spring-security-oauth2-authorization-server和spring-boot-starter-oauth2-client和spring-boot-starter-oauth2-resource-server

### Spring Security OAuth2 配置指南 #### 1. 授权服务器 (Authorization Server) 为了配置授权服务器，可以使用 `spring-security-oauth2-authorization-server` 提供的功能。以下是具体的步骤： 引入必要的依赖项： ```xml <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-oauth2-authorization-server</artifactId> <version>1.0.0</version> </dependency> ``` 创建一个类来启用授权服务器功能并定义令牌端点和其他必要设置： ```java import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.oauth2.server.authorization.config.ProviderSettings; @Configuration(proxyBeanMethods = false) public class AuthorizationServerConfig { @Bean public ProviderSettings providerSettings() { return ProviderSettings.builder() .issuer("https://example.com") // 设置发行者URL .build(); } protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests(authorize -> authorize.anyRequest().authenticated()) .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt); } } ``` 上述代码片段展示了如何通过自定义 `ProviderSettings` 来指定授权服务器的相关参数[^1]。 --- #### 2. 客户端 (Client Configuration) 要使应用程序作为OAuth2客户端运行，需添加以下依赖项： ```xml <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-oauth2-client</artifactId> </dependency> ``` 在 `application.yml` 或 `application.properties` 文件中提供客户端的具体配置信息： ```yaml spring: security: oauth2: client: registration: google: clientId: your-google-client-id clientSecret: your-google-client-secret redirectUri: "{baseUrl}/login/oauth2/code/{registrationId}" scope: - email - profile provider: google: authorization-uri: https://accounts.google.com/o/oauth2/v2/auth token-uri: https://www.googleapis.com/oauth2/v4/token user-info-uri: https://www.googleapis.com/oauth2/v3/userinfo jwk-set-uri: https://www.googleapis.com/oauth2/v3/certs ``` 此部分描述了如何注册外部身份提供商（如Google），以及如何获取用户的电子邮件和个人资料数据[^2]。 --- #### 3. 资源服务器 (Resource Server) 资源服务器负责验证传入请求中的访问令牌，并保护受控API免遭未经授权的访问。为此，应加入如下依赖： ```xml <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-oauth2-resource-server</artifactId> </dependency> ``` 接着，在安全配置文件中声明资源服务器的行为模式： ```java import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.web.SecurityFilterChain; @Configuration public class ResourceServerConfig { @Bean public SecurityFilterChain resourceServerSecurityFilterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(authz -> authz .anyRequest().authenticated()) .oauth2ResourceServer(oauth2 -> oauth2.jwt()); return http.build(); } } ``` 这里说明的是如何利用JWT解析器对进入系统的每一个HTTP请求执行认证操作[^3]。 --- #### 总结 以上分别介绍了基于Spring Boot框架下构建OAuth2架构所需的三个核心模块——授权服务器、客户端和资源服务器的基础搭建方法及其相互协作方式。每一步都紧密关联着实际项目开发过程中的需求场景和技术选型考量因素。