核心模型/组件¶

RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
    .clientId("client-a")
    .clientSecret("{noop}secret") // {noop} 表示 Spring Security 中 NoOpPasswordEncoder 的 PasswordEncoder ID。
    .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
    .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
    .redirectUri("http://127.0.0.1:8080/authorized")
    .scope("scope-a")
    .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
    .build();

public class RegisteredClient implements Serializable {
    // id：唯一标识该 RegisteredClient 的 ID。
    private String id;
    // clientId：客户端标识符。  
    private String clientId;
    // clientIdIssuedAt：客户端标识符的签发时间。
    private Instant clientIdIssuedAt;
    // clientSecret：客户端密钥。该值应使用 Spring Security 的 PasswordEncoder 进行编码。
    private String clientSecret;
    // clientSecretExpiresAt：客户端密钥的过期时间。 
    private Instant clientSecretExpiresAt;
    // clientName：客户端的描述性名称。在某些场景下可能会被使用，例如在授权同意页面展示客户端名称时。  
    private String clientName;
    // clientAuthenticationMethods：客户端可使用的认证方式。
    // 支持的值包括：client_secret_basic、client_secret_post、private_key_jwt、client_secret_jwt，以及 none（公共客户端）。 
    private Set<ClientAuthenticationMethod> clientAuthenticationMethods;
    // authorizationGrantTypes：客户端可使用的授权类型。
    // 支持的值包括：authorization_code、client_credentials、refresh_token、urn:ietf:params:oauth:grant-type:device_code 和 urn:ietf:params:oauth:grant-type:token-exchange。
    private Set<AuthorizationGrantType> authorizationGrantTypes;
    // redirectUris：客户端在基于重定向的流程中可使用的已注册重定向 URI，例如 authorization_code 授权模式。  
    private Set<String> redirectUris;
    // postLogoutRedirectUris：客户端在登出后可使用的重定向 URI。 
    private Set<String> postLogoutRedirectUris;
    // scopes：客户端被允许申请的 scope 列表。
    private Set<String> scopes;
    // clientSettings：客户端的自定义配置项，例如是否要求 PKCE、是否要求授权同意等。
    private ClientSettings clientSettings;
    // tokenSettings：为该客户端签发的 OAuth2 令牌的自定义配置项，例如访问令牌/刷新令牌的存活时间、是否复用刷新令牌等。
    private TokenSettings tokenSettings;

    ...

}

@Bean
public RegisteredClientRepository registeredClientRepository() {
    List<RegisteredClient> registrations = ...
    return new InMemoryRegisteredClientRepository(registrations);
}

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
            OAuth2AuthorizationServerConfigurer.authorizationServer();

    http
        .securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
        .with(authorizationServerConfigurer, (authorizationServer) ->
            authorizationServer
                .registeredClientRepository(registeredClientRepository)
        )
        ...

    return http.build();
}

public class OAuth2Authorization implements Serializable {
    //id：唯一标识该 OAuth2Authorization 的 ID。 
    private String id;
    //registeredClientId：唯一标识 RegisteredClient 的 ID。 
    private String registeredClientId;
    //principalName：资源所有者（或客户端）的主体名称。  
    private String principalName;
    //authorizationGrantType：所使用的 AuthorizationGrantType。
    private AuthorizationGrantType authorizationGrantType;
    //authorizedScopes：为客户端授权的作用域（scope）集合。 
    private Set<String> authorizedScopes;
    //tokens：与已执行授权类型对应的 OAuth2Token 实例及其相关元数据。 
    private Map<Class<? extends OAuth2Token>, Token<?>> tokens;
    //attributes：与已执行授权类型相关的附加属性，例如已认证的 Principal、OAuth2AuthorizationRequest 等。
    private Map<String, Object> attributes;

    ...

}

@Bean
public OAuth2AuthorizationService authorizationService() {
    return new InMemoryOAuth2AuthorizationService();
}

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
            OAuth2AuthorizationServerConfigurer.authorizationServer();

    http
        .securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
        .with(authorizationServerConfigurer, (authorizationServer) ->
            authorizationServer
                .authorizationService(authorizationService)
        )
        ...

    return http.build();
}

public final class OAuth2AuthorizationConsent implements Serializable {
    // registeredClientId：唯一标识 RegisteredClient 的 ID。  
    private final String registeredClientId;    
    // principalName：资源所有者的主体名称（principal name）。
    private final String principalName; 
    // authorities：资源所有者授予客户端的权限集合。  
    // 每一项权限可以代表作用域（scope）、声明（claim）、许可（permission）、角色（role）等。
    private final Set<GrantedAuthority> authorities;    

    ...

}

@Bean
public OAuth2AuthorizationConsentService authorizationConsentService() {
    return new InMemoryOAuth2AuthorizationConsentService();
}

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
            OAuth2AuthorizationServerConfigurer.authorizationServer();

    http
        .securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
        .with(authorizationServerConfigurer, (authorizationServer) ->
            authorizationServer
                .authorizationConsentService(authorizationConsentService)
        )
        ...

    return http.build();
}

public interface OAuth2TokenContext extends Context {

    //getRegisteredClient()：与授权许可关联的 RegisteredClient 对象。
    default RegisteredClient getRegisteredClient() ...

    //getPrincipal()：资源所有者（或客户端）的 Authentication 实例。  
    default <T extends Authentication> T getPrincipal() ...

    //getAuthorizationServerContext()：保存授权服务器运行时环境信息的 AuthorizationServerContext 对象。
    default AuthorizationServerContext getAuthorizationServerContext() ...

    //getAuthorization()：与授权许可关联的 OAuth2Authorization 对象。  
    @Nullable
    default OAuth2Authorization getAuthorization() ...

    //getAuthorizedScopes()：为客户端授权的作用域（scope）集合。 
    default Set<String> getAuthorizedScopes() ...

    //getTokenType()：要生成的 OAuth2TokenType。支持的取值包括 code、access_token、refresh_token 和 id_token。
    default OAuth2TokenType getTokenType() ...

    //getAuthorizationGrantType()：与授权许可关联的 AuthorizationGrantType。  
    default AuthorizationGrantType getAuthorizationGrantType() ...

    //getAuthorizationGrant()：由处理该授权许可的 AuthenticationProvider 所使用的 Authentication 实例。
    default <T extends Authentication> T getAuthorizationGrant() ...

    ...

}

@Bean
public OAuth2TokenGenerator<?> tokenGenerator() {
    JwtEncoder jwtEncoder = ...
    JwtGenerator jwtGenerator = new JwtGenerator(jwtEncoder);
    OAuth2AccessTokenGenerator accessTokenGenerator = new OAuth2AccessTokenGenerator();
    OAuth2RefreshTokenGenerator refreshTokenGenerator = new OAuth2RefreshTokenGenerator();
    return new DelegatingOAuth2TokenGenerator(
            jwtGenerator, accessTokenGenerator, refreshTokenGenerator);
}

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
            OAuth2AuthorizationServerConfigurer.authorizationServer();

    http
        .securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
        .with(authorizationServerConfigurer, (authorizationServer) ->
            authorizationServer
                .tokenGenerator(tokenGenerator)
        )
        ...

    return http.build();
}

@Bean
public OAuth2TokenGenerator<?> tokenGenerator() {
    JwtEncoder jwtEncoder = ...
    JwtGenerator jwtGenerator = new JwtGenerator(jwtEncoder);
    OAuth2AccessTokenGenerator accessTokenGenerator = new OAuth2AccessTokenGenerator();
    accessTokenGenerator.setAccessTokenCustomizer(accessTokenCustomizer());
    OAuth2RefreshTokenGenerator refreshTokenGenerator = new OAuth2RefreshTokenGenerator();
    return new DelegatingOAuth2TokenGenerator(
            jwtGenerator, accessTokenGenerator, refreshTokenGenerator);
}

@Bean
public OAuth2TokenCustomizer<OAuth2TokenClaimsContext> accessTokenCustomizer() {
    return context -> {
        OAuth2TokenClaimsSet.Builder claims = context.getClaims();
        // Customize claims

    };
}

@Bean
public OAuth2TokenGenerator<?> tokenGenerator() {
    JwtEncoder jwtEncoder = ...
    JwtGenerator jwtGenerator = new JwtGenerator(jwtEncoder);
    jwtGenerator.setJwtCustomizer(jwtCustomizer());
    OAuth2AccessTokenGenerator accessTokenGenerator = new OAuth2AccessTokenGenerator();
    OAuth2RefreshTokenGenerator refreshTokenGenerator = new OAuth2RefreshTokenGenerator();
    return new DelegatingOAuth2TokenGenerator(
            jwtGenerator, accessTokenGenerator, refreshTokenGenerator);
}

@Bean
public OAuth2TokenCustomizer<JwtEncodingContext> jwtCustomizer() {
    return context -> {
        JwsHeader.Builder headers = context.getJwsHeader();
        JwtClaimsSet.Builder claims = context.getClaims();
        if (context.getTokenType().equals(OAuth2TokenType.ACCESS_TOKEN)) {
            // Customize headers/claims for access_token

        } else if (context.getTokenType().getValue().equals(OidcParameterNames.ID_TOKEN)) {
            // Customize headers/claims for id_token

        }
    };
}

@Bean
public SessionRegistry sessionRegistry() {
    return new SessionRegistryImpl();
}

@Bean
public HttpSessionEventPublisher httpSessionEventPublisher() {
    return new HttpSessionEventPublisher();
}