailsService implements UserDetailsService {

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return new User(username, passwordEncoder.encode("admin"), AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_USER"));
    }
}

SsoSecurityConfig.java

/**
 * @author Leone
 * @since 2018-05-07
 **/
@Configuration
public class SsoSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .and().authorizeRequests()
                .antMatchers("/**/*.js", "/**/*.css", "/**/*.jpg", "/**/*.png")
                .permitAll()
                .anyRequest().authenticated()
                .and()
                .csrf().disable();
        //  http.formLogin().and().authorizeRequests().anyRequest().authenticated();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }
}

SsoAuthServerConfig.java

/**
 * @author Leone
 * @since 2018-05-07
 **/
@Configuration
@EnableAuthorizationServer
public class SsoAuthServerConfig extends AuthorizationServerConfigurerAdapter {

    /**
     * 客户端一些配置
     *
     * @param clients
     * @throws Exception
     */
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("client1")
                .secret("secret1")
                .authorizedGrantTypes("authorization_code", "refresh_token")
                .scopes("all", "read", "write")
                .autoApprove(true)
                .and()
                .withClient("client2")
                .secret("secret2")
                .authorizedGrantTypes("authorization_code", "refresh_token")
                .scopes("all", "read", "write")
                .autoApprove(true);
    }

    /**
     * 配置jwtTokenStore
     *
     * @param endpoints
     * @throws Exception
     */
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(jwtTokenStore()).accessTokenConverter(jwtAccessTokenConverter());
    }

    /**
     * springSecurity 授权表达式
     *
     * @param security
     * @throws Exception
     */
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security.tokenKeyAccess("isAuthenticated()");
    }

    /**
     * JwtTokenStore
     *
     * @return
     */
    @Bean
    public TokenStore jwtTokenStore() {
        return new JwtTokenStore(jwtAccessTokenConverter());
    }

    /**
     * 生成JTW token
     *
     * @return
     */
    @Bean
    public JwtAccessTokenConverter jwtAccessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey("andy");
        return converter;
    }
}

sso-client-a
pom:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.security.oauth</groupId>
        <artifactId>spring-security-oauth2</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-jwt</artifactId>
    </dependency>

</dependencies>

yml:
server:
  port: 8080
  context-path: /clienta
security:
  oauth2:
    client:
      clientId: client1
      clientSecret: secret1
      access-token-uri: http://127.0.0.1:8082/auth_server/oauth/token    #请求令牌的地址
      user-authorization-uri: http://127.0.0.1:8082/auth_server/oauth/authorize    #请求认证的地址
    resource:
      jwt:
        key-uri: http://127.0.0.1:8082/auth_server/oauth/token_key   #解析jwt令牌所需要密钥的地址

index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>sso-client-A</title>
</head>
<body>
    <h1>sso demo client-A</h1>
    <a href="http://127.0.0.1:8081/clientb/index.html">访问client-b</a>
</body>
</html>

SsoClientA.java

/**
 * @author Leone
 * @since 2018-05-07
 **/
@EnableOAuth2Sso
@SpringBootApplication
public class SsoClientA {
    public static void main(String[] args) {
        SpringApplication.run(SsoClientA.class, args);
    }
}

sso-client-b

pom:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.security.oauth</groupId>
        <artifactId>spring-security-oauth2</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-jwt</artifactId>
    </dependency>

</dependencies>

yml:

server:
  port: 8081
  context-path: /clientb
security:
  oauth2:
    client:
      clientId: client2
      clientSecret: secret2
      access-token-uri: http://127.0.0.1:8082/auth_server/oauth/token
      user-authorization-uri: http://127.0.0.1:8082/auth_server/oauth/authorize
    resource:
      jwt:
        key-uri: http://127.0.0.1:8082/auth_server/oauth/token_key

index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>sso-client-B</title>
</head>
<body>
    <h1>sso demo client-B</h1>
    <a href="http://127.0.0.1:8080/clienta/index.html">访问client-a</a>
</body>
</html>

SsoClientA.java

/**
 * @author Leone
 * @since 2018-05-07
 **/
@RestController
@EnableOAuth2Sso
@SpringBootApplication
public class SsoClientB {

    @Autowired
    private OAuth2RestTemplate oAuth2RestTemplate;

    public static void main(String[] args) {
        SpringApplication.run(SsoClientB.class, args);
    }

    @GetMapping("/user")
    public Authentication user(Authentication user) {
        return user;
    }

    @Bean
    public OAuth2RestTemplate oAuth2RestTemplate(OAuth2ClientContext oAuth2ClientContext, OAuth2ProtectedResourceDetails details){
        return new OAuth2RestTemplate(details,oAuth2ClientContext);
    }
}

项目源码:git@github.com:janlle/sso-server.git