[译]OAuth2 with Spring 第3部分：使用Spring授权服务器授予authorization_code OIDC客户端

spring:
  security:
    user:

      # Definition of the user details that we will use for login
      # in the authorization server

      name: user
      password: "{noop}secret"
      roles: USER

    # Oauth2 client registration starts from here

    oauth2:
      authorization-server:
        client:

          # We have defined only one client: oidc-client
          # This client information was also mentioned
          # in the above URL: client_id=oidc-client

          oidc-client:
            registration:

              # The following client ID and client secret will be matched with the
              # provided client credentials from client application

              client-id: oidc-client
              client-secret: "{noop}secret2"

              # The following authorization-grant-type will be matched with the
              # provided authorization-grant-type from the client application

              authorization-grant-types:
                - "authorization_code"
                - "refresh_token"
              client-authentication-methods:
                - client_secret_basic

              # This following redirect URI will be used to redirect the resource owner to the
              # Client application after the resource owner (user) provides necessary consents.

              redirect-uris:
                - http://127.0.0.1:8081/login/oauth2/code/oidc-client
              post-logout-redirect-uris:
                - http://127.0.0.1:8081/logout

              # The scopes are defined in the authorization server.
              # These won't display in the consent page

              scopes:
                - "openid"
                - "profile"
                - "read"
                - "write"

            # Marking this flag as true will display the consent page

            require-authorization-consent: true

            # Here we set the access token and refresh token validity duration
            # in seconds

            token:
              access-token-time-to-live: 3600s
              refresh-token-time-to-live: 7200s
#        endpoint:
#          token-uri: "/oauth2/token"
#        issuer-uri: http://127.0.0.1:8080/issuer
logging:
  level:
    org:
      springframework:
        security: trace

server:
  port: 8081

logging:
  level:
    org:
      springframework:
        security: TRACE

spring:
  security:
    oauth2:
      client:
        registration:

          # Client registration starts here
          oidc-client:

            # Our oidc-client needs a provider. The provider information has been registered
            # at the bottom of this configuration
            provider: spring

            # The following client-id and client-secred will be sent to the authorization server
            # for client_credentials authentication to the authorization server. We don't need to
            # mention the client_credentials in the grant type here. Note that, here the client-secret
            # must not have {noop} or any other encoding type mentioned.

            client-id: oidc-client
            client-secret: secret2

            # Our authorization grant type is authorization_code
            authorization-grant-type: authorization_code

            # The following redirect URL is the redirect URL definition of our client Server application.
            # It is generally the current application host address. The authorization server's redirect URL
            # definition means that this URL will be triggered when auth server redirects data to here.
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"

            # Scopes that will be displayed for requesting in the consent page.
            # Authorization server must have equal or more scopes than these in number
            scope:
              - openid
              - profile
              - read
              - write
            client-authentication-method: client_secret_basic

            # This client name will display in the login screen as social login type
            client-name: oidc-client

        # As mentioned above about provider, here we register the provider details
        # for any unknown provider with their issuer URI
        provider:
          spring:
            issuer-uri: http://localhost:8080

      # Since our application acts as both authorization client and resource server,
      # here is the configuration for resource server
      resource-server:
        jwt:
          issuer-uri: http://localhost:8080

package com.mainul35.socialloginclient;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/")
public class AppController {

    @Autowired
    private AppService appService;

    @GetMapping("/")
    public ResponseEntity<String> getPublicData() {
        return ResponseEntity.ok("Public data");
    }

    @GetMapping("/private-data")
    public ResponseEntity<String> getPrivateData() {
        return ResponseEntity.ok(appService.getJwtToken());
    }
}

package com.mainul35.socialloginclient;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
import org.springframework.security.oauth2.core.OAuth2AccessToken;
import org.springframework.security.oauth2.core.OAuth2RefreshToken;
import org.springframework.stereotype.Service;

@Service
public class AppService {

    @Autowired
    private OAuth2AuthorizedClientService authorizedClientService;
    @PreAuthorize("hasAuthority('SCOPE_profile')")
    public String getJwtToken() {
        var authentication = SecurityContextHolder.getContext().getAuthentication();
        var accessToken = getAccessToken(authentication);
        var refreshToken = getRefreshToken(authentication);
        return String.format("Access Token = %s <br><br><br> Refresh Token = %s",
                accessToken.getTokenValue(), refreshToken.getTokenValue());
    }

    public OAuth2AccessToken getAccessToken (Authentication authentication) {
        var authorizedClient = this.getAuthorizedClient(authentication);
        if (authorizedClient != null) {
            OAuth2AccessToken accessToken = authorizedClient.getAccessToken();
            if (accessToken != null) {
                return accessToken;
            }
        }
        return null;
    }
    public OAuth2RefreshToken getRefreshToken(Authentication authentication) {
        var authorizedClient = this.getAuthorizedClient(authentication);
        if (authorizedClient != null) {
            OAuth2RefreshToken refreshToken = authorizedClient.getRefreshToken();
            if (refreshToken != null) {
                return refreshToken;
            }
        }
        return null;
    }

    private OAuth2AuthorizedClient getAuthorizedClient(Authentication authentication) {
        if (authentication instanceof OAuth2AuthenticationToken) {
            OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) authentication;
            String clientRegistrationId = oauthToken.getAuthorizedClientRegistrationId();
            String principalName = oauthToken.getName();
            return authorizedClientService
                    .loadAuthorizedClient(clientRegistrationId, principalName);
        }
        return null;
    }
}

package com.mainul35.socialloginclient;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

@EnableMethodSecurity
@SpringBootApplication
public class SocialLoginClientApplication {

 public static void main(String[] args) {
  SpringApplication.run(SocialLoginClientApplication.class, args);
 }

}