oidc auth2.0_使用Spring Security 5.0和OIDC轻松构建身份验证「建议收藏」

Using default security password: 103c55b4-2760-4830-9bca-a06a87d384f9

security.user.password=spring security is ph@!

$ http --auth user:'bf91316f-f894-453a-9268-4826cdd7e151' localhost:8080
HTTP/1.1 404
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Type: application/json;charset=UTF-8
Date: Sun, 03 Dec 2017 19:11:50 GMT
Expires: 0
Pragma: no-cache
Set-Cookie: JSESSIONID=65283FCBDB9E6EF1C0679290AA994B0D; Path=/; HttpOnly
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

{
   "error": "Not Found",
   "message": "No message available",
   "path": "/",
   "status": 404,
   "timestamp": "2017-12-03T19:11:50.846+0000"
}

package com.okta.developer.oidc;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

import java.security.Principal;

@RestController
public class MainController {

   @GetMapping("/")
   String home(Principal user) {
       return "Hello " + user.getName();
   }
}

$ http --auth user:'d7c4138d-a1cc-4cc9-8975-97f37567594a' localhost:8080
HTTP/1.1 200
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 10
Content-Type: text/plain;charset=UTF-8
Date: Sun, 03 Dec 2017 19:26:54 GMT
Expires: 0
Pragma: no-cache
Set-Cookie: JSESSIONID=22A5A91051B7AFBA1DC8BD30C0B53365; Path=/; HttpOnly
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Hello user

spring:
 thymeleaf:
   cache: false
 security:
   oauth2:
     client:
       registration:
         okta:
           client-id: {clientId}
           client-secret: {clientSecret}
       provider:
         okta:
           authorization-uri: https://{yourOktaDomain}.com/oauth2/default/v1/authorize
           token-uri: https://{yourOktaDomain}.com/oauth2/default/v1/token
           user-info-uri: https://{yourOktaDomain}.com/oauth2/default/v1/userinfo
           jwk-set-uri: https://{yourOktaDomain}.com/oauth2/default/v1/keys

<dependency>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-config</artifactId>
</dependency>
<dependency>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-oauth2-client</artifactId>
</dependency>
<dependency>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-oauth2-jose</artifactId>
</dependency>
<dependency>
   <groupId>org.thymeleaf.extras</groupId>
   <artifactId>thymeleaf-extras-springsecurity4</artifactId>
</dependency>

/*
* Copyright 2002-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*      http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.okta.developer.oidc;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpHeaders;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.reactive.function.client.ClientRequest;
import org.springframework.web.reactive.function.client.ExchangeFilterFunction;
import org.springframework.web.reactive.function.client.WebClient;
import reactor.core.publisher.Mono;

import java.util.Collections;
import java.util.Map;

/**
* @author Joe Grandja
*/
@Controller
public class MainController {

   private final OAuth2AuthorizedClientService authorizedClientService;

   public MainController(OAuth2AuthorizedClientService authorizedClientService) {
       this.authorizedClientService = authorizedClientService;
   }

   @RequestMapping("/")
   public String index(Model model, OAuth2AuthenticationToken authentication) {
       OAuth2AuthorizedClient authorizedClient = this.getAuthorizedClient(authentication);
       model.addAttribute("userName", authentication.getName());
       model.addAttribute("clientName", authorizedClient.getClientRegistration().getClientName());
       return "index";
   }

   @RequestMapping("/userinfo")
   public String userinfo(Model model, OAuth2AuthenticationToken authentication) {
       OAuth2AuthorizedClient authorizedClient = this.getAuthorizedClient(authentication);
       Map userAttributes = Collections.emptyMap();
       String userInfoEndpointUri = authorizedClient.getClientRegistration()
               .getProviderDetails().getUserInfoEndpoint().getUri();
       if (!StringUtils.isEmpty(userInfoEndpointUri)) {    // userInfoEndpointUri is optional for OIDC Clients
           userAttributes = WebClient.builder()
                   .filter(oauth2Credentials(authorizedClient)).build()
                   .get().uri(userInfoEndpointUri)
                   .retrieve()
                   .bodyToMono(Map.class).block();
       }
       model.addAttribute("userAttributes", userAttributes);
       return "userinfo";
   }

   private OAuth2AuthorizedClient getAuthorizedClient(OAuth2AuthenticationToken authentication) {
       return this.authorizedClientService.loadAuthorizedClient(
               authentication.getAuthorizedClientRegistrationId(), authentication.getName());
   }

   private ExchangeFilterFunction oauth2Credentials(OAuth2AuthorizedClient authorizedClient) {
       return ExchangeFilterFunction.ofRequestProcessor(
               clientRequest -> {
                   ClientRequest authorizedRequest = ClientRequest.from(clientRequest)
                           .header(HttpHeaders.AUTHORIZATION,
                                   "Bearer " + authorizedClient.getAccessToken().getTokenValue())
                           .build();
                   return Mono.just(authorizedRequest);
               });
   }
}

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"
     xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
<head>
   <title>Spring Security - OAuth 2.0 Login</title>
   <meta charset="utf-8" />
</head>
<body>
<div style="float: right" th:fragment="logout" sec:authorize="isAuthenticated()">
   <div style="float:left">
       <span style="font-weight:bold">User: </span><span sec:authentication="name"></span>
   </div>
   <div style="float:none"> </div>
   <div style="float:right">
       <form action="#" th:action="@{/logout}" method="post">
           <input type="submit" value="Logout" />
       </form>
   </div>
</div>
<h1>OAuth 2.0 Login with Spring Security</h1>
<div>
   You are successfully logged in <span style="font-weight:bold" th:text="${userName}"></span>
   via the OAuth 2.0 Client <span style="font-weight:bold" th:text="${clientName}"></span>
</div>
<div> </div>
<div>
   <a href="/userinfo" th:href="@{/userinfo}">Display User Info</a>
</div>
</body>
</html>

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org">
<head>
   <title>Spring Security - OAuth 2.0 User Info</title>
   <meta charset="utf-8" />
</head>
<body>
<div th:replace="index::logout"></div>
<h1>OAuth 2.0 User Info</h1>
<div>
   <span style="font-weight:bold">User Attributes:</span>
   <ul>
       <li th:each="userAttribute : ${userAttributes}">
           <span style="font-weight:bold" th:text="${userAttribute.key}"></span>: <span th:text="${userAttribute.value}"></span>
       </li>
   </ul>
</div>
</body>
</html>