Spring Security中配置SSO

在Spring Security中配置单点登录（SSO）可以实现用户在多个应用之间共享登录状态。下面是一个简单的示例配置：

1. 添加依赖：
在Maven项目中，将以下依赖添加到`pom.xml`文件中：

   <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-security</artifactId>
   </dependency>
   <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-oauth2-client</artifactId>
   </dependency>

2. 创建配置类：
创建一个配置类，例如 `SecurityConfig.java`，并添加以下内容：

   import org.springframework.beans.factory.annotation.Autowired;
   import org.springframework.context.annotation.Configuration;
   import org.springframework.security.config.annotation.web.builders.HttpSecurity;
   import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
   import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
   import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
   import org.springframework.security.oauth2.client.registration.ClientRegistration;
   import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
   import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
   import org.springframework.security.oauth2.core.oidc.user.OidcUser;
   
   @Configuration
   @EnableWebSecurity
   public class SecurityConfig extends WebSecurityConfigurerAdapter {
   
       @Autowired
       private OidcUserService oidcUserService;
   
       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http
               .authorizeRequests()
                   .anyRequest().authenticated()
                   .and()
               .oauth2Login()
                   .userInfoEndpoint()
                       .oidcUserService(oidcUserService);
       }
   
       @Bean
       public ClientRegistrationRepository clientRegistrationRepository() {
           return new InMemoryClientRegistrationRepository(
               clientRegistration()
           );
       }
   
       private ClientRegistration clientRegistration() {
           return ClientRegistration.withRegistrationId("your-registration-id")
               .clientId("your-client-id")
               .clientSecret("your-client-secret")
               .redirectUriTemplate("{baseUrl}/login/oauth2/code/{registrationId}")
               .authorizationUri("your-authorization-uri")
               .tokenUri("your-token-uri")
               .userInfoUri("your-user-info-uri")
               .userNameAttributeName("your-attribute-name")
               .clientName("your-client-name")
               .build();
       }
   }

在上述配置中，你需要替换以下属性的值：
- `your-registration-id`：客户端注册ID，用于标识此客户端。
- `your-client-id`：客户端ID，用于与认证服务器进行身份验证。
- `your-client-secret`：客户端密钥，用于与认证服务器进行身份验证。
- `your-authorization-uri`：认证服务器的授权URI。
- `your-token-uri`：认证服务器的令牌URI。
- `your-user-info-uri`：认证服务器的用户信息URI。
- `your-attribute-name`：用户属性名称，用来从用户信息中获取用户名。
- `your-client-name`：客户端名称。

3. 创建OidcUserService：
创建一个名为 `OidcUserService` 的类，并添加以下内容：

   import org.springframework.security.core.authority.AuthorityUtils;
   import org.springframework.security.oauth2.core.oidc.user.OidcUser;
   import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
   import org.springframework.security.oauth2.core.oidc.user.OidcUserRequest;
   import org.springframework.security.oauth2.core.oidc.user.OidcUserService;
   import org.springframework.stereotype.Service;
   
   @Service
   public class CustomOidcUserService extends OidcUserService {
   
       @Override
       public OidcUser loadUser(OidcUserRequest userRequest) throws OAuth2AuthenticationException {
           OidcUser oidcUser = super.loadUser(userRequest);
           Set<GrantedAuthority> authorities = new HashSet<>();
           authorities.addAll(oidcUser.getAuthorities());
           authorities.add(new OidcUserAuthority(userRequest.getIdToken(), userRequest.getUserInfo()));
           return new DefaultOidcUser(authorities, userRequest.getIdToken(), userRequest.getUserInfo());
       }
   }

这个自定义的 `OidcUserService` 类可以用来加载OIDC用户信息。

4. 配置应用程序属性：
在 `application.properties`（或 `application.yml`）文件中，添加以下属性：

   spring.security.oauth2.client.registration.your-registration-id.client-id=your-client-id
   spring.security.oauth2.client.registration.your-registration-id.client-secret=your-client-secret
   spring.security.oauth2.client.registration.your-registration-id.scope=openid,email,profile
   spring.security.oauth2.client.registration.your-registration-id.redirect-uri={baseUrl}/login/oauth2/code/{registrationId}
   spring.security.oauth2.client.provider.your-registration-id.authorization-uri=your-authorization-uri
   spring.security.oauth2.client.provider.your-registration-id.token-uri=your-token-uri
   spring.security.oauth2.client.provider.your-registration-id.user-info-uri=your-user-info-uri
   spring.security.oauth2.client.provider.your-registration-id.user-name-attribute=your-attribute-name

替换上述属性中的 `your-registration-id`、`your-client-id`、`your-client-secret`、`your-authorization-uri`、`your-token-uri`、`your-user-info-uri` 和 `your-attribute-name` 的值。

这样，你就完成了在Spring Security中配置SSO的过程。请注意，以上示例仅提供了基本的配置，你可能需要根据你的需求进行进一步的自定义。