Spring AS 持久化

在 [[spring authorization server 实现授权中心]] 中实现了基础的演示功能。本文包含的内容有：

1. 在 mysql 中保存客户端信息
2. 在 mysql 中保存用户信息

创建数据表

查看 [[spring authorization server 实现授权中心#AuthorizationServerConfig]] 可以看到以下配置，这里定义了一个嵌入数据 Bean，包含 3 条数据库脚本。分别用于创建

• oauth2_registered_client
• oauth2_authorization_consent
• oauth2_authorization

@Bean  
public EmbeddedDatabase embeddedDatabase() {  
    return new EmbeddedDatabaseBuilder()  
            .generateUniqueName(true)  
            .setType(EmbeddedDatabaseType.H2)  
            .setScriptEncoding("UTF-8")  
            .addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql")  
            .addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql")  
            .addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql")  
            .build();  
}

oauth2_registered_client

CREATE TABLE oauth2_registered_client (

id varchar(100) NOT NULL,

client_id varchar(100) NOT NULL,

client_id_issued_at timestamp DEFAULT CURRENT_TIMESTAMP NOT NULL,

client_secret varchar(200) DEFAULT NULL,

client_secret_expires_at timestamp DEFAULT NULL,

client_name varchar(200) NOT NULL,

client_authentication_methods varchar(1000) NOT NULL,

authorization_grant_types varchar(1000) NOT NULL,

redirect_uris varchar(1000) DEFAULT NULL,

scopes varchar(1000) NOT NULL,

client_settings varchar(2000) NOT NULL,

token_settings varchar(2000) NOT NULL,

PRIMARY KEY (id)

);

打开 mysql，创建 auth-center 数据库，执行 [[#oauth2_registered_client]] 脚本。

oauth2_authorization

用户认证时需要此表。

/*

IMPORTANT:

If using PostgreSQL, update ALL columns defined with 'blob' to 'text',

as PostgreSQL does not support the 'blob' data type.

*/

CREATE TABLE oauth2_authorization (

id varchar(100) NOT NULL,

registered_client_id varchar(100) NOT NULL,

principal_name varchar(200) NOT NULL,

authorization_grant_type varchar(100) NOT NULL,

attributes blob DEFAULT NULL,

state varchar(500) DEFAULT NULL,

authorization_code_value blob DEFAULT NULL,

authorization_code_issued_at timestamp DEFAULT NULL,

authorization_code_expires_at timestamp DEFAULT NULL,

authorization_code_metadata blob DEFAULT NULL,

access_token_value blob DEFAULT NULL,

access_token_issued_at timestamp DEFAULT NULL,

access_token_expires_at timestamp DEFAULT NULL,

access_token_metadata blob DEFAULT NULL,

access_token_type varchar(100) DEFAULT NULL,

access_token_scopes varchar(1000) DEFAULT NULL,

oidc_id_token_value blob DEFAULT NULL,

oidc_id_token_issued_at timestamp DEFAULT NULL,

oidc_id_token_expires_at timestamp DEFAULT NULL,

oidc_id_token_metadata blob DEFAULT NULL,

refresh_token_value blob DEFAULT NULL,

refresh_token_issued_at timestamp DEFAULT NULL,

refresh_token_expires_at timestamp DEFAULT NULL,

refresh_token_metadata blob DEFAULT NULL,

PRIMARY KEY (id)

);

配置 application.yml

1. build.gradle 中依赖更改如下所示

   • 添加 mysql 驱动
   • 去掉 H2 相关依赖

   
   ...
   
   dependencies{
   	implementation 'org.springframework.boot:spring-boot-starter-web'  
   	implementation 'org.springframework.boot:spring-boot-starter-security'  
   	implementation 'org.springframework.boot:spring-boot-starter-data-jdbc'  
   	implementation 'org.springframework.security:spring-security-oauth2-authorization-server:0.3.0'  
   	implementation 'org.springframework.boot:spring-boot-starter-actuator'  
   	  
   	compileOnly 'org.projectlombok:lombok'  
   	developmentOnly 'org.springframework.boot:spring-boot-devtools'  
   	runtimeOnly 'mysql:mysql-connector-java'  
   	  
   	annotationProcessor 'org.springframework.boot:spring-boot-configuration-processor'  
   	annotationProcessor 'org.projectlombok:lombok'  
   	  
   	testImplementation 'org.springframework.boot:spring-boot-starter-test'  
   	testImplementation 'org.springframework.security:spring-security-test'
   }
   
   ...
   
   

2. 更改 application.yml 如下

server:  
  port: 9000  
  
logging:  
  level:  
    root: INFO  
    org.springframework.web: INFO  
    org.springframework.security: INFO  
    org.springframework.security.oauth2: INFO  
  
spring:  
  datasource:  
    driver-class-name: com.mysql.cj.jdbc.Driver  
    url: jdbc:mysql://localhost:3306/auth-center?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai  
    username: root  
    password: 123456
  port: 9000

logging:
  level:
    root: INFO
    org.springframework.web: INFO
    org.springframework.security: INFO
    org.springframework.security.oauth2: INFO

spring:
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://localhost:3306/auth-center?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai
    username: root
    password: 123456

client:
  registers:
    - client-id: mobile-gateway-client
      client-secret: "123456"
      authentication-method: client_secret_basic
      grant-types:
        - authorization_code
        - refresh_token
        - client_credentials
      scopes:
        - openid
        - message.read
        - message.write
      redirect-uris:
        - http://127.0.0.1:9100/login/oauth2/code/mobile-gateway-client-oidc
        - http://127.0.0.1:9100/authorized

读取配置 ConfigurationProperties

...
@ConfigurationProperties(prefix = "client")  
@ConstructorBinding  
public record RegisterClientConfig(List<Register> registers) {  
      
    public record Register(String clientId, String clientSecret, String authenticationMethod, List<String> grantTypes,  
                           List<String> scopes, List<String> redirectUris) {  
    }  
}

添加 Member 对象

@Getter  
@Setter  
@ToString  
@AllArgsConstructor  
@RequiredArgsConstructor  
public class Member implements UserDetails {  
  
    private Long id;  
  
    private String loginAccount;  
  
    private String password;  
  
    @Transient  
    private List<GrantedAuthority> authorities;  
  
  
    @Override  
    public Collection<? extends GrantedAuthority> getAuthorities() {  
        return AuthorityUtils.createAuthorityList("read", "write");  
    }  
  
    @Override  
    public String getPassword() {  
        return password;  
    }  
  
    @Override  
    public String getUsername() {  
        return loginAccount;  
    }  
  
    @Override  
    public boolean isAccountNonExpired() {  
        return true;  
    }  
  
    @Override  
    public boolean isAccountNonLocked() {  
        return true;  
    }  
  
    @Override  
    public boolean isCredentialsNonExpired() {  
        return true;  
    }  
  
    @Override  
    public boolean isEnabled() {  
        return true;  
    }  
}

添加 MbrRepository

@Repository  
public interface MbrRepository extends CrudRepository<Member, Long> {  
  
    Optional<Member> findByLoginAccount(String loginAccount);  
}

MbrService

public interface MbrService extends UserDetailsService {  
  
}

UserDetailsServiceImp

@Service  
@RequiredArgsConstructor  
public class UserDetailsServiceImp implements MbrService {  
  
    private final MbrRepository mbrRepository;  
  
    @Override  
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {  
        return mbrRepository.findByLoginAccount(username).orElseThrow(() -> new UsernameNotFoundException("用户不存在"));  
    }  
  
}

AuthorizationServerConfig

...
@Configuration(proxyBeanMethods = false)  
public class AuthorizationServerConfig {  
  
    @Bean  
    @Order(Ordered.HIGHEST_PRECEDENCE)  
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {  
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);  
        return http.formLogin(withDefaults()).build();  
    }  
  
    @Bean  
    public RegisteredClientRepository registeredClientRepository(JdbcTemplate jdbcTemplate) {  
        return new JdbcRegisteredClientRepository(jdbcTemplate);  
    }  
  
    @Bean  
    public OAuth2AuthorizationService authorizationService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) {  
        return new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository);  
    }  
  
    @Bean  
    public JWKSource<SecurityContext> jwkSource() {  
        RSAKey rsaKey = Jwks.generateRsa();  
        JWKSet jwkSet = new JWKSet(rsaKey);  
        return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);  
    }  
  
    @Bean  
    public ProviderSettings providerSettings() {  
        return ProviderSettings.builder().issuer("http://localhost:9000").build();  
    }  
  
}
@EnableWebSecurity
@Configuration(proxyBeanMethods = false)
@RequiredArgsConstructor
public class AuthorizationServerConfig {

    private final JdbcTemplate jdbcTemplate;
    private final RegisterClientConfig clientConfig;
    private final MbrService mbrService;

    @Bean
    @Order(1)
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        http.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
                .exceptionHandling((exceptions) -%3E exceptions
                        .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login"))
                );

        return http.build();
    }

    @Bean
    @Order(2)
    public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeRequests(authorizeRequests -> authorizeRequests.anyRequest().authenticated())
                .userDetailsService(mbrService)
                .formLogin(withDefaults());
        return http.build();
    }

    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        return new JdbcRegisteredClientRepository(jdbcTemplate);
    }

    @Bean
    public OAuth2AuthorizationService authorizationService(RegisteredClientRepository registeredClientRepository, PasswordEncoder passwordEncoder) {
        clientConfig.registers().forEach(cfg -> {
            RegisteredClient registeredClientFromDb = registeredClientRepository.findByClientId(cfg.clientId());
            if (registeredClientFromDb != null) {
                return;
            }
            RegisteredClient.Builder registerBuilder = RegisteredClient.withId(UUID.randomUUID().toString())
                    .clientId(cfg.clientId())
                    .clientSecret(passwordEncoder.encode(cfg.clientSecret()))
                    .clientAuthenticationMethod(new ClientAuthenticationMethod(cfg.authenticationMethod()));
            cfg.grantTypes().forEach(grantType -> registerBuilder.authorizationGrantType(new AuthorizationGrantType(grantType)));
            cfg.redirectUris().forEach(registerBuilder::redirectUri);
            cfg.scopes().forEach(registerBuilder::scope);
            registeredClientRepository.save(registerBuilder.build());
        });
        JdbcOAuth2AuthorizationService jdbcOAuth2AuthorizationService = new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository);
        jdbcOAuth2AuthorizationService.setAuthorizationRowMapper(new RowMapper(registeredClientRepository));
        return jdbcOAuth2AuthorizationService;
    }

    @Bean
    public JWKSource%3CSecurityContext> jwkSource() {
        RSAKey rsaKey = Jwks.generateRsa();
        JWKSet jwkSet = new JWKSet(rsaKey);
        return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
    }


    @Bean
    public ProviderSettings providerSettings() {
        return ProviderSettings.builder().issuer("http://localhost:9000").build();
    }

    @Bean
    public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
        return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
    }

    static class RowMapper extends JdbcOAuth2AuthorizationService.OAuth2AuthorizationRowMapper {
        RowMapper(RegisteredClientRepository registeredClientRepository) {
            super(registeredClientRepository);
            getObjectMapper().addMixIn(Member.class, MemberMixin.class);
        }
    }

    @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
    @JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
            isGetterVisibility = JsonAutoDetect.Visibility.NONE)
    @JsonIgnoreProperties(ignoreUnknown = true)
    @JsonDeserialize(using = MemberDeserializer.class)
    static class MemberMixin {
    }

}

EncoderConfig

@Configuration  
public class EncoderConfig {  
  
    @Bean  
    @ConditionalOnMissingBean(PasswordEncoder.class)  
    public PasswordEncoder passwordEncoder() {  
        return new BCryptPasswordEncoder();  
    }  
}

MemberDeserializer

public class MemberDeserializer extends JsonDeserializer<Member> {  
  
    @Override  
    public Member deserialize(JsonParser jsonParser, DeserializationContext deserializationContext) throws IOException {  
        ObjectMapper mapper = (ObjectMapper) jsonParser.getCodec();  
        JsonNode jsonNode = mapper.readTree(jsonParser);  
        Long id = readJsonNode(jsonNode, "id").asLong();  
        String loginAccount = readJsonNode(jsonNode, "loginAccount").asText();  
        String password = readJsonNode(jsonNode, "password").asText();  
        List<GrantedAuthority> authorities = mapper.readerForListOf(GrantedAuthority.class).readValue(jsonNode.get("authorities"));  
        return new Member(id, loginAccount, password, authorities);  
    }  
  
    private JsonNode readJsonNode(JsonNode jsonNode, String field) {  
        return jsonNode.has(field) ? jsonNode.get(field) : MissingNode.getInstance();  
    }  
}

启动服务

@SpringBootApplication  
@ConfigurationPropertiesScan  
public class AuthCenterApplication {  
  
    public static void main(String[] args) {  
        SpringApplication.run(AuthCenterApplication.class, args);  
    }  
}

总结

1. 目前 spring authorization server 版本是 0.3.0 ，在我看来仍然有诸多不完善的地方，但官方总不至于又实现一套 keycloak。
2. 0.3.0 版本发布之际，官方文档 也放出来了。