OAuth 2.0 客户端
OAuth 2.0 客户端功能为 OAuth 2.0 授权框架 中定义的客户端角色提供支持。
从高层次来看，可用的核心功能包括：
授权许可支持
客户端认证支持
HTTP 客户端支持（用于请求受保护的资源）
HttpSecurity.oauth2Client() DSL 提供了多种配置选项，用于自定义 OAuth 2.0 客户端所使用的核心组件。
此外，HttpSecurity.oauth2Client().authorizationCodeGrant() 允许对授权码许可（Authorization Code grant）进行自定义。
以下代码展示了 HttpSecurity.oauth2Client() DSL 提供的完整配置选项：
OAuth2 客户端配置选项
-
Java
-
Kotlin
@Configuration
@EnableWebSecurity
public class OAuth2ClientSecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Client((oauth2) -> oauth2
.clientRegistrationRepository(this.clientRegistrationRepository())
.authorizedClientRepository(this.authorizedClientRepository())
.authorizedClientService(this.authorizedClientService())
.authorizationCodeGrant((codeGrant) -> codeGrant
.authorizationRequestRepository(this.authorizationRequestRepository())
.authorizationRequestResolver(this.authorizationRequestResolver())
.accessTokenResponseClient(this.accessTokenResponseClient())
)
);
return http.build();
}
}@Configuration
@EnableWebSecurity
class OAuth2ClientSecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Client {
clientRegistrationRepository = clientRegistrationRepository()
authorizedClientRepository = authorizedClientRepository()
authorizedClientService = authorizedClientService()
authorizationCodeGrant {
authorizationRequestRepository = authorizationRequestRepository()
authorizationRequestResolver = authorizationRequestResolver()
accessTokenResponseClient = accessTokenResponseClient()
}
}
}
return http.build()
}
}除了 HttpSecurity.oauth2Client() DSL 之外，也支持 XML 配置。
以下代码展示了安全命名空间中可用的完整配置选项：
OAuth2 客户端 XML 配置选项
<http>
<oauth2-client client-registration-repository-ref="clientRegistrationRepository"
authorized-client-repository-ref="authorizedClientRepository"
authorized-client-service-ref="authorizedClientService">
<authorization-code-grant
authorization-request-repository-ref="authorizationRequestRepository"
authorization-request-resolver-ref="authorizationRequestResolver"
access-token-response-client-ref="accessTokenResponseClient"/>
</oauth2-client>
</http>OAuth2AuthorizedClientManager 负责管理 OAuth 2.0 客户端的授权（或重新授权），并与一个或多个 OAuth2AuthorizedClientProvider 协作完成此任务。
以下代码展示了如何注册一个 OAuth2AuthorizedClientManager @Bean，并将其与一个复合的 OAuth2AuthorizedClientProvider 关联，该复合提供者支持 authorization_code、refresh_token 和 client_credentials 授权许可类型：
-
Java
-
Kotlin
@Bean
public OAuth2AuthorizedClientManager authorizedClientManager(
ClientRegistrationRepository clientRegistrationRepository,
OAuth2AuthorizedClientRepository authorizedClientRepository) {
OAuth2AuthorizedClientProvider authorizedClientProvider =
OAuth2AuthorizedClientProviderBuilder.builder()
.authorizationCode()
.refreshToken()
.clientCredentials()
.build();
DefaultOAuth2AuthorizedClientManager authorizedClientManager =
new DefaultOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository);
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
return authorizedClientManager;
}@Bean
fun authorizedClientManager(
clientRegistrationRepository: ClientRegistrationRepository,
authorizedClientRepository: OAuth2AuthorizedClientRepository): OAuth2AuthorizedClientManager {
val authorizedClientProvider: OAuth2AuthorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
.authorizationCode()
.refreshToken()
.clientCredentials()
.build()
val authorizedClientManager = DefaultOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientRepository)
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
return authorizedClientManager
}