oltu是一个开源的oauth2.0协议的实现，本人在此开源项目的基础上进行修改，实现一个自定义的oauth2.0模块。
关于oltu的使用大家可以看这里：http://oltu.apache.org/
项目可以从这里下载：http://mirror.bit.edu.cn/apache/oltu/org.apache.oltu.oauth2/
项目中我将四种授权方式都做了实现（授权码模式、简化模式、密码模式及客户端模式），但是这里仅以授权码模式为例，服务端采用Jersey框架实现，而客户端采用spring mvc实现。
服务器端实现：为了方便开发，我将oltu的所有源码都拖进了项目中，而不是导入jar，因为很多地方可能在我所开发的项目中不适用，这样可以方便修改和跟踪代码。
其实服务端开发很简单，主要集中在两个比较主要的文件中，一个是请求授权的AuthzEndpoint.java，一个是生成令牌的TokenEndpoint.java，如图所示。
至于资源控制器由于我开发的项目中，资源访问控制是采用过滤器的方式，因此没有用到oltu提供的java类，两个主要类文件的代码修改如下：
AuthzEndpoint.java
/**
* Copyright 2010 Newcastle University
*
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.oltu.oauth2.integration.endpoints;
import java.net.URI;
import java.net.URISyntaxException;
import java.text.SimpleDateFormat;
import java.util.HashMap;
import java.util.Map;
import java.util.Properties;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.Response;
import org.apache.ibatis.session.SqlSession;
import org.apache.oltu.oauth2.as.issuer.MD5Generator;
import org.apache.oltu.oauth2.as.issuer.OAuthIssuerImpl;
import org.apache.oltu.oauth2.as.request.OAuthAuthzRequest;
import org.apache.oltu.oauth2.as.response.OAuthASResponse;
import org.apache.oltu.oauth2.common.OAuth;
import org.apache.oltu.oauth2.common.error.OAuthError;
import org.apache.oltu.oauth2.common.error.ServerErrorType;
import org.apache.oltu.oauth2.common.exception.OAuthProblemException;
import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
import org.apache.oltu.oauth2.common.message.OAuthResponse;
import org.apache.oltu.oauth2.common.message.types.ResponseType;
import org.apache.oltu.oauth2.integration.utils.Cache;
import org.apache.oltu.oauth2.integration.utils.CacheManager;
import com.cz.bean.App;
import com.cz.bean.Authority;
import com.cz.bean.RefreshToken;
import com.cz.dao.AppMapper;
import com.cz.dao.AuthorityMapper;
import com.cz.dao.RefreshTokenMapper;
import com.cz.util.DbUtil;
/**
*
* client request authorization
*
*/
@Path("/authz")
public class AuthzEndpoint {
SqlSession sqlSession = DbUtil.getSessionFactory().openSession(true);
AppMapper appDao = sqlSession.getMapper(AppMapper.class);
AuthorityMapper authorityDao = sqlSession.getMapper(AuthorityMapper.class);
RefreshTokenMapper refreshTokenDao = sqlSession
.getMapper(RefreshTokenMapper.class);
//登录页面
private static String loginPage;
//错误页面
private static String errorPage;
static {
Properties p = new Properties();
try {
p.load(AuthzEndpoint.class.getClassLoader().getResourceAsStream(
"config.properties"));
loginPage = p.getProperty("loginPage");
errorPage = p.getProperty("errorPage");
} catch (Exception e) {
e.printStackTrace();
}
}
public static final String INVALID_CLIENT_DESCRIPTION = "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).";
@GET
public Response authorize(@Context HttpServletRequest request)
throws URISyntaxException, OAuthSystemException {
OAuthAuthzRequest oauthRequest = null;
OAuthIssuerImpl oauthIssuerImpl = new OAuthIssuerImpl(
new MD5Generator());
try {
oauthRequest = new OAuthAuthzRequest(request);
/*
* 当前登录的用户，模拟一个从session中获取的登录用户
* 该方法未实现，待模块与养老平台整合时，应调用养老平台方法判断用户是否已登录
* 并获得对应用户的userId
*/
String userId = "1";
if ("".equals(userId) || userId == null) {
// 用户没有登录就跳转到登录页面
return Response.temporaryRedirect(new URI(loginPage)).build();
}
App app = null;
if(oauthRequest.getClientId()!=null && !"".equals(oauthRequest.getClientId())){
app = appDao.selectByPrimaryKey(oauthRequest.getClientId());
}else{
return Response.temporaryRedirect(new URI(errorPage+"?error="+ServerErrorType.CLIENT_ID_IS_NULL)).build();
}
// 根据response_type创建response
String responseType = oauthRequest
.getParam(OAuth.OAUTH_RESPONSE_TYPE);
OAuthASResponse.OAuthAuthorizationResponseBuilder builder = OAuthASResponse
.authorizationResponse(request,
HttpServletResponse.SC_FOUND);
// 检查传入的客户端id是否正确
if (app == null) {
return Response.temporaryRedirect(new URI(errorPage+"?error="+ServerErrorType.UNKOWN_CLIENT_ID)).build();
}
String scope = oauthRequest.getParam(OAuth.OAUTH_SCOPE);
// 授权请求类型
if (responseType.equals(ResponseType.CODE.toString())) {
String code = oauthIssuerImpl.authorizationCode();
builder.setCode(code);
CacheManager.putCache(userId+"_code", new Cache("code", code,
216000000, false));
CacheManager.putCache(userId+"_scope", new Cache("scope", scope,
216000000, false));
}
if (responseType.equals(ResponseType.TOKEN.toString())) {
// 校验client_secret
if (!app.getSecret_key().equals(oauthRequest.getClientSecret())) {
OAuthResponse response =
OAuthASResponse.errorResponse(HttpServletResponse.SC_OK)
.setError(OAuthError.TokenResponse.INVALID_CLIENT).setErrorDescription(INVALID_CLIENT_DESCRIPTION)
.buildJSONMessage();
return Response.status(response.getResponseStatus()).entity(response.getBody()).build();
}
String accessToken = oauthIssuerImpl.accessToken();
builder.setAccessToken(accessToken);
builder.setExpiresIn(3600l);
//判断是否已经授权----待调整是放在authz部分还是token部分
Map<String,Object> aQueryParam = new HashMap<>();
aQueryParam.put("appKey",oauthRequest.getClientId());
aQueryParam.put("userId",Integer.valueOf(userId));
if(authorityDao.findUnique(aQueryParam)==null){
Authority authority = new Authority();
authority.setApp_key(oauthRequest.getClientId());
authority.setUser_id(Integer.valueOf(userId));
authorityDao.insert(authority);
}
// 存储token,已授权则更新令牌，未授权则新增令牌
Map<String,Object> rQueryParam = new HashMap<>();
rQueryParam.put("appKey", oauthRequest.getClientId());
rQueryParam.put("userId", Integer.valueOf(userId));
if (refreshTokenDao.findUnique(rQueryParam) != null) {
Map<String,Object> map = new HashMap<>();
map.put("accessToken", accessToken);
map.put("appKey", oauthRequest.getClientId());
map.put("userId", Integer.valueOf(userId));
map.put("createTime", getDate());
map.put("scope", scope);
map.put("authorizationTime", getDate());
refreshTokenDao.updateAccessToken(map);
} else {
RefreshToken rt = new RefreshToken();
rt.setApp_key(oauthRequest.getClientId());
rt.setUser_id(Integer.valueOf(userId));
rt.setAccess_token(accessToken);
rt.setCreate_time(getDate());
rt.setAuthorization_time(getDate());
rt.setExpire("3600");
rt.setScope(scope);
rt.setAuthorization_time(getDate());
refreshTokenDao.insert(rt);
}
}
// 客户端跳转URI
String redirectURI = oauthRequest
.getParam(OAuth.OAUTH_REDIRECT_URI);
final OAuthResponse response = builder.location(redirectURI).setParam("scope", scope)
.buildQueryMessage();
String test = response.getLocationUri();
URI url = new URI(response.getLocationUri());
return Response.status(response.getResponseStatus()).location(url)
.build();
} catch (OAuthProblemException e) {
return Response.temporaryRedirect(new URI(errorPage+"?error="+ServerErrorType.BAD_RQUEST)).build();
}
}
private String getDate() {
SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
return sdf.format(System.currentTimeMillis());
}
}
|
上面的代码是授权码认证的第一步，当用户同意授权之后向服务器请求授权码。你可以使用一下腾讯的授权功能来加深一下体会，因为我所开发的模块也是参考腾讯的授权认证流程来实现的，客户端通过提交请求，访问类似http://192.168.19.75:10087/oauth/authz?client_id=s6BhdRkqt3&client_secret=12345&redirect_uri=http://localhost:8080/redirect.jsp&state=y&response_type=authorization_code的链接来访问上面的程序，参数的含义如下
client_id :客户端id
client_secret：客户端密钥
redirect_uri：回调地址，第三方应用定义的地址
State：状态，服务器将返回一个一模一样的参数。
response_type：授权方式，这里必须是authorization_code，表示授权码 方式。
这个过程结束时，服务器会跳转至第三方应用定义的回调地址并附上授权码，而第三方通过这个回调地址获得授权码并进行相应的处理，而这个过程在oltu的实现中其实就是几行简单的代码：
// 创建response wrapper
OAuthAuthzResponse oar = null;
oar = OAuthAuthzResponse.oauthCodeAuthzResponse(request);
// 获得授权码
String code = oar.getCode();
|
上面的代码就是oltu客户端接收服务器发回的授权码的代码，其中request是一个HttpServletRequest对象，获得了授权码之后，按照下一步的流程，自然就是向授权服务器请求令牌并附上上一步获得的授权码。服务器获得授权码并进行相应处理的代码如下：
TokenEndpoint.java
/**
* Copyright 2010 Newcastle University
*
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.oltu.oauth2.integration.endpoints;
import java.net.URI;
import java.net.URISyntaxException;
import java.text.SimpleDateFormat;
import java.util.HashMap;
import java.util.Map;
import java.util.Properties;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.ws.rs.Consumes;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.Response;
import org.apache.ibatis.session.SqlSession;
import org.apache.oltu.oauth2.as.issuer.MD5Generator;
import org.apache.oltu.oauth2.as.issuer.OAuthIssuer;
import org.apache.oltu.oauth2.as.issuer.OAuthIssuerImpl;
import org.apache.oltu.oauth2.as.request.OAuthTokenRequest;
import org.apache.oltu.oauth2.as.response.OAuthASResponse;
import org.apache.oltu.oauth2.common.OAuth;
import org.apache.oltu.oauth2.common.error.OAuthError;
import org.apache.oltu.oauth2.common.error.ServerErrorType;
import org.apache.oltu.oauth2.common.exception.OAuthProblemException;
import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
import org.apache.oltu.oauth2.common.message.OAuthResponse;
import org.apache.oltu.oauth2.common.message.types.GrantType;
import org.apache.oltu.oauth2.integration.utils.CacheManager;
import com.cz.bean.App;
import com.cz.bean.Authority;
import com.cz.bean.RefreshToken;
import com.cz.bean.User;
import com.cz.dao.AppMapper;
import com.cz.dao.AuthorityMapper;
import com.cz.dao.RefreshTokenMapper;
import com.cz.dao.UserMapper;
import com.cz.util.DbUtil;
/**
*
* get access token
*
*/
@Path("/token")
public class TokenEndpoint {
SqlSession sqlSession = DbUtil.getSessionFactory().openSession(true);
AppMapper appDao = sqlSession.getMapper(AppMapper.class);
RefreshTokenMapper refreshTokenDao = sqlSession
.getMapper(RefreshTokenMapper.class);
UserMapper dao = sqlSession.getMapper(UserMapper.class);
AuthorityMapper authorityDao = sqlSession.getMapper(AuthorityMapper.class);
// 登录页面
private static String loginPage;
// 错误页面
private static String errorPage;
static {
Properties p = new Properties();
try {
p.load(AuthzEndpoint.class.getClassLoader().getResourceAsStream(
"config.properties"));
loginPage = p.getProperty("loginPage");
errorPage = p.getProperty("errorPage");
} catch (Exception e) {
e.printStackTrace();
}
}
public static final String INVALID_CLIENT_DESCRIPTION = "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).";
@SuppressWarnings({ "unchecked", "rawtypes" })
@POST
@Consumes("application/x-www-form-urlencoded")
@Produces("application/json")
public Response authorize(@Context HttpServletRequest request)
throws OAuthSystemException, URISyntaxException {
OAuthTokenRequest oauthRequest = null;
String scope = "";
OAuthIssuer oauthIssuerImpl = new OAuthIssuerImpl(new MD5Generator());
try {
oauthRequest = new OAuthTokenRequest(request);
/*
* 当前登录的用户，模拟一个从session中获取的登录用户
* 该方法未实现，待模块与养老平台整合时，应调用养老平台方法判断用户是否已登录
*/
String userId = "1";
if ("".equals(userId) || userId == null) {
// 用户没有登录的话就跳转到登录页面
return Response.temporaryRedirect(new URI(loginPage)).build();
}
App app = null;
if (oauthRequest.getClientId() != null && !"".equals(oauthRequest.getClientId())) {
app = appDao.selectByPrimaryKey(oauthRequest.getClientId());
} else {
return Response.temporaryRedirect(new URI(errorPage + "?error=" + ServerErrorType.CLIENT_ID_IS_NULL)).build();
}
// 校验clientid
if (app == null || !app.getApp_key().toString().equals(oauthRequest.getClientId())) {
if(oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(GrantType.AUTHORIZATION_CODE.toString())){
return Response.temporaryRedirect(new URI(errorPage + "?error=" + ServerErrorType.UNKOWN_CLIENT_ID)).build();
}else{
OAuthResponse response =
OAuthASResponse.errorResponse(HttpServletResponse.SC_OK)
.setError(OAuthError.TokenResponse.INVALID_CLIENT).setErrorDescription(INVALID_CLIENT_DESCRIPTION)
.buildJSONMessage();
return Response.status(response.getResponseStatus()).entity(response.getBody()).build();
}
}
// 校验client_secret
if (!app.getSecret_key().equals(oauthRequest.getClientSecret())) {
if(oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(GrantType.AUTHORIZATION_CODE.toString())){
return Response.temporaryRedirect(new URI(errorPage + "?error=" + ServerErrorType.UNKOWN_CLIENT_SECRET)).build();
}else{
OAuthResponse response =
OAuthASResponse.errorResponse(HttpServletResponse.SC_OK)
.setError(OAuthError.TokenResponse.INVALID_CLIENT).setErrorDescription(INVALID_CLIENT_DESCRIPTION)
.buildJSONMessage();
return Response.status(response.getResponseStatus()).entity(response.getBody()).build();
}
}
// 校验不同类型的授权方式
if (oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(GrantType.AUTHORIZATION_CODE.toString())) {
String cacheCode = null;
if (CacheManager.getCacheInfo(userId + "_code").getValue() != null) {
cacheCode = CacheManager.getCacheInfo(userId + "_code")
.getValue().toString();
} else {
// 用户没有登录的话就跳转到登录页面
return Response.temporaryRedirect(new URI(loginPage)).build();
}
if (!cacheCode.equals(oauthRequest.getParam(OAuth.OAUTH_CODE))) {
return Response.temporaryRedirect(new URI(errorPage+ "?error=" + ServerErrorType.INVALID_AUTHORIZATION_CODE)).build();
}
if(CacheManager.getCacheInfo(userId+"_scope").getValue()!=null){
scope = CacheManager.getCacheInfo(userId+"_scope").getValue().toString();
}
} else if (oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(GrantType.PASSWORD.toString())) {
User user = dao.getById(userId);
if (!user.getPassword().equals(oauthRequest.getPassword())|| !user.getName().equals(oauthRequest.getUsername())) {
OAuthResponse response = OAuthASResponse
.errorResponse(HttpServletResponse.SC_OK)
.setError(OAuthError.TokenResponse.INVALID_CLIENT)
.setErrorDescription("Invalid username or password.")
.buildJSONMessage();
return Response.status(response.getResponseStatus()).entity(response.getBody()).build();
}
} else if (oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(
GrantType.CLIENT_CREDENTIALS.toString())) {
// 客户端id以及secret已验证，更多验证规则在这里添加，没有其他验证则程序直接发放令牌
// OAuthResponse response = OAuthASResponse
// .errorResponse(HttpServletResponse.SC_OK)
// .setError(OAuthError.TokenResponse.INVALID_GRANT)
// .setErrorDescription("invalid client")
// .buildJSONMessage();
// return Response.status(response.getResponseStatus()).entity(response.getBody()).build();
}else if (oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(
GrantType.REFRESH_TOKEN.toString())) {
// 刷新令牌未实现
}
String accessToken = oauthIssuerImpl.accessToken();
String refreshToken = oauthIssuerImpl.refreshToken();
// 构建响应
OAuthResponse response = OAuthASResponse
.tokenResponse(HttpServletResponse.SC_OK)
.setAccessToken(accessToken).setRefreshToken(refreshToken)
.setExpiresIn("3600")
.buildJSONMessage();
// 判断是否已经授权----待调整是放在authz部分还是token部分
Map aQueryParam = new HashMap();
aQueryParam.put("appKey", oauthRequest.getClientId());
aQueryParam.put("userId", Integer.valueOf(userId));
if (authorityDao.findUnique(aQueryParam) == null) {
Authority authority = new Authority();
authority.setApp_key(oauthRequest.getClientId());
authority.setUser_id(Integer.valueOf(userId));
authorityDao.insert(authority);
}
// String scope = "";
// if(CacheManager.getCacheInfo(userId+"_scope").getValue()!=null){
// scope = CacheManager.getCacheInfo(userId+"_scope").getValue().toString();
// }
// 存储token,已授权则更新令牌，未授权则新增令牌
Map rQueryParam = new HashMap();
rQueryParam.put("appKey", oauthRequest.getClientId());
rQueryParam.put("userId", Integer.valueOf(userId));
if (refreshTokenDao.findUnique(rQueryParam) != null) {
Map map = new HashMap();
map.put("accessToken", accessToken);
map.put("appKey", oauthRequest.getClientId());
map.put("userId", Integer.valueOf(userId));
map.put("createTime", getDate());
map.put("scope", scope);
map.put("authorizationTime", getDate());
refreshTokenDao.updateAccessToken(map);
} else {
RefreshToken rt = new RefreshToken();
rt.setApp_key(oauthRequest.getClientId());
rt.setUser_id(Integer.valueOf(userId));
rt.setAccess_token(accessToken);
rt.setRefresh_token(refreshToken);
rt.setCreate_time(getDate());
rt.setAuthorization_time(getDate());
rt.setExpire("3600");
rt.setScope(scope);
rt.setAuthorization_time(getDate());
refreshTokenDao.insert(rt);
}
return Response.status(response.getResponseStatus())
.entity(response.getBody()).build();
} catch (OAuthProblemException e) {
System.out.println(e.getDescription());
return Response.temporaryRedirect(new URI(errorPage + "?error="+ ServerErrorType.BAD_RQUEST)).build();
}
}
private String getDate() {
SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
return sdf.format(System.currentTimeMillis());
}
}
|
上面的代码，处理了客户端发来的申请令牌请求，并向客户端发放访问令牌，而oltu的客户端则通过如下代码来完成这个请求令牌和解析令牌的过程：
OAuthClient client = new OAuthClient(new URLConnectionClient());
OAuthAccessTokenResponse oauthResponse = null;
oauthResponse =
client.accessToken(request, OAuth.HttpMethod.POST);
String token = oauthResponse.getRefreshToken();
|
如果你是第一次开发，oauth2.0的认证过程可能会让你觉得头疼，因为你首先需要对这个流程很熟悉，并且同时要看懂了oltu的代码才好理解这个开源的项目到底是怎么实现这个过程的，因此这里我不过多的粘贴代码，因为这并没有什么卵用，还是运行项目和追踪代码比较容易理解它的原理，下面是我实现的项目代码，代码写得比较简陋，不过对于跟我一样的菜鸟，还是能起到一定的帮助的~
服务端：https://git.oschina.net/honganlei/oauth-server.git
服务端授权登录页面：https://git.oschina.net/honganlei/OauthClient.git
第三方接入授权模块的例子：https://git.oschina.net/honganlei/OauthApp.git