Question

我们有一个扩展AuthorizationServerConfigurerAdapter的专用授权服务器，我们在其中设置权限覆盖void configure（ClientDetailsServiceConfigurer clients）方法。

    @Configuration
    @EnableAuthorizationServer
    protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {

    @Value('${oauth.clientId}')
    private String clientId

    @Value('${oauth.secret:}')
    private String secret

    @Value('${oauth.resourceId}')
    private String resourceId

    @Autowired
    @Qualifier('authenticationManagerBean')
    private AuthenticationManager authenticationManager

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        return new JwtAccessTokenConverter();
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.checkTokenAccess("permitAll()")
        oauthServer.allowFormAuthenticationForClients()
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager)
                .accessTokenConverter(accessTokenConverter())
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient(clientId)
                .secret(secret)
                .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                .authorities("USER", "ADMIN")
                .scopes("read", "write", "trust")
                .resourceIds(resourceId)
    }

现在如何使用资源服务器中的权限进行基于角色的授权。我们可以通过授权服务器生成的令牌进行身份验证。需要帮助。

Answer 1

在资源服务器中，您应该扩展ResourceServerConfigurerAdapter以配置requestMatchers并为每个资源设置角色。

@Configuration
@EnableResourceServer
public class OAuth2Config extends ResourceServerConfigurerAdapter {

    @Value("${keys.public}")
    private String publicKey;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .requestMatchers()
                .antMatchers("/**")
                .and()
                .authorizeRequests()
                .antMatchers("/service1/**").access("#oauth2.hasScope('ADMIN')")
                .antMatchers("/service2/**").access("#oauth2.hasScope('USER')");
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.tokenStore(tokenStore());
    }

    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(jwtAccessTokenConverter());
    }

    @Bean
    public JwtAccessTokenConverter jwtAccessTokenConverter() {
        JwtAccessTokenConverter tokenConverter = new JwtAccessTokenConverter();
        tokenConverter.setVerifierKey(publicKey);
        return tokenConverter;
    }
}

Answer 2

您已从auth服务器收到令牌。您现在可以使用该令牌向auth服务器发出另一个请求以检索用户对象。这个json对象将包含角色（权限）。请求如下所示。

    curl -H "Authorization: Bearer 2a953581-e9c9-4278-b42e-8af925f49a99"  
    http://localhost:9999/uaa/user

为此，您需要创建用户服务端点并实现UserDetailsService。

    @RequestMapping("/user")
public Principal user(Principal user) {
    return user;
}
    @Bean
     UserDetailsService userDetailsService.....

在UserDetailsService.User中的org.springframework.security.core.userdetails中创建并设置角色列表，如下所示。

AuthorityUtils.createAuthorityList("ROLE_USER", "ROLE_ADMIN"));

spring boot OAuth2基于角色的授权

2 个答案: