Spring Security OAuth2，如何自定义授权码和访问令牌

Question

我想自定义身份验证代码，以更长的时间访问令牌值。

我没有在Google，Facebook上使用oauth身份验证，并且不支持通过formlogin（）通过内部服务登录ID密码。

我已经看到了这个（https://docs.spring.io/spring-security/site/docs/5.1.1.RELEASE/reference/htmlsingle/#oauth2Client-authorization-request-resolver）

也许此内容与我想要的方向类似，但由于我不使用clientRegistration存储库，所以无法做到这一点。

我正在向内部服务注册oauth客户端并通过db（https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/test/resources/schema.sql）服务

我希望我能告诉您如何更改身份验证代码和访问令牌。

这是SecurityConfig.java文件

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private ClientRegistrationRepository clientRegistrationRepository;

@Autowired
private LoginService loginService;
@Autowired
private LoginFailureHandler loginFailureHandler;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) {
    auth.authenticationProvider(loginService);
}

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers(
            "/webjars/**"
            , "/static/**"
            , "/_hcheck"
    );
}

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.requestMatchers()
            .antMatchers("/login"
                    , "/logout"
                    , "/j_spring_security_check"
                    , "/oauth/authorize"
                    , "/clients/groups/**"
                    , "/clients/**"
                    , "/clients"
                    , "/sso/clients"
                    , "/api/**"
                    , "/secret/matches"
                    , "/auth/defaultToken"
                    , "/main"
            ).and()
            .authorizeRequests()
            .and()
            .formLogin()
            .loginPage("/login")
            .loginProcessingUrl("/j_spring_security_check")
            .usernameParameter("j_username")
            .passwordParameter("j_password")
            .defaultSuccessUrl("/main")
            .failureHandler(loginFailureHandler)
            .permitAll()
            .and()
            .logout()
            .logoutSuccessUrl("/login")
            .and().cors().configurationSource(configurationSource())
            .and().csrf().disable()
      ;
}

private CorsConfigurationSource configurationSource() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    config.addAllowedOrigin("*");
    config.setAllowCredentials(true);
    config.addAllowedHeader("X-Requested-With");
    config.addAllowedHeader("Content-Type");
    config.addAllowedHeader("X-Auth-Token");
    config.addAllowedMethod("*");
    source.registerCorsConfiguration("/**", config);
    return source;
}

@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}

这是OAuth2AuthConfig.java文件

@Configuration
@EnableAuthorizationServer
public class OAuth2AuthConfig extends AuthorizationServerConfigurerAdapter {

@Autowired
DatasourceConfig datasourceConfig;

@Autowired
@Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;

@Bean
@Primary
public DefaultTokenServices tokenServices() {
    final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
    defaultTokenServices.setTokenStore(datasourceConfig.tokenStore());
    defaultTokenServices.setSupportRefreshToken(false);
    return defaultTokenServices;
}

@Override
public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
    oauthServer.tokenKeyAccess("permitAll()")
            .checkTokenAccess("permitAll()");
}

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.jdbc(datasourceConfig.dataSource());
}

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    endpoints
            .tokenStore(datasourceConfig.tokenStore())
            .authenticationManager(authenticationManager)
            .reuseRefreshTokens(false)
            .authorizationCodeServices(jdbcAuthorizationCodeServices());
}

@Bean
public JdbcAuthorizationCodeServices jdbcAuthorizationCodeServices() {
    return new JdbcAuthorizationCodeServices(datasourceConfig.dataSource());
}

@Bean
public BCryptPasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

}