# Spring Security 源码分析（四）：OAuth2 实现

@Configuration
public class ClientDetailsServiceConfiguration {

  @SuppressWarnings("rawtypes")
  private ClientDetailsServiceConfigurer configurer = new ClientDetailsServiceConfigurer(new ClientDetailsServiceBuilder());

  /**
   * 将第三方应用认证服务配置器注入 Spring 容器，使得认证服务可被干预
   */
  @Bean
  public ClientDetailsServiceConfigurer clientDetailsServiceConfigurer() {
    return configurer;
  }

  /**
   * 懒加载第三方应用认证服务，等待认证服务加载干预配置
   */
  @Bean
  @Lazy
  @Scope(proxyMode=ScopedProxyMode.INTERFACES)
  public ClientDetailsService clientDetailsService() throws Exception {
    return configurer.and().build();
  }

}

@Configuration
@Import(TokenKeyEndpointRegistrar.class)
public class AuthorizationServerEndpointsConfiguration {

  /**
   * 授权端点配置
   */
  private AuthorizationServerEndpointsConfigurer endpoints = new AuthorizationServerEndpointsConfigurer();

  /**
   * 第三方应用认证服务
   */
  @Autowired
  private ClientDetailsService clientDetailsService;

  /**
   * 自定义授权服务器配置
   */
  @Autowired
  private List<AuthorizationServerConfigurer> configurers = Collections.emptyList();

  @PostConstruct
  public void init() {
    for (AuthorizationServerConfigurer configurer : configurers) {
      try {
        // 将自定义配置应用到授权服务器
        configurer.configure(endpoints);
      } catch (Exception e) {
        throw new IllegalStateException("Cannot configure enpdoints", e);
      }
    }
    endpoints.setClientDetailsService(clientDetailsService);
  }

  /**
   * 配置 /oauth/authorize 接口
   */
  @Bean
  public AuthorizationEndpoint authorizationEndpoint() throws Exception {
    // 声明 /oauth/authorize GET 和 POST 请求
    AuthorizationEndpoint authorizationEndpoint = new AuthorizationEndpoint();

    // 获取自定义授权端点配置的 URL 映射
    FrameworkEndpointHandlerMapping mapping = getEndpointsConfigurer().getFrameworkEndpointHandlerMapping();
    // 默认授权确认页面为 /oauth/confirm_access，允许自定义
    authorizationEndpoint.setUserApprovalPage(extractPath(mapping, "/oauth/confirm_access"));
    authorizationEndpoint.setProviderExceptionHandler(exceptionTranslator());
    // 默认授权失败页面为 /oauth/error，允许自定义
    authorizationEndpoint.setErrorPage(extractPath(mapping, "/oauth/error"));
    // 配置访问令牌授权器，访问令牌默认存储在内存中，允许多种授权方式
    authorizationEndpoint.setTokenGranter(tokenGranter());
    authorizationEndpoint.setClientDetailsService(clientDetailsService);
    authorizationEndpoint.setAuthorizationCodeServices(authorizationCodeServices());
    authorizationEndpoint.setOAuth2RequestFactory(oauth2RequestFactory());
    authorizationEndpoint.setOAuth2RequestValidator(oauth2RequestValidator());
    // 授权确认策略，允许配置为自动确认和跳转确认等多种方式
    authorizationEndpoint.setUserApprovalHandler(userApprovalHandler());
    // 跳转处理器，验证允许跳转的授权方式，验证跳转路径是否注册
    authorizationEndpoint.setRedirectResolver(redirectResolver());
    return authorizationEndpoint;
  }

  /**
   * 配置 /oauth/token 接口
   */
  @Bean
  public TokenEndpoint tokenEndpoint() throws Exception {
    // 声明 /oauth/token GET 和 POST 请求
    TokenEndpoint tokenEndpoint = new TokenEndpoint();
    tokenEndpoint.setClientDetailsService(clientDetailsService);
    tokenEndpoint.setProviderExceptionHandler(exceptionTranslator());
    // 配置访问令牌授权器
    tokenEndpoint.setTokenGranter(tokenGranter());
    tokenEndpoint.setOAuth2RequestFactory(oauth2RequestFactory());
    tokenEndpoint.setOAuth2RequestValidator(oauth2RequestValidator());
    // 配置 /oauth/token 接口允许的请求方法，默认只允许 POST 方法
    tokenEndpoint.setAllowedRequestMethods(allowedTokenEndpointRequestMethods());
    return tokenEndpoint;
  }

  /**
   * 配置 /oauth/check_token 接口
   */
  @Bean
  public CheckTokenEndpoint checkTokenEndpoint() {
    // 校验 token 是否有效并返回相关信息
    CheckTokenEndpoint endpoint = new CheckTokenEndpoint(getEndpointsConfigurer().getResourceServerTokenServices());
    endpoint.setAccessTokenConverter(getEndpointsConfigurer().getAccessTokenConverter());
    endpoint.setExceptionTranslator(exceptionTranslator());
    return endpoint;
  }

  /**
   * 配置授权确认页面，可以自定义覆盖
   */
  @Bean
  public WhitelabelApprovalEndpoint whitelabelApprovalEndpoint() {
    return new WhitelabelApprovalEndpoint();
  }

  /**
   * 配置授权错误页面，可以自定义覆盖
   */
  @Bean
  public WhitelabelErrorEndpoint whitelabelErrorEndpoint() {
    return new WhitelabelErrorEndpoint();
  }
  // ...

}

  private List<Filter> getFilters(HttpServletRequest request) {
    // 根据请求路径匹配过滤器链
    for (SecurityFilterChain chain : filterChains) {
      if (chain.matches(request)) {
        return chain.getFilters();
      }
    }
    return null;
  }

@Configuration
// 优先级高
@Order(0)
@Import({ ClientDetailsServiceConfiguration.class, AuthorizationServerEndpointsConfiguration.class })
public class AuthorizationServerSecurityConfiguration extends WebSecurityConfigurerAdapter {

  /**
   * 自定义授权服务器配置
   */
  @Autowired
  private List<AuthorizationServerConfigurer> configurers = Collections.emptyList();

  /**
   * 第三方客户端认证配置
   */
  @Autowired
  private ClientDetailsService clientDetailsService;

  /**
   * 授权端点配置
   */
  @Autowired
  private AuthorizationServerEndpointsConfiguration endpoints;

  @Autowired
  public void configure(ClientDetailsServiceConfigurer clientDetails) throws Exception {
    for (AuthorizationServerConfigurer configurer : configurers) {
      // 干预第三方客户端认证配置
      configurer.configure(clientDetails);
    }
  }

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    // Over-riding to make sure this.disableLocalConfigureAuthenticationBldr = false
    // 默认使用 UserDetailsService 的实现类生成认证过滤器，而本套过滤器链是面向第三方应用认证而不是用户认证，所以不需要初始化 AuthenticationManager
  }

  /**
   * 过滤器配置
   */
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    // 授权服务器安全配置扩展
    AuthorizationServerSecurityConfigurer configurer = new AuthorizationServerSecurityConfigurer();
    // 自定义授权确认、授权失败页面路径映射
    FrameworkEndpointHandlerMapping handlerMapping = endpoints.oauth2EndpointHandlerMapping();
    http.setSharedObject(FrameworkEndpointHandlerMapping.class, handlerMapping);
    // 加载自定义授权服务器安全配置扩展
    configure(configurer);
    http.apply(configurer);

    String tokenEndpointPath = handlerMapping.getServletPath("/oauth/token");
    String tokenKeyPath = handlerMapping.getServletPath("/oauth/token_key");
    String checkTokenPath = handlerMapping.getServletPath("/oauth/check_token");
    if (!endpoints.getEndpointsConfigurer().isUserDetailsServiceOverride()) {
      // 从自定义配置和容器中取得配置的 AuthenticationManager，用于刷新 token
      UserDetailsService userDetailsService = http.getSharedObject(UserDetailsService.class);
      endpoints.getEndpointsConfigurer().userDetailsService(userDetailsService);
    }

    http
      .authorizeRequests()
      // 访问 /oauth/token 接口需要完全认证
      .antMatchers(tokenEndpointPath).fullyAuthenticated()
      // 配置访问 /oauth/token_key 和 /oauth/check_token 接口的权限
      .antMatchers(tokenKeyPath).access(configurer.getTokenKeyAccess())
      .antMatchers(checkTokenPath).access(configurer.getCheckTokenAccess())
      .and()
      .requestMatchers()
      .antMatchers(tokenEndpointPath, tokenKeyPath, checkTokenPath)
      .and()
      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);
    http.setSharedObject(ClientDetailsService.class, clientDetailsService);
  }

  protected void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
    for (AuthorizationServerConfigurer configurer : configurers) {
      // 应用自定义授权服务器安全配置扩展
      configurer.configure(oauthServer);
    }
  }
}

  /**
    * 第三方应用认证配置
    */
  @Override
  public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    // 根据配置初始化第三方认证信息，放入内存
    ClientDetailsServiceBuilder<InMemoryClientDetailsServiceBuilder>.ClientBuilder builder = clients
      .inMemory().withClient(this.details.getClientId());
    builder.secret(this.details.getClientSecret())
    // ...

    // 配置 token 有效时间，默认12小时
    if (this.details.getAccessTokenValiditySeconds() != null) {
      builder.accessTokenValiditySeconds(
        this.details.getAccessTokenValiditySeconds());
    }
    // 配置刷新令牌有效时间，默认30天
    if (this.details.getRefreshTokenValiditySeconds() != null) {
      builder.refreshTokenValiditySeconds(
        this.details.getRefreshTokenValiditySeconds());
    }
    // 配置运行跳转的 URL
    if (this.details.getRegisteredRedirectUri() != null) {
      builder.redirectUris(
        this.details.getRegisteredRedirectUri().toArray(new String[0]));
    }
  }

  /**
    * 授权端点自定义配置
    */
  @Override
  public void configure(AuthorizationServerEndpointsConfigurer endpoints)
    throws Exception {
    if (this.tokenConverter != null) {
      // 配置 /oauth/check_token 接口验证验证成功返回 token 信息逻辑
      endpoints.accessTokenConverter(this.tokenConverter);
    }
    if (this.tokenStore != null) {
      // 配置 token 存储策略，默认在内存中
      endpoints.tokenStore(this.tokenStore);
    }
    if (this.details.getAuthorizedGrantTypes().contains("password")) {
      // 配置用户认证管理器，用于密码模式中对用户身份进行认证
      endpoints.authenticationManager(this.authenticationManager);
    }
  }

  /**
    * 配置授权安全策略
    */
  @Override
  public void configure(AuthorizationServerSecurityConfigurer security)
    throws Exception {
    security.passwordEncoder(NoOpPasswordEncoder.getInstance());
    if (this.properties.getCheckTokenAccess() != null) {
      // 配置 /oauth/check_token 接口访问权限
      security.checkTokenAccess(this.properties.getCheckTokenAccess());
    }
    if (this.properties.getTokenKeyAccess() != null) {
      // 配置 /oauth/token_key 接口访问权限
      security.tokenKeyAccess(this.properties.getTokenKeyAccess());
    }
    if (this.properties.getRealm() != null) {
      // 配置 realm 名称，默认为 realm
      security.realm(this.properties.getRealm());
    }
  }

@Configuration
@EnableAuthorizationServer
public class OAuth2SecurityConfig extends WebSecurityConfigurerAdapter {
}

  @RequestMapping(value = "/oauth/authorize")
  public ModelAndView authorize(Map<String, Object> model, @RequestParam Map<String, String> parameters, SessionStatus sessionStatus, Principal principal) {
    // 提取请求参数，生成 AuthorizationRequest
    AuthorizationRequest authorizationRequest = getOAuth2RequestFactory().createAuthorizationRequest(parameters);
    // 授权类型
    Set<String> responseTypes = authorizationRequest.getResponseTypes();
    // ...

    try {
      // 验证用户是否已认证
      if (!(principal instanceof Authentication) || !((Authentication) principal).isAuthenticated()) {
        throw new InsufficientAuthenticationException("User must be authenticated with Spring Security before authorization can be completed.");
      }
      // 查询第三方应用信息
      ClientDetails client = getClientDetailsService().loadClientByClientId(authorizationRequest.getClientId());
      // ...
      // 配置回调地址
      authorizationRequest.setRedirectUri(resolvedRedirect);
      // 验证参数中的 scope 是否有效
      oauth2RequestValidator.validateScope(authorizationRequest, client);
      // 验证请求授权的 scope 是否默认确认授权。userApprovalHandler 可配置，默认为所有请求的 scope 自动确认授权方可直接授权
      authorizationRequest = userApprovalHandler.checkForPreApproval(authorizationRequest, (Authentication) principal);
      // ...

      if (authorizationRequest.isApproved()) {
        // 如果默认确认授权
        if (responseTypes.contains("token")) {
          // 隐式授权模式直接返回访问令牌
          return getImplicitGrantResponse(authorizationRequest);
        }
        if (responseTypes.contains("code")) {
          // 授权码模式直接返回授权码
          return new ModelAndView(getAuthorizationCodeResponse(authorizationRequest, (Authentication) principal));
        }
      }

      // 如果没有自动授权，跳转到 /oauth/confirm_access 进行确认授权
      model.put("authorizationRequest", authorizationRequest);
      return getUserApprovalPageResponse(model, authorizationRequest, (Authentication) principal);

    }
    // ...

  }

  @Override
  public void init(HttpSecurity http) throws Exception {
    // ...

    if (passwordEncoder != null) {
      // 有密码的配置
      // ...
    else {
      // 无密码的配置
      // 配置认证服务为第三方认证服务
      http.userDetailsService(new ClientDetailsUserDetailsService(clientDetailsService()));
    }
    // 配置不对 SecurityContext 进行存储和读取
    http.securityContext().securityContextRepository(new NullSecurityContextRepository()).and().csrf().disable()
      // 配置 http basic 认证
      .httpBasic().realmName(realm);
    // ...
  }

  // 从请求参数中读取账户密码
  String username = parameters.get("username");
  String password = parameters.get("password");
  // ...

  Authentication userAuth = new UsernamePasswordAuthenticationToken(username, password);
  // ...
  try {
    // 对用户信息进行认证
    userAuth = authenticationManager.authenticate(userAuth);
  }
  // ...

  private List<TokenGranter> getDefaultTokenGranters() {
    // ...

    if (authenticationManager != null) {
      // 传入用户认证管理器，密码模式有了校验用户身份的能力
      tokenGranters.add(new ResourceOwnerPasswordTokenGranter(authenticationManager, tokenServices, clientDetails, requestFactory));
    }
    return tokenGranters;
  }

  @Transactional(noRollbackFor={InvalidTokenException.class, InvalidGrantException.class})
  public OAuth2AccessToken refreshAccessToken(String refreshTokenValue, TokenRequest tokenRequest) throws AuthenticationException {
    // ...

    // 查询存储的 refresh_token
    OAuth2RefreshToken refreshToken = tokenStore.readRefreshToken(refreshTokenValue);
    // ..
    // 获取刷新令牌对应的用户认证信息
    OAuth2Authentication authentication = tokenStore.readAuthenticationForRefreshToken(refreshToken);
    if (this.authenticationManager != null && !authentication.isClientOnly()) {
      // 进行用户认证
      Authentication user = new PreAuthenticatedAuthenticationToken(authentication.getUserAuthentication(), "", authentication.getAuthorities());
      user = authenticationManager.authenticate(user);
      Object details = authentication.getDetails();
      authentication = new OAuth2Authentication(authentication.getOAuth2Request(), user);
      authentication.setDetails(details);
    }
    // ...

    if (isExpired(refreshToken)) {
      // 如果刷新令牌过期，授权失败
      tokenStore.removeRefreshToken(refreshToken);
      throw new InvalidTokenException("Invalid refresh token (expired): " + refreshToken);
    }
    // 重新创建用户认证信息
    authentication = createRefreshedAuthentication(authentication, tokenRequest);

    if (!reuseRefreshToken) {
      // 是否重用 refresh_token
      tokenStore.removeRefreshToken(refreshToken);
      refreshToken = createRefreshToken(authentication);
    }

    // 重新创建访问令牌
    OAuth2AccessToken accessToken = createAccessToken(authentication, refreshToken);
    tokenStore.storeAccessToken(accessToken, authentication);
    if (!reuseRefreshToken) {
      tokenStore.storeRefreshToken(accessToken.getRefreshToken(), authentication);
    }
    return accessToken;
  }

  protected void configure(HttpSecurity http) throws Exception {
    // 资源服务器保护配置
    ResourceServerSecurityConfigurer resources = new ResourceServerSecurityConfigurer();
    ResourceServerTokenServices services = resolveTokenServices();
    if (services != null) {
      resources.tokenServices(services);
    } else {
      if (tokenStore != null) {
        resources.tokenStore(tokenStore);
      } else if (endpoints != null) {
        // Spring 容器中有授权端点实例，说明资源服务器和授权服务器在同一实例中，则使用相同的 TokenStore
        resources.tokenStore(endpoints.getEndpointsConfigurer().getTokenStore());
      }
    }
    if (eventPublisher != null) {
      resources.eventPublisher(eventPublisher);
    }
    for (ResourceServerConfigurer configurer : configurers) {
      // 自定义资源保护配置
      configurer.configure(resources);
    }
    http.authenticationProvider(new AnonymousAuthenticationProvider("default"))
      .exceptionHandling()
      .accessDeniedHandler(resources.getAccessDeniedHandler()).and()
      .sessionManagement()
      .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
      .csrf().disable();
    http.apply(resources);
    if (endpoints != null) {
      // 授权端点中的路径排除在外，不受资源服务器保护
      http.requestMatcher(new NotOAuthRequestMatcher(endpoints.oauth2EndpointHandlerMapping()));
    }
    for (ResourceServerConfigurer configurer : configurers) {
      // 自定义过滤器配置
      configurer.configure(http);
    }
    if (configurers.isEmpty()) {
      // 默认在没有自定义配置的情况下访问所有路径都需要权限
      http.authorizeRequests().anyRequest().authenticated();
    }
  }

  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    // ...

    try {
      // 读取 Authorization 头，取出 Bearer 的值，即访问令牌
      Authentication authentication = tokenExtractor.extract(request);
      if (authentication == null) {
        // ...
      } else {
        // ...

        // 认证逻辑为验证 TokenStore 中的访问令牌
        Authentication authResult = authenticationManager.authenticate(authentication);
        // ...

        // 认证信息存入 SecurityContext
        SecurityContextHolder.getContext().setAuthentication(authResult);

      }
    }

    // ...

    chain.doFilter(request, response);
  }