集成Spring Security與OAuth2是一個相對復雜的過程，但以下是一個基本的步驟指南，幫助你完成這個任務：
首先，在你的項目中添加Spring Security和OAuth2相關的依賴。如果你使用的是Maven，可以在pom.xml中添加以下依賴：
<dependencies>
<!-- Spring Security -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!-- OAuth2 -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-client</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-jose</artifactId>
</dependency>
</dependencies>
在你的Spring Boot應用中配置OAuth2客戶端。你需要在application.yml或application.properties文件中添加以下配置：
spring:
security:
oauth2:
client:
registration:
my-client:
client-id: your-client-id
client-secret: your-client-secret
authorization-grant-type: authorization_code
redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
scope: read,write
provider:
my-provider:
issuer-uri: https://your-auth-server.com
user-name-attribute: username
接下來，配置Spring Security以使用OAuth2進行身份驗證。你可以創建一個配置類來實現這一點：
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
import org.springframework.security.oauth2.client.web.reactive.function.client.ServletOAuth2AuthorizedClientExchangeFilterFunction;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests(authorizeRequests ->
authorizeRequests
.antMatchers("/public/**").permitAll()
.anyRequest().authenticated()
)
.oauth2Login(oauth2Login ->
oauth2Login
.loginPage("/login")
.defaultSuccessUrl("/home")
.userInfoEndpoint(userInfoEndpoint ->
userInfoEndpoint
.userService(userService)
)
);
}
@Bean
public ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2Client() {
ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2Client =
new ServletOAuth2AuthorizedClientExchangeFilterFunction(clientRegistrationRepository(), authorizedClientRepository());
oauth2Client.setDefaultClientRegistrationId("my-client");
return oauth2Client;
}
// Optional: Custom user service if needed
@Bean
public UserService userService() {
return new UserService() {
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
// Implement user loading logic
return new User(username, "password", Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER")));
}
};
}
}
創建一個簡單的登錄頁面和一個主頁，以便用戶可以登錄并使用OAuth2進行身份驗證。
login.html:
<!DOCTYPE html>
<html>
<head>
<title>Login</title>
</head>
<body>
<h1>Login</h1>
<form action="/login/oauth2/code/my-client" method="get">
<input type="text" name="username" placeholder="Username">
<input type="password" name="password" placeholder="Password">
<button type="submit">Login</button>
</form>
</body>
</html>
home.html:
<!DOCTYPE html>
<html>
<head>
<title>Home</title>
</head>
<body>
<h1>Welcome, {{#currentUser.name}}</h1>
<a href="/logout">Logout</a>
</body>
</html>
現在，你可以運行你的Spring Boot應用，并嘗試使用OAuth2進行身份驗證。訪問http://localhost:8080/login，你應該會被重定向到你的授權服務器進行身份驗證，然后返回到你的應用并顯示主頁。
以上步驟涵蓋了集成Spring Security與OAuth2的基本過程。根據你的具體需求，你可能需要進行更多的定制和配置。確保你了解OAuth2的工作原理和Spring Security的安全特性，以便更好地設計和實現你的應用。
