<dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-security</artifactId>
            <version>2.2.5.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-oauth2</artifactId>
            <version>2.2.5.RELEASE</version>
        </dependency>
    </dependencies>

@Configuration
@EnableAuthorizationServer
public class MyAuthorizationConfig extends AuthorizationServerConfigurerAdapter {
    /**
     * 客戶端存儲(chǔ)策略，這里使用內(nèi)存方式，后續(xù)可以存儲(chǔ)在數(shù)據(jù)庫(kù)
     */
    @Autowired
    private ClientDetailsService clientDetailsService;
    /**
     * Security的認(rèn)證管理器，密碼模式需要用到
     */
    @Autowired
    private AuthenticationManager authenticationManager;
    /**
     * 配置令牌訪問(wèn)的安全約束
     */
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security
                //開(kāi)啟/oauth/token_key驗(yàn)證端口權(quán)限訪問(wèn)
                .tokenKeyAccess("permitAll()")
                //開(kāi)啟/oauth/check_token驗(yàn)證端口認(rèn)證權(quán)限訪問(wèn)
                .checkTokenAccess("permitAll()")
                //表示支持 client_id 和 client_secret 做登錄認(rèn)證
                .allowFormAuthenticationForClients();
    }
    //配置客戶端
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        //內(nèi)存模式
        clients.inMemory()
                //客戶端id
                .withClient("test")
                //客戶端秘鑰
                .secret(new BCryptPasswordEncoder().encode("123456"))
                //資源id，唯一，比如訂單服務(wù)作為一個(gè)資源,可以設(shè)置多個(gè)
                .resourceIds("order")
                //授權(quán)模式，總共四種，1. authorization_code（授權(quán)碼模式）、password（密碼模式）、client_credentials（客戶端模式）、implicit（簡(jiǎn)化模式）
                //refresh_token并不是授權(quán)模式，
                .authorizedGrantTypes("authorization_code","password","client_credentials","implicit","refresh_token")
                //允許的授權(quán)范圍，客戶端的權(quán)限，這里的all只是一種標(biāo)識(shí)，可以自定義，為了后續(xù)的資源服務(wù)進(jìn)行權(quán)限控制
                .scopes("all")
                //false 則跳轉(zhuǎn)到授權(quán)頁(yè)面
                .autoApprove(false)
                //授權(quán)碼模式的回調(diào)地址
                .redirectUris("http://www.baidu.com"); //可以and繼續(xù)添加客戶端
    }
    /**
     * 令牌存儲(chǔ)策略
     */
    @Bean
    public TokenStore tokenStore(){
        return new InMemoryTokenStore();
    }
    @Bean
    public AuthorizationServerTokenServices tokenServices() {
        DefaultTokenServices services = new DefaultTokenServices();
        //客戶端端配置策略
        services.setClientDetailsService(clientDetailsService);
        //支持令牌的刷新
        services.setSupportRefreshToken(true);
        //令牌服務(wù)
        services.setTokenStore(tokenStore());
        //access_token的過(guò)期時(shí)間
        services.setAccessTokenValiditySeconds(60 * 60 * 2);
        //refresh_token的過(guò)期時(shí)間
        services.setRefreshTokenValiditySeconds(60 * 60 * 24 * 3);
        return services;
    }
    /**
     * 授權(quán)碼模式的service，使用授權(quán)碼模式authorization_code必須注入
     */
    @Bean
    public AuthorizationCodeServices authorizationCodeServices() {
        //授權(quán)碼存在內(nèi)存中
        return new InMemoryAuthorizationCodeServices();
    }
    /**
     * 配置令牌訪問(wèn)的端點(diǎn)
     */
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
                //授權(quán)碼模式所需要的authorizationCodeServices
                .authorizationCodeServices(authorizationCodeServices())
                //密碼模式所需要的authenticationManager
                .authenticationManager(authenticationManager)
                //令牌管理服務(wù)，無(wú)論哪種模式都需要
                .tokenServices(tokenServices())
                //只允許POST提交訪問(wèn)令牌，uri：/oauth/token
                .allowedTokenEndpointRequestMethods(HttpMethod.POST);
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    /**
     * 加密算法
     */
    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //todo 允許表單登錄
        http.authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginProcessingUrl("/login")
                .permitAll()
                .and()
                .csrf()
                .disable();
    }
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //從內(nèi)存中加載用戶，實(shí)際生產(chǎn)中需要從數(shù)據(jù)庫(kù)中加載
        auth.inMemoryAuthentication()
                .withUser("admin")
                .password(new BCryptPasswordEncoder().encode("123456"))
                .roles("admin");//后面可以跟and連接
    }
    /**
     * AuthenticationManager對(duì)象在OAuth2認(rèn)證服務(wù)中要使用，提前放入IOC容器中
     * Oauth的密碼模式需要
     */
    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    /**
     * 配置令牌校驗(yàn)服務(wù)，客戶端攜帶令牌訪問(wèn)資源，作為資源端必須檢驗(yàn)令牌的真?zhèn)?
     * TODO 使用JWT作為TOKEN則不必遠(yuǎn)程調(diào)用check_token校驗(yàn)
     */
    @Bean
    public RemoteTokenServices tokenServices() {
        //遠(yuǎn)程調(diào)用授權(quán)服務(wù)的check_token進(jìn)行令牌的校驗(yàn)
        RemoteTokenServices services = new RemoteTokenServices();
        // /oauth/check_token 這個(gè)url是認(rèn)證中心校驗(yàn)的token的端點(diǎn)
        services.setCheckTokenEndpointUrl("http://localhost:8080/oauth/check_token");
        //客戶端的唯一id
        services.setClientId("test");
        //客戶端的秘鑰
        services.setClientSecret("123456");
        return services;
    }
    /**
     * 配置資源id和令牌校驗(yàn)服務(wù)
     */
    @Override
    public void configure(ResourceServerSecurityConfigurer resources)  {
        //配置唯一資源id
        resources.resourceId("order")
                //配置令牌校驗(yàn)服務(wù)
                .tokenServices(tokenServices());
    }
    /**
     * 配置security的安全機(jī)制
     */
    @Override
    public void configure(HttpSecurity http) throws Exception {
        //#oauth2.hasScope()校驗(yàn)客戶端的權(quán)限，這個(gè)all是在客戶端中的scope
        http.authorizeRequests()
                .antMatchers("/**").access("#oauth2.hasScope('all')")
                .anyRequest().authenticated();
    }
}

@RestController
public class TestController {
    @GetMapping("/test")
    public String hello() {
        return "hello world";
    }
}