深入 Spring Authorization Server：为何需要自定义密码模式？

作者：老汪软件技巧
发表时间：2024-12-10 04:04
浏览量：

一、引言

随着 OAuth 2.1 标准的推广，密码模式（Password Grant）因安全性问题逐渐被弃用。然而，在许多实际场景中，仍存在对密码模式的需求。那么，为什么在 Spring Authorization Server 中需要自定义密码模式？它的实现有哪些挑战和注意点？本文将从密码模式的背景、需求以及技术实现三方面展开分析。

二、密码模式的背景与现状1. 密码模式的定义

优点：简单易用，特别适合第一方应用。

缺点：直接暴露用户名和密码，容易被攻击。

2. OAuth 2.1 标准不再推荐密码模式

Spring Authorization Server 默认不支持密码模式。

3. 为什么还有密码模式的需求？三、为什么需要自定义密码模式？1. Spring Authorization Server 不再提供内置支持2. 现有项目的需求场景

需求的权衡：

四、自定义密码模式的实现步骤1.pom.xml

<dependencies>
    
    <dependency>
        <groupId>com.alibaba.cloudgroupId>
        <artifactId>spring-cloud-starter-alibaba-nacos-discoveryartifactId>
    dependency>
    
    <dependency>
        <groupId>org.springframework.securitygroupId>
        <artifactId>spring-security-oauth2-authorization-serverartifactId>
    dependency>
    
    <dependency>
        <groupId>org.springframework.securitygroupId>
        <artifactId>spring-security-oauth2-resource-serverartifactId>
    dependency>
    
    <dependency>
        <groupId>org.springframework.bootgroupId>
        <artifactId>spring-boot-starter-webartifactId>
    dependency>
    
    <dependency>
        <groupId>org.springframework.bootgroupId>
        <artifactId>spring-boot-starter-data-redisartifactId>
    dependency>
    
    <dependency>
        <groupId>cn.hutoolgroupId>
        <artifactId>hutool-allartifactId>
    dependency>
    
    <dependency>
        <groupId>com.mysqlgroupId>
        <artifactId>mysql-connector-jartifactId>
    dependency>
    <dependency>
        <groupId>org.springframework.bootgroupId>
        <artifactId>spring-boot-starter-jdbcartifactId>
    dependency>
dependencies>

由于我采用的是父子模块，这里先上一下我的版本号

2.先在AuthorizationServerConfig配置类中先添加我们要自定义的类

/**
 * 该类是授权服务器的配置类
 */
@Configuration
@EnableWebSecurity
public class AuthorizationServerConfig {
    @Resource
    private MyUserDetailServiceImpl myUserDetailServiceImpl; //该类是我自定义的UserDetail用于密码模式从数据库中查询校验用户信息
    @Resource
    private OAuth2AuthorizationService oAuth2AuthorizationService;
    /**
     * 配置密码编码器
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(10);
    }
    @Bean   //自定义的身份验证
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
        daoAuthenticationProvider.setUserDetailsService(myUserDetailServiceImpl);
        daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
        return daoAuthenticationProvider;
    }
    /**
     * 配置认证管理器（AuthenticationManager）
     */
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
    /*
    配置注册客户端
     */
    @Bean                                                            //这里会自动注入我自定义的配置
    public RegisteredClientRepository registeredClientRepository(PasswordEncoder passwordEncoder) {
        RegisteredClient build = RegisteredClient.withId(UUID.randomUUID().toString())
                .clientId("client") //  第三方客户端的名称
                .clientSecret(passwordEncoder.encode("coin-secret"))// 客户端秘钥
                .scope("all") //第三方客户端额度授权范围  指定客户端的权限范围，例如允许访问用户的只读数据或完全控制
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)//授权码模式
                .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) //刷新token模式
                .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) //客户端模式 不涉及用户的授权流程，仅基于客户端的 client_id 和 client_secret 验证。通常用于服务之间的授权。
                .authorizationGrantType(AuthorizationGrantType.PASSWORD)  //自定义的密码模式
                .tokenSettings(TokenSettings.builder()
                        .accessTokenTimeToLive(Duration.ofHours(1))
                        .refreshTokenTimeToLive(Duration.ofDays(7)).build())
//                .redirectUri("http://localhost:9999/login/oauth2/code/demo-client") ////认证回调地址，接收认证服务器回传的code，需要和客户端配置的一致
                .redirectUri("https://www.baidu.com")
                //客户端设置用户需要确认授权
                .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
//                .tokenSettings(TokenSettings.builder().build())
                //客户端的权限范围
//                .scope(OidcScopes.OPENID)
                .build();
        return new InMemoryRegisteredClientRepository(build);
    }
    /**
     * Spring Authorization Server 相关配置
     * 主要配置OAuth 2.1和OpenID Connect 1.0
     */
    @Bean
    @Order(1)
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http, AuthenticationManager authenticationManager, OAuth2TokenGenerator tokenGenerator,CustomAuthenticationEntryPoint customAuthenticationEntryPoint)
            throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
                //开启OpenID Connect 1.0（其中oidc为OpenID Connect的缩写）   就会返回一个ID token
                .oidc(Customizer.withDefaults())
                //以下是自定义端点
                .tokenEndpoint(tokenEndpoint -> tokenEndpoint
                        .accessTokenRequestConverter(new OAuth2ResourceOwnerPasswordAuthenticationConverter())
                        .authenticationProvider(new OAuth2ResourceOwnerPasswordAuthenticationProvider(authenticationManager, oAuth2AuthorizationService, tokenGenerator)));
//                        .accessTokenResponseHandler(new MyAuthenticationSuccessHandler())
//                        .errorResponseHandler(new MyAuthenticationFailureHandler()));
        http
                //将需要认证的请求，通过json错误信息响应回去
                .exceptionHandling((exceptions) -> exceptions
                        .defaultAuthenticationEntryPointFor(
                                customAuthenticationEntryPoint,
                                new MediaTypeRequestMatcher(MediaType.APPLICATION_JSON)
                        )
                )
                // 使用jwt处理接收到的access token
                .oauth2ResourceServer((resourceServer) -> resourceServer
                        .jwt(Customizer.withDefaults()));
        return http.build();
    }
    /**
     * 该方法是spring security的配置
     *
     * @param http
     * @return
     * @throws Exception
     */
    @Bean
    @Order(2)
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http.csrf(customize -> customize.disable())
                .authorizeHttpRequests(authorizeRequests -> authorizeRequests.anyRequest().authenticated())
                .formLogin(Customizer.withDefaults()) // 使用表单登录（适合手动测试）
                .build();
    }
    @Bean  //用于签署访问令牌。
    public JWKSource jwkSource() {
        KeyPair keyPair = generateRsaKey();
        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic(); //公钥
        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate(); //私钥
        RSAKey rsaKey = new RSAKey.Builder(publicKey)
                .privateKey(privateKey)
                .keyID(UUID.randomUUID().toString())
                .build();
        JWKSet jwkSet = new JWKSet(rsaKey);
        return new ImmutableJWKSet<>(jwkSet);
    }
    /*
           深沉RSA密钥对，给上面jwkSource() 方法提供密钥对
     */
    private static KeyPair generateRsaKey() {
        KeyPair keyPair;
        try {
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
            keyPairGenerator.initialize(2048);
            keyPair = keyPairGenerator.generateKeyPair();
        } catch (Exception ex) {
            throw new IllegalStateException(ex);
        }
        return keyPair;
    }
    /*
        配置JWT解析器
     */
    @Bean
    public JwtDecoder jwtDecoder(JWKSource jwkSource) {
        return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
    }
    /**
     * 配置授权服务器请求地址
     */
    @Bean
    public AuthorizationServerSettings authorizationServerSettings() {
        //什么都不配置，则使用默认地址
        return AuthorizationServerSettings.builder().build();
    }
    @Bean
    public OAuth2TokenGenerator tokenGenerator() {
        NimbusJwtEncoder jwtEncoder = new NimbusJwtEncoder(jwkSource());
        JwtGenerator jwtGenerator = new JwtGenerator(jwtEncoder);
        jwtGenerator.setJwtCustomizer(tokenCustomizer());
        OAuth2AccessTokenGenerator accessTokenGenerator = new OAuth2AccessTokenGenerator();
        OAuth2RefreshTokenGenerator refreshTokenGenerator = new OAuth2RefreshTokenGenerator();
        return new DelegatingOAuth2TokenGenerator(
                jwtGenerator, accessTokenGenerator, refreshTokenGenerator);
    }
    @Bean
    public OAuth2TokenCustomizer tokenCustomizer() {
        return context -> {
            Authentication principal = context.getPrincipal();
            if (OAuth2TokenType.ACCESS_TOKEN.equals(context.getTokenType())) {
                Set authorities = principal.getAuthorities().stream().map(GrantedAuthority::getAuthority)
                        .collect(Collectors.toSet());
                context.getClaims().claim("authorities", authorities);
            }
            if (OidcParameterNames.ID_TOKEN.equals(context.getTokenType().getValue())) {
                Set authorities = principal.getAuthorities().stream().map(GrantedAuthority::getAuthority)
                        .collect(Collectors.toSet());
                context.getClaims().claim("authorities", authorities);
            }
        };
    }

大部分代码可以参考官网

其中比较重要的步骤是

/**
     * Spring Authorization Server 相关配置
     * 主要配置OAuth 2.1和OpenID Connect 1.0
     */
    @Bean
    @Order(1)
    public SecurityFilterChain authorizationServerSecurityFilterChain(
    HttpSecurity http,
    AuthenticationManager authenticationManager,
    OAuth2TokenGenerator tokenGenerator,
    CustomAuthenticationEntryPoint customAuthenticationEntryPoint)
            throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
                //开启OpenID Connect 1.0（其中oidc为OpenID Connect的缩写）   就会返回一个ID token
                .oidc(Customizer.withDefaults())
                //以下是自定义端点
                .tokenEndpoint(tokenEndpoint -> tokenEndpoint
                        .accessTokenRequestConverter(new OAuth2ResourceOwnerPasswordAuthenticationConverter())
                        .authenticationProvider(new OAuth2ResourceOwnerPasswordAuthenticationProvider(
                        authenticationManager,
                        oAuth2AuthorizationService,
                        tokenGenerator)));
//                        .accessTokenResponseHandler(new MyAuthenticationSuccessHandler())
//                        .errorResponseHandler(new MyAuthenticationFailureHandler()));
        http
                //将需要认证的请求，通过json错误信息响应回去
                .exceptionHandling((exceptions) -> exceptions
                        .defaultAuthenticationEntryPointFor(
                                customAuthenticationEntryPoint,
                                new MediaTypeRequestMatcher(MediaType.APPLICATION_JSON)
                        )
                )
                // 使用jwt处理接收到的access token
                .oauth2ResourceServer((resourceServer) -> resourceServer
                        .jwt(Customizer.withDefaults()));
        return http.build();
    }

添加了自定义端点

                .tokenEndpoint(tokenEndpoint -> tokenEndpoint
                        .accessTokenRequestConverter(new OAuth2ResourceOwnerPasswordAuthenticationConverter())
                        .authenticationProvider(new OAuth2ResourceOwnerPasswordAuthenticationProvider(
                        authenticationManager,
                        oAuth2AuthorizationService,
                        tokenGenerator)));
//                        .accessTokenResponseHandler(new MyAuthenticationSuccessHandler())
//                        .errorResponseHandler(new MyAuthenticationFailureHandler()));

这里面我还添加了自定义处理认证成功和失败返回的json,但是不知道因为某种原因添加之后只有自定义成功的handler会被处理，失败的都不会被执行，后来发现需要在http.exceptionHandling中处理失败的情况

http
 .exceptionHandling((exceptions) -> exceptions
 .defaultAuthenticationEntryPointFor(customAuthenticationEntryPoint,
                             new MediaTypeRequestMatcher(MediaType.APPLICATION_JSON) ) )

以下是自定义成功失败返回结果的类的编写

CustomAuthenticationEntryPoint

@Component
public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        // 设置响应类型为 JSON
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        response.setCharacterEncoding("UTF-8"); // 设置编码为 UTF-8
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);  // 401 状态码
        // 自定义错误消息，可以根据异常类型或内容设置不同的错误消息
        String errorMessage = "Authentication failed: " + authException.getMessage();
        // 创建 JSON 格式的错误消息
        String jsonResponse = String.format("{"error":"%s", "message":"%s"}", "Unauthorized", errorMessage);
        // 写入响应内容
        PrintWriter out = response.getWriter();
        out.write(jsonResponse);
        out.flush();
    }
}

MyAuthenticationSuccessHandler

/**
 * 认证成功处理器
 */
public class MyAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    /**
     * MappingJackson2HttpMessageConverter 是 Spring 框架提供的一个 HTTP 消息转换器，用于将 HTTP 请求和响应的 JSON 数据与 Java 对象之间进行转换
     */
    private final HttpMessageConverter