Take RemoteTokenServices as an example - analyze the entire process of obtaining OAuth2 access tokens from the authorization server and loading authentication objects into the SecurityContext from the source code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

public interface ResourceServerTokenServices {

    /**
     * Load the credentials for the specified access token.
     *
     * @param accessToken The access token value.
     * @return The authentication for the access token.
     * @throws AuthenticationException If the access token is expired
     * @throws InvalidTokenException if the token isn't valid
     */
    OAuth2Authentication loadAuthentication(String accessToken) throws AuthenticationException, InvalidTokenException;

    /**
     * Retrieve the full access token details from just the value.
     * 
     * @param accessToken the token value
     * @return the full access token with client id etc.
     */
    OAuth2AccessToken readAccessToken(String accessToken);

}

1

resources.tokenServices(xxx);

1
2
3
4

remoteTokenServices.setClientId(resourceServerProperties.getClientId());
remoteTokenServices.setClientSecret(resourceServerProperties.getClientSecret());
// 设置/oauth/check_token端点
remoteTokenServices.setCheckTokenEndpointUrl(resourceServerProperties.getTokenInfoUri());

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# oauth2配置
security:
  oauth2:
    client:
      # 客户端ID
      client-id: ${OAUTH2_CLIENT_ID:lzhpo}
      # 客户端秘钥（加密前）
      client-secret: ${OAUTH2_CLIENT_SECRET:lzhpo1024}
      # 授权类型
      grant-type: ${OAUTH2_GRANT_TYPE:authorization_code,password,refresh_token,implicit,client_credentials}
      # 权限范围
      scope: ${OAUTH2_SCOPE:all}
      # 用于密码模式，获取访问令牌的地址（org.springframework.security.oauth2.provider.endpoint.TokenEndpoint）
      access-token-uri: ${OAUTH2_ACCESS_TOKEN_URI:http://localhost:9999/api/auth/oauth/token}
      # 用于授权码模式，获取授权码的地址（org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint）
      user-authorization-uri: ${OAUTH2_USER_AUTHORIZATION_URI:http://localhost:9999/api/auth/oauth/authorize}
    resource:
      # 资源服务器编号
      id: ${spring.application.name}
      # 校验访问令牌是否有效的地址（org.springframework.security.oauth2.provider.endpoint.CheckTokenEndpoint.checkToken）
      token-info-uri: ${OAUTH2_TOKEN_INFO_URI:http://localhost:9999/api/auth/oauth/check_token}
      # 获取用户信息
      user-info-uri: ${OAUTH2_USER_INFO_URI:http://localhost:9999/api/auth/oauth/check_user}
      # 默认使用token-info-uri，可以设置为false以使用user-info-uri
      prefer-token-info: true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

 /**
   * Authorization server security
   *
   * <p>isAuthenticated()、permitAll() <br>
   * If the endpoint /oauth/check_token is Authenticated, header Authorization is required. <br>
   * e.g: {@code Authorization:Basic bHpocG86bHpocG8xMDI0}
   *
   * <pre>
   * Reference：{@link AuthorizationServerProperties}
   *
   * Also can configure in application.properties or application.yml:
   * {@code
   *  security.oauth2.authorization.token-key-access: isAuthenticated()
   *  security.oauth2.authorization.check-token-access: isAuthenticated()
   * }
   * </pre>
   *
   * @param security security
   */
  @Override
  public void configure(AuthorizationServerSecurityConfigurer security) {
    security
        // Allow the client to send a form for permission authentication to obtain a token
        .allowFormAuthenticationForClients()
        // Endpoint: /oauth/token_key
        // If you use jwt, the public key that can be obtained is used for token verification
        .tokenKeyAccess("isAuthenticated()")
        // Endpoint: /oauth/check_token
        .checkTokenAccess("isAuthenticated()");
  }

1

Authorization:Basic bHpocG86bHpocG8xMDI0

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

    private ResourceServerTokenServices tokenServices(HttpSecurity http) {
        if (resourceTokenServices != null) {
            return resourceTokenServices;
        }
        DefaultTokenServices tokenServices = new DefaultTokenServices();
        tokenServices.setTokenStore(tokenStore());
        tokenServices.setSupportRefreshToken(true);
        tokenServices.setClientDetailsService(clientDetails());
        this.resourceTokenServices = tokenServices;
        return tokenServices;
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException, IOException, ServletException {

        OAuth2AccessToken accessToken;
        try {
            accessToken = restTemplate.getAccessToken();
        } catch (OAuth2Exception e) {
            BadCredentialsException bad = new BadCredentialsException("Could not obtain access token", e);
            publish(new OAuth2AuthenticationFailureEvent(bad));
            throw bad;            
        }
        try {
            // 这里就是前面`RemoteTokenServices`请求`/oauth/check_token`接口，拿到校验结果的
            OAuth2Authentication result = tokenServices.loadAuthentication(accessToken.getValue());
            if (authenticationDetailsSource!=null) {
                request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_VALUE, accessToken.getValue());
                request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_TYPE, accessToken.getTokenType());
                result.setDetails(authenticationDetailsSource.buildDetails(request));
            }
            publish(new AuthenticationSuccessEvent(result));
            return result;
        }
        catch (InvalidTokenException e) {
            BadCredentialsException bad = new BadCredentialsException("Could not obtain user details from token", e);
            publish(new OAuth2AuthenticationFailureEvent(bad));
            throw bad;            
        }

    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
    }

    private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        if (!requiresAuthentication(request, response)) {
            chain.doFilter(request, response);
            return;
        }
        try {
            // 交给子类实现的尝试进行认证的抽象方法，就上面我说的OAuth2ClientAuthenticationProcessingFilter过滤器的attemptAuthentication
            Authentication authenticationResult = attemptAuthentication(request, response);
            if (authenticationResult == null) {
                // return immediately as subclass has indicated that it hasn't completed
                return;
            }
            this.sessionStrategy.onAuthentication(authenticationResult, request, response);
            // Authentication success
            if (this.continueChainBeforeSuccessfulAuthentication) {
                chain.doFilter(request, response);
            }
            // 身份认证成功
            successfulAuthentication(request, response, chain, authenticationResult);
        }
        catch (InternalAuthenticationServiceException failed) {
            this.logger.error("An internal error occurred while trying to authenticate the user.", failed);
            unsuccessfulAuthentication(request, response, failed);
        }
        catch (AuthenticationException ex) {
            // Authentication failed
            unsuccessfulAuthentication(request, response, ex);
        }
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
            Authentication authResult) throws IOException, ServletException {
        // 装载身份验证信息
        SecurityContextHolder.getContext().setAuthentication(authResult);
        if (this.logger.isDebugEnabled()) {
            this.logger.debug(LogMessage.format("Set SecurityContextHolder to %s", authResult));
        }
        this.rememberMeServices.loginSuccess(request, response, authResult);
        if (this.eventPublisher != null) {
            this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
        }
        this.successHandler.onAuthenticationSuccess(request, response, authResult);
    }