security+oauth2+jwt授权认证资源服务器配置代码

Security、OAuth 2.0 和 JWT（JSON Web Tokens）一起通常用于现代Web应用程序的安全访问控制。资源服务器（Resource Server）是API的主要部分，它处理用户请求并提供数据。以下是一个简单的Spring Boot应用中，使用Spring Security、OAuth 2.0和JWT进行授权认证的资源服务器配置示例：

// 引入依赖
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.security.oauth2.ResourceServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfiguration;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
import org.springframework.security.oauth2.provider.token.DefaultTokenServices;
import org.springframework.security.oauth2.provider.token.JwtAccessTokenConverter;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    // ...其他授权服务器设置...

}

@Configuration
public class ResourceServerConfig implements ResourceServerConfigurerAdapter {
    
    @Autowired
    private ResourceServerProperties resourceServerProperties;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId("resource-server");
    }

    @Bean
    public JwtAccessTokenConverter jwtTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey("your-secret-key"); // 替换为实际密钥
        return converter;
    }

    @Bean
    public DefaultTokenServices tokenServices() {
        DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setTokenStore(jwtTokenStore());
        defaultTokenServices.setSupportRefreshToken(true);
        defaultTokenServices.setAccessTokenValiditySeconds(3600); // 设置JWT的有效期为1小时
        return defaultTokenServices;
    }

    //...其他必要的JWT存储配置...

    @RestController
    public class AuthController {

        @GetMapping("/token")
        public ResponseEntity<String> getToken() {
            try {
                String jwt = tokenServices().createAccessToken(new OAuth2Authentication(NOT_USED, authenticationManager.authenticate(requestingUser()))).getValue();
                HttpHeaders headers = new HttpHeaders();
                headers.add(HttpHeaders.CONTENT_TYPE, "application/json");
                headers.add(HttpHeaders.AUTHORIZATION, "Bearer " + jwt);
                return new ResponseEntity<>(headers, HttpStatus.OK);
            } catch (Exception e) {
                return new ResponseEntity<>(e.getMessage(), HttpStatus.BAD_REQUEST);
            }
        }

        // ...处理刷新令牌的方法...
        
    }

    private OAuth2AuthenticationEntryPoint oauth2AuthenticationEntryPoint() {
        return new OAuth2AuthenticationEntryPoint();
    }

    // ...其他配置...
}

在这个例子中，`AuthorizationServerConfig`负责OAuth 2.0的授权服务器部分，而`ResourceServerConfig`则设置了资源服务器，包括JWT的生成和验证。注意，你需要替换`your-secret-key`为实际的加密密钥，并根据需求自定义错误处理和令牌有效期。