Merge pull request #12 from LookBackInTheRain/dev

dev

Author: LookBackInTheRain

README.md

@@ -18,7 +18,7 @@ spring-security ，spring-security-oauth2 ，string boot 学习
 boot:
   oauth:
     # token 存储方式，可选配置
-    token-store-type: jwt #默认为 memory， redis
+    token-store-type: jwt #默认为 memory
     # token签名秘钥，可选配置，默认：OAUTHBOOT@IUY09&098#UIOKNJJ-YUIT.CLUB
     token-signing-key: 123qwe 
     # 登录处理url 可选配置

UPDATE.md

@@ -1,3 +1,21 @@
+
+### 2019/3/8 更新
+1. 解决无法使用 `refresh_token` 更新`token`问题 
+2. `spring-boot` 升级并测试通过
+
+|框架/类库/数据库|   旧版本 | 新版本|
+|--|--|--|
+|java|11（Mac）/ 8（Win10）| - |
+| spring-boot | 2.0.5.RELEASE | 2.1.3.RELEASE |
+|spring-security|5.0.8.RELEASE | 5.0.8.RELEASE |
+|spring-security-oauth2-autoconfigure|2.0.6.RELEASE| 2.1.3.RELEASE |
+|mybatis-plus|3.0.4| 3.1.0 |
+|数据库连接池（druid）|1.1.11| 1.1.14 |
+|swagger-ui|2.9.2| - |
+|hibernate-validator|6.0.13.Final| - |
+|MySQL|5.7.22 MySQL Community Server| - |
+|Redis|4.0.10| - |
+
 ### 2019/2/15 更新 
 1. 配置token存储类型增加jdbc，已测试通过
  ```

pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>2.0.6.RELEASE</version>
+        <version>2.1.3.RELEASE</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
 
@@ -76,7 +76,7 @@
         <dependency>
             <groupId>org.springframework.security.oauth.boot</groupId>
             <artifactId>spring-security-oauth2-autoconfigure</artifactId>
-            <version>2.1.0.RELEASE</version>
+            <version>2.1.3.RELEASE</version>
         </dependency>
 
 
@@ -117,14 +117,20 @@
         <dependency>
             <groupId>com.baomidou</groupId>
             <artifactId>mybatis-plus-boot-starter</artifactId>
-            <version>3.0.4</version>
+            <version>3.1.0</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.baomidou</groupId>
+            <artifactId>mybatis-plus-generator</artifactId>
+            <version>3.1.0</version>
         </dependency>
 
 
         <dependency>
             <groupId>com.alibaba</groupId>
             <artifactId>druid</artifactId>
-            <version>1.1.11</version>
+            <version>1.1.14</version>
         </dependency>
 
         <!--swagger start-->

src/main/java/club/yuit/CodeGenerator.java

@@ -44,6 +44,7 @@ public static void main(String[] args) {
         // 代码生成器
         AutoGenerator mpg = new AutoGenerator();
 
+
         // 全局配置
         GlobalConfig gc = new GlobalConfig();
         String projectPath = System.getProperty("user.dir");

src/main/java/club/yuit/oauth/boot/config/DbConfig.java

@@ -15,7 +15,7 @@
 /**
  * @author yuit
  * @date time 2018/10/9  15:14
- *
+ * 数据库配置
  **/
 @Configuration
 @ConfigurationProperties(prefix = "spring.datasource")

src/main/java/club/yuit/oauth/boot/config/SecurityConfig.java

@@ -25,22 +25,21 @@
 @Order(1)
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
-    @Autowired
+
     private BootUserDetailService userDetailService;
 
-    @Autowired
-    private BootSecurityProperties properties;
 
-    @Autowired
-    private BootLoginFailureHandler handler;
+    private BootSecurityProperties properties;
 
-    @Autowired
-    private ClientDetailsService clientDetailsService;
 
-    @Autowired
-    BootOAuth2AuthExceptionEntryPoint authenticationEntryPoint;
+    private BootLoginFailureHandler handler;
 
 
+    public SecurityConfig(BootUserDetailService userDetailService, BootSecurityProperties properties, BootLoginFailureHandler handler) {
+        this.userDetailService = userDetailService;
+        this.properties = properties;
+        this.handler = handler;
+    }
 
     /**
      * 让Security 忽略这些url，不做拦截处理
@@ -86,11 +85,6 @@ protected void configure(HttpSecurity http) throws Exception {
                 .loginProcessingUrl(properties.getLoginProcessUrl());
 
         http.httpBasic().disable();
-
-
-
-
-
     }
 
 

src/main/java/club/yuit/oauth/boot/config/auth2/OAuth2AuthorizationServerConfig.java

@@ -1,33 +1,23 @@
 package club.yuit.oauth.boot.config.auth2;
 
 import club.yuit.oauth.boot.filter.BootBasicAuthenticationFilter;
-import club.yuit.oauth.boot.support.oauth2.BootAccessDeniedHandler;
 import club.yuit.oauth.boot.support.oauth2.BootClientDetailsService;
-import club.yuit.oauth.boot.support.oauth2.BootOAuth2AuthExceptionEntryPoint;
-import club.yuit.oauth.boot.support.oauth2.BootOAuth2WebResponseExceptionTranslator;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.boot.autoconfigure.security.SecurityProperties;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
 import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
 import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
 import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
 import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
-import org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter;
 import org.springframework.security.oauth2.provider.error.WebResponseExceptionTranslator;
 import org.springframework.security.oauth2.provider.token.TokenStore;
 import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
 import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;
 import org.springframework.security.web.AuthenticationEntryPoint;
 
-import javax.servlet.FilterChain;
-
 /**
  * @author yuit
  * @date  2018/10/15  14:52
@@ -36,28 +26,46 @@
 @EnableAuthorizationServer
 public class OAuth2AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
 
-    @Autowired
+
     private AuthenticationManager authenticationManager;
 
-    @Autowired
+
     private BootClientDetailsService clientDetailsService;
 
-    @Autowired
+
     private TokenStore tokenStore;
 
-    @Autowired(required = false)
+
     private JwtAccessTokenConverter converter;
 
-    @Autowired
+
     private AuthenticationEntryPoint authenticationEntryPoint;
 
 
-    @Autowired
+
     private WebResponseExceptionTranslator bootWebResponseExceptionTranslator;
 
-    @Autowired
+
     private BootBasicAuthenticationFilter filter;
 
+    private UserDetailsService userDetailsService;
+
+    @Autowired(required = false)
+    public OAuth2AuthorizationServerConfig(AuthenticationManager authenticationManager,
+                                           BootClientDetailsService clientDetailsService,
+                                           TokenStore tokenStore, JwtAccessTokenConverter converter,
+                                           AuthenticationEntryPoint authenticationEntryPoint,
+                                           WebResponseExceptionTranslator bootWebResponseExceptionTranslator,
+                                           BootBasicAuthenticationFilter filter, UserDetailsService userDetailsService) {
+        this.authenticationManager = authenticationManager;
+        this.clientDetailsService = clientDetailsService;
+        this.tokenStore = tokenStore;
+        this.converter = converter;
+        this.authenticationEntryPoint = authenticationEntryPoint;
+        this.bootWebResponseExceptionTranslator = bootWebResponseExceptionTranslator;
+        this.filter = filter;
+        this.userDetailsService = userDetailsService;
+    }
 
     public OAuth2AuthorizationServerConfig() {
         super();
@@ -70,10 +78,13 @@ public void configure(AuthorizationServerSecurityConfigurer security) throws Exc
         // 允许表单登录
         security.allowFormAuthenticationForClients();
 
+        // 加载client的service
         filter.setClientDetailsService(clientDetailsService);
 
+        // 自定义异常处理端口
         security.authenticationEntryPoint(authenticationEntryPoint);
 
+        // 认证之前的过滤器
         security.addTokenEndpointAuthenticationFilter(filter);
 
         security.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
@@ -82,22 +93,29 @@ public void configure(AuthorizationServerSecurityConfigurer security) throws Exc
 
     @Override
     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
+        // 配置加载客户端的service
         clients.withClientDetails(clientDetailsService);
     }
 
     @Override
     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
 
         endpoints
+                // token 存储方式
                 .tokenStore(tokenStore)
                 .authenticationManager(authenticationManager)
+                // 不配置会导致token无法刷新
+                .userDetailsService(userDetailsService)
                 .allowedTokenEndpointRequestMethods(HttpMethod.POST,HttpMethod.GET);
 
+        // 判断当前是否使用jwt
         if(!(tokenStore instanceof RedisTokenStore) && this.converter!=null){
             endpoints.accessTokenConverter(converter);
         }
 
 
+
+
         // 处理 ExceptionTranslationFilter 抛出的异常
         endpoints.exceptionTranslator(bootWebResponseExceptionTranslator);
 

src/main/java/club/yuit/oauth/boot/config/auth2/OAuth2ResourceServerConfig.java

@@ -14,6 +14,7 @@
 /**
  * @author yuit
  * @date  2018/10/15  14:57
+ * 资源服务配置
  **/
 @Configuration
 @EnableResourceServer

src/main/java/club/yuit/oauth/boot/config/auth2/TokenStoreConfig.java

@@ -21,6 +21,9 @@
 /**
  * @author yuit
  * @date  2018/10/17  16:38
+ *
+ * token 存储方式配置
+ *
  **/
 @Configuration
 public class TokenStoreConfig {

src/main/resources/application.yml

@@ -24,7 +24,7 @@ spring:
         max-wait: -1 # 连接池最大阻塞等待时间（负数代表没有限制）
         max-idle: 8 # 连接池最大空闲连接数
         min-idle: 0 # 连接池最小空闲连接数
-    timeout: 10000 # 链接超时时间 （ms）
+    timeout: 10000 # 链接超时时间 （ms）,连接时间小会导致连接超时
   # 模板引擎配置
   thymeleaf:
     prefix: classpath:/views/
@@ -34,7 +34,7 @@ spring:
     throw-exception-if-no-handler-found: true
 
 
-logging.level.org.springframework.security: DEBUG
+#logging.level.org.springframework.security: DEBUG
 
 
 mybatis-plus:
@@ -48,7 +48,7 @@ mybatis-plus:
       db-type: mysql  # 3.0 版本的必须配置 不然无法启动 nested exception is com.baomidou.mybatisplus.core.exceptions.MybatisPlusException: Error: GlobalConfigUtils setMetaData Fail !  Cause:java.lang.NullPointerException
 boot:
   oauth:
-    token-store-type: jdbc
+    token-store-type: jwt
     token-signing-key: 123123