spring boot OAuth2基于角色的授权

Question

我们有一个扩展AuthorizationServerConfigurerAdapter的专用授权服务器,我们在其中设置了覆盖void configure(ClientDetailsS​​erviceConfigurer clients)方法的权限.

    @Configuration
    @EnableAuthorizationServer
    protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {

    @Value('${oauth.clientId}')
    private String clientId

    @Value('${oauth.secret:}')
    private String secret

    @Value('${oauth.resourceId}')
    private String resourceId

    @Autowired
    @Qualifier('authenticationManagerBean')
    private AuthenticationManager authenticationManager

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        return new JwtAccessTokenConverter();
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.checkTokenAccess("permitAll()")
        oauthServer.allowFormAuthenticationForClients()
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager)
                .accessTokenConverter(accessTokenConverter())
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient(clientId)
                .secret(secret)
                .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                .authorities("USER", "ADMIN")
                .scopes("read", "write", "trust")
                .resourceIds(resourceId)
    }

现在,如何使用资源服务器中的权限进行基于角色的授权.我们可以通过授权服务器生成的令牌进行身份验证.需要帮忙.

Answer 1

在资源服务器中,您应该扩展ResourceServerConfigurerAdapter以配置requestMatchers并为每个资源设置角色.

@Configuration
@EnableResourceServer
public class OAuth2Config extends ResourceServerConfigurerAdapter {

    @Value("${keys.public}")
    private String publicKey;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .requestMatchers()
                .antMatchers("/**")
                .and()
                .authorizeRequests()
                .antMatchers("/service1/**").access("#oauth2.hasScope('ADMIN')")
                .antMatchers("/service2/**").access("#oauth2.hasScope('USER')");
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.tokenStore(tokenStore());
    }

    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(jwtAccessTokenConverter());
    }

    @Bean
    public JwtAccessTokenConverter jwtAccessTokenConverter() {
        JwtAccessTokenConverter tokenConverter = new JwtAccessTokenConverter();
        tokenConverter.setVerifierKey(publicKey);
        return tokenConverter;
    }
}