/**
	 * 加密方式，spring security5.5.7升級(jí)后，默認(rèn)采用BCryptPasswordEncoder
	 * @return
	 */
	@Bean
	public PasswordEncoder passwordEncoder() {
		return PasswordEncoderFactories.createDelegatingPasswordEncoder();
	}

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    /**
     * 引入BCrypt強(qiáng)哈希加密和解密工具
     */
    @Autowired
    private PasswordEncoder passwordEncoder;
	
	/*
     * 客戶端配置改動(dòng)
     *
     * @param clients
     * @throws Exception
     */
    
     @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
 
        InMemoryClientDetailsServiceBuilder builder = clients.inMemory();
        //spirng boot 1.5.* 升級(jí)到spring boot 2.0以上，當(dāng)再次訪問(wèn)授權(quán)服務(wù)器時(shí)出現(xiàn)Encoded password does not look like BCrypt異常，需要passwordEncoder.encode
        if (ArrayUtils.isNotEmpty(securityProperties.getOauth2().getClients())) {
            for (OAuth2ClientProperties config : securityProperties.getOauth2().getClients()) {
                //設(shè)置clientid
                builder.withClient(config.getClientId())
                        // 設(shè)置clientsecret，需要加密配置
                        .secret(passwordEncoder.encode(config.getClientSecret()))
                        // 設(shè)置令牌過(guò)期時(shí)間,單位秒,默認(rèn)7200，定義在OAuth2ClientProperties
                        .accessTokenValiditySeconds(config.getAccessTokenValidateSeconds())
                        // 允許的授權(quán)模式
                        .authorizedGrantTypes("refresh_token", "authorization_code", "password")
                        // 設(shè)置刷新令牌的過(guò)期時(shí)間，單位秒，這里設(shè)置為60天
                        .refreshTokenValiditySeconds(5184000)
                        // 配置oauth能獲取的權(quán)限,是一個(gè)數(shù)組
                        .scopes("all", "write", "read");
            }
        }
}

@Component
public class MyUserDetailsService implements UserDetailsService {
    /**
	 * 注入加密器
	 */
    @Autowired
	private PasswordEncoder passwordEncoder;
	/**
	 * 搜索用戶信息，構(gòu)造登錄用戶
	 * @param username
	 * @return
	 * @throws UsernameNotFoundException
	 */
	@Override
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
		//其他數(shù)據(jù)庫(kù)查詢等邏輯省略........
		logger.info("表單登錄用戶名:" + username);
		
//進(jìn)行權(quán)限系統(tǒng)登錄，密碼前面需要加上加密的方式，調(diào)用createDelegatingPasswordEncoder后默認(rèn)會(huì)加上{bcrypt}在密碼前面
		String password = passwordEncoder.encode("123456");
		user.setLastLoginTime(nowTime);
		sysPublicUserRepository.save(user);
		logger.info("保存登錄時(shí)間:" + nowTime);
		User user1 = new User(userId, password,
				true, accountNonExpired, true, true,
				AuthorityUtils.commaSeparatedStringToAuthorityList(user.getRoles()));
 
		return user1;
	}
}

@Component("authenticationSuccessHandler")
public class authenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
 
	/**
	 * 注入密碼器
	 */
	@Autowired
	private PasswordEncoder passwordEncoder;
	/**
	 * 此方法是用于在request中取得ClientDetails和新建tokenRequest，并用這兩個(gè)參數(shù)來(lái)生成OAuth2AccessToken
	 */
	@Override
	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
			Authentication authentication) throws IOException, ServletException {
		//..............省略代碼
		//..............
		
		//客戶端的密鑰，從header中取出
		String clientSecret = extractAndDecodeHeader(header, request);
		
		ClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId);
		PasswordEncoder passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
		if (clientDetails == null) {
			throw new UnapprovedClientAuthenticationException("clientId對(duì)應(yīng)的配置信息不存在:" + clientId);
		} else if (!passwordEncoder.matches(clientSecret,clientDetails.getClientSecret())) { //關(guān)鍵是這里不能用equal匹配了
			throw new UnapprovedClientAuthenticationException("clientSecret不匹配:" + clientId);
		}
		//............
		//后續(xù)token的其他處理
		//............
	}
}