{
  "sub": "dailymart",                # 用戶ID
  "aud": "oidc-client",                # ID Token的受眾，即Client_ID            
  "auth_time": 1722780563,          # 完成認(rèn)證的時(shí)間
  "iss": "http://127.0.0.1:9090",   # 發(fā)行人，即認(rèn)證服務(wù)器
  "exp": 1722782868,                # 到期時(shí)間
  "iat": 1722781068,                # 發(fā)布時(shí)間
    ...
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-authorization-server</artifactId>
</dependency>

<groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-authorization-server</artifactId>
    <version>1.3.1</version>
</dependency>

@Slf4j
@Configuration(proxyBeanMethods = false)
public class AuthorizationServerConfig {


    /**
     * Security過(guò)濾器鏈,用于協(xié)議端點(diǎn)
     */
    @Bean
    @Order(Ordered.HIGHEST_PRECEDENCE)
    public SecurityFilterChain authorizationServerSecurityFilterChain (HttpSecurity http) throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity (http);
        // 開(kāi)啟OIDC
        http.getConfigurer (OAuth2AuthorizationServerConfigurer.class)
                .oidc (Customizer.withDefaults ());


        http
            .exceptionHandling ((exceptions) -> exceptions
                    .defaultAuthenticationEntryPointFor (
                            new LoginUrlAuthenticationEntryPoint ("/login"),
                            new MediaTypeRequestMatcher (MediaType.TEXT_HTML)
                    )
            )
            //接受用戶信息和/或客戶端注冊(cè)的訪問(wèn)令牌
            .oauth2ResourceServer ((resourceServer) -> resourceServer
                    .jwt (Customizer.withDefaults ()));


        return http.build ();
    }


    /**
     * 配置密碼解析器，使用BCrypt的方式對(duì)密碼進(jìn)行加密和驗(yàn)證
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }






    /**
     * 管理客戶端
     * @param passwordEncoder 密碼管理器
     */
    @Bean
    public RegisteredClientRepository registeredClientRepository(PasswordEncoder passwordEncoder) {
        RegisteredClient oidcClient = RegisteredClient.withId(UUID.randomUUID().toString())
                .clientId("oidc-client")
                .clientSecret(passwordEncoder.encode("123456"))
                //客戶端認(rèn)證基于請(qǐng)求頭
                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
                .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
                .redirectUri("http://127.0.0.1:8080/login/oauth2/code/oidc-client") // 頁(yè)面地址需要跟這個(gè)保持一致
                .postLogoutRedirectUri("http://127.0.0.1:8080/")
                .scope(OidcScopes.OPENID)
                .scope(OidcScopes.PROFILE)
                .scope("user.info")
                .scope("all")
                // 客戶端設(shè)置，設(shè)置用戶需要確認(rèn)授權(quán)，設(shè)置false后不需要確認(rèn)
                .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
                //設(shè)置accessToken有效期
                .tokenSettings(TokenSettings.builder().accessTokenTimeToLive(Duration.ofHours(2)).build())
                .build();


        return new InMemoryRegisteredClientRepository(oidcClient);
    }




    /**
     * 用于簽署訪問(wèn)令牌
     */
    @Bean
    public JWKSource<SecurityContext> jwkSource() {
        KeyPair keyPair = generateRsaKey();
        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
        RSAKey rsaKey = new RSAKey.Builder(publicKey)
                .privateKey(privateKey)
                .keyID(UUID.randomUUID().toString())
                .build();
        JWKSet jwkSet = new JWKSet(rsaKey);
        return new ImmutableJWKSet<>(jwkSet);
    }


    /**
     * 創(chuàng)建RsaKey
     */
    private static KeyPair generateRsaKey() {
        KeyPair keyPair;
        try {
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
            keyPairGenerator.initialize(2048);
            keyPair = keyPairGenerator.generateKeyPair();
        }
        catch (Exception ex) {
            log.error ("generateRsaKey Exception", ex);
            throw new IllegalStateException(ex);
        }
        return keyPair;
    }




    /**
     * 解碼簽名訪問(wèn)令牌
     */
    @Bean
    public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
        return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
    }






    @Bean
    public AuthorizationServerSettings authorizationServerSettings() {
        return AuthorizationServerSettings.builder().build();
    }




}

@EnableWebSecurity 
@Configuration(proxyBeanMethods = false) 
public class DefaultSecurityConfig {


    /**
     * 用于認(rèn)證的Spring Security過(guò)濾器鏈。
     */
    @Bean
    public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http)
            throws Exception {
        http
                .authorizeHttpRequests((authorize) ->
                        authorize
                        .requestMatchers("/assets/**","/webjars/**","/actuator/**","/oauth2/**","/login").permitAll()
                        .anyRequest().authenticated()
                )
                .cors(Customizer.withDefaults())
                .csrf(AbstractHttpConfigurer::disable)
                .formLogin(Customizer.withDefaults());


        return http.build();
    }




    /**
     * 配置內(nèi)存用戶
     * @param passwordEncoder 密碼管理器
     */
    @Bean
    public UserDetailsService users(PasswordEncoder passwordEncoder) {


        UserDetails userDetails = User.withUsername("dailymart")
                .password(passwordEncoder.encode("123456"))
                .roles("USER")
                .build();


        return new InMemoryUserDetailsManager(userDetails);
    }




}

{
    "issuer": "http://127.0.0.1:9090",
    "authorization_endpoint": "http://127.0.0.1:9090/oauth2/authorize",
    "device_authorization_endpoint": "http://127.0.0.1:9090/oauth2/device_authorization",
    "token_endpoint": "http://127.0.0.1:9090/oauth2/token",
    "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt"],
    "jwks_uri": "http://127.0.0.1:9090/oauth2/jwks",
    "userinfo_endpoint": "http://127.0.0.1:9090/userinfo",
    "end_session_endpoint": "http://127.0.0.1:9090/connect/logout",
    "response_types_supported": ["code"],
    "grant_types_supported": ["authorization_code", "client_credentials", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
    "revocation_endpoint": "http://127.0.0.1:9090/oauth2/revoke",
    "revocation_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt"],
    "introspection_endpoint": "http://127.0.0.1:9090/oauth2/introspect",
    "introspection_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt"],
    "code_challenge_methods_supported": ["S256"],
    "subject_types_supported": ["public"],
    "id_token_signing_alg_values_supported": ["RS256"],
    "scopes_supported": ["openid"]
}