Skip to content

Commit bda7352

Browse files
longqiulinglongqiuling
committed
oidc sample
1 parent 3e7f418 commit bda7352

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+2073
-2
lines changed

‎.gitignore

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
HELP.md
2+
target/
3+
!.mvn/wrapper/maven-wrapper.jar
4+
!**/src/main/**/target/
5+
!**/src/test/**/target/
6+
7+
### STS ###
8+
.apt_generated
9+
.classpath
10+
.factorypath
11+
.project
12+
.settings
13+
.springBeans
14+
.sts4-cache
15+
16+
### IntelliJ IDEA ###
17+
.idea
18+
*.iws
19+
*.iml
20+
*.ipr
21+
22+
### NetBeans ###
23+
/nbproject/private/
24+
/nbbuild/
25+
/dist/
26+
/nbdist/
27+
/.nb-gradle/
28+
build/
29+
!**/src/main/**/build/
30+
!**/src/test/**/build/
31+
32+
### VS Code ###
33+
.vscode/

‎README.md

+72-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,72 @@
1-
# java-spring-oidc-native-code-sample
2-
Alibaba Cloud IDaaS Product Spring OIDC Native Framework Sample.
1+
# 快速开始
2+
# 授权码流
3+
## 第一步：注册应用
4+
![img.png](src/main/resources/static/img/img.png)
5+
![img_1.png](src/main/resources/static/img/img_1.png)
6+
![img_2.png](src/main/resources/static/img/img_2.png)
7+
## 第二步：修改配置
8+
修改application.yaml文件中的 idp 配置
9+
```yaml
10+
idaas:
11+
oidc:
12+
clientId: # IDaaS应用中拿到的 client_id
13+
clientSecret: # IDaaS应用中拿到的 client_secret
14+
issuer: # IDaaS应用中拿到的Issuer
15+
scopes: # IDaaS应用中配置的scopes
16+
redirectUri: ${baseUri}/authentication/login #登录 Redirect URI
17+
```
18+
application.yaml中的配置项分别对应IDaaS应用中的配置
19+
![img_3.png](src/main/resources/static/img/img_3.png)
20+
![img_6.png](src/main/resources/static/img/img_6.png)
21+
![img_5.png](src/main/resources/static/img/img_5.png)
22+
其中，redirectUri在当前项目中指向了/authentication/login
23+
## 第三步：在 IDaaS 中添加重定向地址redirect-uri
24+
- 因为要最终需要到LoginController接口中拿到access token令牌，故重定向地址为LoginController内的login方法所指向的uri，将其填写到IDaaS中。
25+
- {baseUri}/authentication/login
26+
27+
## 第四步：添加授权
28+
### 添加授权
29+
![img_7.png](src/main/resources/static/img/img_7.png)
30+
### 第五步：访问
31+
有两种方式可以登录访问，可以由SP发起登录，也可以由IdP发起登录，下面依次进行介绍。
32+
### （一）由SP(java-spring-oidc-native-code-sample)发起的登录
33+
整个授权码流程如下：
34+
![img_8.png](src/main/resources/static/img/img_8.png)
35+
1. 访问应用端点: http://127.0.0.1:8082,来到SP首页位置
36+
2. 点击想要的Tab页，如用户信息，此时会跳转到登录认证页面
37+
![img_9.png](src/main/resources/static/img/img_9.png)
38+
填写注册应用中所授权的用户账密
39+
4. 登录认证成功后会跳转回redirect-uri,即 http://127.0.0.1:8082/authentication/login, 并显示一下信息
40+
- 授权码
41+
- 令牌信息（access token id token、refresh token）
42+
- 用户信息
43+
### （二）由IdP(IDaaS)发起的登录
44+
需要在IDaaS应用中的高级配置中填写initLoginUri,不填写将直接跳转到redirectUri
45+
![img_10.png](src/main/resources/static/img/img_10.png)
46+
整个授权码流程如下：
47+
![img_11.png](src/main/resources/static/img/img_11.png)
48+
1. 登录注册应用所授权的IDaaS用户的应用门户，登录认证页面如下所示。
49+
![img_9.png](src/main/resources/static/img/img_9.png)
50+
3. 登录成功后，将会在页面中显示注册的应用，点击该应用
51+
![img_12.png](src/main/resources/static/img/img_12.png)
52+
4. 登录认证成功后会跳转回redirect-uri,即 http://127.0.0.1:8082/authentication/login, 并显示一下信息
53+
- 授权码
54+
- 令牌信息（access token id token、refresh token）
55+
- 用户信息端点信息
56+
57+
# PKCE + 授权码流
58+
与授权码流不同点如下：
59+
1. 注册应用时指定PKCE模式
60+
![img_13.png](src/main/resources/static/img/img_13.png)
61+
2.修改application.yaml配置,添加如下两个参数。值与注册应用时配置的保持一致
62+
```yaml
63+
idaas:
64+
oidc:
65+
openPkce: true #打开PKCE
66+
codeChallengeMethod: S256 #加密算法
67+
```
68+
## 访问
69+
### 可以通过SP发起登录，也可以通过IdP发起登录
70+
PKCE可以防止攻击者窃取code，从而通过code去拿到令牌。主要流程如下：
71+
![img_14.png](src/main/resources/static/img/img_14.png)
72+
SP登录与IdP发起的登录可参考授权码流。

‎pom.xml

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<parent>
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-starter-parent</artifactId>
8+
<version>2.7.0</version>
9+
<relativePath/> <!-- lookup parent from repository -->
10+
</parent>
11+
<groupId>com.aliyunidaas.sample</groupId>
12+
<artifactId>custom-oidc</artifactId>
13+
<version>0.0.1-SNAPSHOT</version>
14+
<name>custom-oidc</name>
15+
<description>custom-oidc</description>
16+
<properties>
17+
<java.version>1.8</java.version>
18+
</properties>
19+
<dependencies>
20+
<dependency>
21+
<groupId>org.springframework.boot</groupId>
22+
<artifactId>spring-boot-starter-web</artifactId>
23+
</dependency>
24+
<dependency>
25+
<groupId>com.alibaba</groupId>
26+
<artifactId>fastjson</artifactId>
27+
<version>1.2.75_noneautotype</version>
28+
</dependency>
29+
<dependency>
30+
<groupId>org.springframework.boot</groupId>
31+
<artifactId>spring-boot-starter-test</artifactId>
32+
<scope>test</scope>
33+
</dependency>
34+
<!--前端依赖-->
35+
<dependency>
36+
<groupId>org.springframework.boot</groupId>
37+
<artifactId>spring-boot-starter-thymeleaf</artifactId>
38+
</dependency>
39+
<!--通信-->
40+
<dependency>
41+
<groupId>org.apache.httpcomponents</groupId>
42+
<artifactId>httpclient</artifactId>
43+
<version>4.5.13</version>
44+
</dependency>
45+
46+
<dependency>
47+
<groupId>commons-lang</groupId>
48+
<artifactId>commons-lang</artifactId>
49+
<version>2.6</version>
50+
</dependency>
51+
52+
<dependency>
53+
<groupId>org.slf4j</groupId>
54+
<artifactId>slf4j-api</artifactId>
55+
<version>1.7.36</version>
56+
</dependency>
57+
<dependency>
58+
<groupId>com.google.guava</groupId>
59+
<artifactId>guava</artifactId>
60+
<version>20.0</version>
61+
</dependency>
62+
<dependency>
63+
<groupId>org.springframework.boot</groupId>
64+
<artifactId>spring-boot-configuration-processor</artifactId>
65+
<optional>true</optional>
66+
</dependency>
67+
<dependency>
68+
<groupId>org.bitbucket.b_c</groupId>
69+
<artifactId>jose4j</artifactId>
70+
<version>0.7.9</version>
71+
</dependency>
72+
</dependencies>
73+
74+
<build>
75+
<plugins>
76+
<plugin>
77+
<groupId>org.springframework.boot</groupId>
78+
<artifactId>spring-boot-maven-plugin</artifactId>
79+
<version>2.7.0</version>
80+
</plugin>
81+
</plugins>
82+
</build>
83+
84+
</project>

‎src/main/java/com/aliyunidaas/sample/Application.java

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package com.aliyunidaas.sample;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
/**
7+
* Copyright (c) Alibaba Cloud Computing
8+
* Description:
9+
*
10+
* @date: 2022/6/27 11:26 AM
11+
* @author: longqiuling
12+
**/
13+
@SpringBootApplication
14+
public class Application {
15+
16+
public static void main(String[] args) {
17+
SpringApplication.run(Application.class, args);
18+
}
19+
20+
}

‎src/main/java/com/aliyunidaas/sample/common/EndpointContext.java

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
package com.aliyunidaas.sample.common;
2+
3+
/**
4+
* Copyright (c) Alibaba Cloud Computing
5+
* Description:
6+
*
7+
* @date: 2022/7/5 1:57 PM
8+
* @author: longqiuling
9+
**/
10+
public class EndpointContext {
11+
12+
private String authorizationEndpoint;
13+
14+
private String tokenEndpoint;
15+
16+
private String userinfoEndpoint;
17+
18+
public EndpointContext() {
19+
}
20+
21+
public String getAuthorizationEndpoint() {
22+
return authorizationEndpoint;
23+
}
24+
25+
public void setAuthorizationEndpoint(String authorizationEndpoint) {
26+
this.authorizationEndpoint = authorizationEndpoint;
27+
}
28+
29+
public String getTokenEndpoint() {
30+
return tokenEndpoint;
31+
}
32+
33+
public void setTokenEndpoint(String tokenEndpoint) {
34+
this.tokenEndpoint = tokenEndpoint;
35+
}
36+
37+
public String getUserinfoEndpoint() {
38+
return userinfoEndpoint;
39+
}
40+
41+
public void setUserinfoEndpoint(String userinfoEndpoint) {
42+
this.userinfoEndpoint = userinfoEndpoint;
43+
}
44+
45+
public static EndpointContextBuilder getBuilder() {
46+
return EndpointContextBuilder.anEndpointContext();
47+
}
48+
49+
public static final class EndpointContextBuilder {
50+
private String authorizationEndpoint;
51+
private String tokenEndpoint;
52+
private String userinfoEndpoint;
53+
54+
private EndpointContextBuilder() {}
55+
56+
public static EndpointContextBuilder anEndpointContext() {return new EndpointContextBuilder();}
57+
58+
public EndpointContextBuilder setAuthorizationEndpoint(String authorizationEndpoint) {
59+
this.authorizationEndpoint = authorizationEndpoint;
60+
return this;
61+
}
62+
63+
public EndpointContextBuilder setTokenEndpoint(String tokenEndpoint) {
64+
this.tokenEndpoint = tokenEndpoint;
65+
return this;
66+
}
67+
68+
public EndpointContextBuilder setUserinfoEndpoint(String userinfoEndpoint) {
69+
this.userinfoEndpoint = userinfoEndpoint;
70+
return this;
71+
}
72+
73+
public EndpointContext build() {
74+
EndpointContext endpointContext = new EndpointContext();
75+
endpointContext.setAuthorizationEndpoint(authorizationEndpoint);
76+
endpointContext.setTokenEndpoint(tokenEndpoint);
77+
endpointContext.setUserinfoEndpoint(userinfoEndpoint);
78+
return endpointContext;
79+
}
80+
}
81+
}
82+

0 commit comments

Comments
 (0)