<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.example</groupId>
    <artifactId>app-kiba-security</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>app-kiba-security</name>
    <description>app-kiba-security</description>
    <properties>
        <java.version>1.8</java.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <spring-boot.version>2.4.2</spring-boot.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
    </dependencies>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.8.1</version>
                <configuration>
                    <source>1.8</source>
                    <target>1.8</target>
                    <encoding>UTF-8</encoding>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <version>${spring-boot.version}</version>
                <configuration>
                    <mainClass>com.kiba.appkibasecurity.AppKibaSecurityApplication</mainClass>
                    <skip>true</skip>
                </configuration>
                <executions>
                    <execution>
                        <id>repackage</id>
                        <goals>
                            <goal>repackage</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>

@Configuration
public class SecurityConfig   {
    /**
     * 注冊(cè)用戶，這里用戶是在內(nèi)存中的
     *  {noop}表示“無操作”（No Operation）密碼編碼。
     * @return
     */
    @Bean
    UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager users = new InMemoryUserDetailsManager();
        users.createUser(User.withUsername("kiba").password("{noop}123").roles("admin").build()); 
        return users;
    }
    /**
     * 讓hello可以不用登錄，就可以直接訪問，例如：http://127.0.0.1:8080/hello?name=kiba就可以直接訪問
     * @return
     */
    @Bean
    WebSecurityCustomizer webSecurityCustomizer() {
        return new WebSecurityCustomizer() {
            @Override
            public void customize(WebSecurity web) {
                web.ignoring().antMatchers("/hello");
            }
        };
    }
}

@Configuration
@AllArgsConstructor
public class SecurityAdapter extends WebSecurityConfigurerAdapter {
    /**
     * authenticated()：用戶需要通過用戶名/密碼登錄，記住我功能也可以（remember-me）。
     * fullyAuthenticated()用戶需要通過用戶名/密碼登錄，記住我功能不行。 
     */
    @Override
    @SneakyThrows
    protected void configure(HttpSecurity http) {
        http.httpBasic().and()
                //禁用跨站請(qǐng)求偽造（CSRF）保護(hù)。
                .csrf().disable()
                .authorizeRequests().anyRequest().fullyAuthenticated();
    } 
}

@Configuration
@AllArgsConstructor
public class SecurityAdapter extends WebSecurityConfigurerAdapter {
    /**
     * authenticated()：用戶需要通過用戶名/密碼登錄，記住我功能也可以（remember-me）。
     * fullyAuthenticated()用戶需要通過用戶名/密碼登錄，記住我功能不行。
     */
    @Override
    @SneakyThrows
    protected void configure(HttpSecurity http) {
        http.httpBasic().and()
                //禁用跨站請(qǐng)求偽造（CSRF）保護(hù)。
                .csrf().disable()
                .authorizeRequests().anyRequest().fullyAuthenticated();
    }
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("kiba518")
                .password(passwordEncoder().encode("123"))
                .authorities(new ArrayList<>(0));
    }
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

 <dependency>
            <groupId>org.springframework.security.oauth</groupId>
            <artifactId>spring-security-oauth2</artifactId>
            <version>2.4.0.RELEASE</version>
        </dependency>

@Configuration
@EnableAuthorizationServer //開啟授權(quán)服務(wù)
public class AuthorizationConfig extends AuthorizationServerConfigurerAdapter {
    @Autowired
    private PasswordEncoder passwordEncoder;
    @Autowired
    private AuthenticationManager authenticationManager;
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        //允許表單提交
        security.allowFormAuthenticationForClients()
                .checkTokenAccess("isAuthenticated()");
    }
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("client-kiba") //客戶端唯一標(biāo)識(shí)（client_id）
                .secret(passwordEncoder.encode("kiba518-123456")) //客戶端的密碼(client_secret)，這里的密碼應(yīng)該是加密后的
                .authorizedGrantTypes("password") //授權(quán)模式標(biāo)識(shí),共4種模式[授權(quán)碼（authorization-code）隱藏式（implicit） 密碼式（password）客戶端憑證（client credentials）]
                .scopes("read_scope"); //作用域
    }
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }
}

@Bean
    public AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }

  <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security.oauth</groupId>
            <artifactId>spring-security-oauth2</artifactId>
            <version>2.4.0.RELEASE</version>
        </dependency>

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    @Bean
    public RemoteTokenServices remoteTokenServices() {
        final RemoteTokenServices tokenServices = new RemoteTokenServices();
        tokenServices.setClientId("client-kiba");
        tokenServices.setClientSecret("kiba518-123456");
        tokenServices.setCheckTokenEndpointUrl("http://localhost:8080/oauth/check_token");//這個(gè)接口是oauth自帶的
        return tokenServices;
    }
    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.stateless(true);
    }
    @Override
    public void configure(HttpSecurity http) throws Exception {
        //session創(chuàng)建策略
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
        //所有請(qǐng)求需要認(rèn)證
        http.authorizeRequests().anyRequest().authenticated();
    }
}