你好呀，我的老朋友！我是老寇，跟我一起学习 Spring gRPC 集成 Spring Security OAuth2。

Spring Authorization Server

在使用 OAuth 2.0 的授权服务器时最常遇到的问题是：

• 配置文件过于冗长，导致错误难以定位。
• token 的生命周期不易自定义，容易出现过期或失效的问题。
• 缺少统一的日志策略，使得调试过程变得繁琐。

引入依赖

org.springframework.boot
spring-boot-starter-webmvc


org.springframework.boot
spring-boot-starter-security-oauth2-authorization-server

主要配置代码

@Configuration
public class SecurityConfig {
@Bean
RegisteredClientRepository registeredClientRepository(
PasswordEncoder passwordEncoder。@Value String clientId,@Value String clientSecret) {
RegisteredClient client = RegisteredClient.withId.toString)
.clientId
.clientSecret)
.clientAunticationMethod
.clientAunticationMethod
.authorizationGrantType
.scope
.tokenSettings
.accessTokenTimeToLive)
.build)
.build;return new InMemoryRegisteredClientRepository;}
@Bean
PasswordEncoder passwordEncoder {
return PasswordEncoderFactories.createDelegatingPasswordEncoder;}
@Bean
JWKSource jwkSource {
RSAKey rsaKey = generateRsa;JWKSet jwkSet = new JWKSet;return -> jwkSelector.select;}
@Bean
JwtDecoder jwtDecoder {
return OAuth2AuthorizationServerConfiguration.jwtDecoder;}
@Bean
AuthorizationServerSettings authorizationServerSettings {
return AuthorizationServerSettings.builder.build;怎么说呢，}
@Bean
@Order
SecurityFilterChain authorizationServerSecurityFilterChain throws Exception {
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
new OAuth2AuthorizationServerConfigurer;话说回来，RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher;http.securityMatcher;http.with)，http.authorizeHttpRequests.aunticated);return http.build;}
private static RSAKey generateRsa {
KeyPair keyPair = generateRsaKey;RSAPublicKey publicKey = keyPair.getPublic;
老实说，RSAPrivateKey privateKey = keyPair.getPrivate;return new RSAKey.Builder
.privateKey
.keyUse
.keyID.toString)
.build;按理说，}
private static KeyPair generateRsaKey {
try {
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance;keyPairGenerator.initialize;return keyPairGenerator.generateKeyPair;} catch {
throw new IllegalStateException;}
}
}

测试客户端

curl -u machine-client:machine-secret \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials&scope=message.read" \
http的观点是，//localhost:8080/oauth2/token

application.yml 示例

server:
至于port。8080
至于app，oauth2:
从client来看，id: client-id
从secret来看，client-secret
logging:
至于level，org.springframework.security: info

Spring gRPC Server 集成 Spring Security

在 gRPC 服务端使用全局拦截器时主要痛点包括：

• 拦截器与 Spring MVC 拦截器混用导致顺序不明确。怎么说呢，
• Token 验证耗时过长。对高并发场景影响明显，
• 缺少统一异常处理机制，导致客户端无法得到一致的错误信息。

引入依赖

org.springframework.boot
spring-boot-starter-grpc-server


org.springframework.grpc
spring-grpc-core

dependency>       > groupid"
">
\t\t\t
\t\t\t<\/wbr/>
\t
\t
 
&\gt;\t\t <\/\wbr/> dependency>\t\t <\wbr/> dependency>\t\t &
<\/\wbr/> dependencies>\t\t &
<\/\wbr/> dependencies>\t\t &
<\/\wbr/> dependencies>

主要配置代码

@Configuration
@EnableMethodSecurity
public class GrpcOAuth2Config {
@Bean
@GlobalServerInterceptor
AunticationProcessInterceptor jwtAunticationProcessInterceptor throws Exception {
return grpc.authorizeRequests(requests ->
requests.allRequests.aunticated)
.oauth2ResourceServer(resourceServer ->
resourceServer.jwt))
.build;}
}

方法级安全示例

@Slf4j
@GrpcService
@RequiredArgsConstructor
public class XxxImpl extends XxxGrpc.XxxImplBase {
private final String resultMsg = MessageUtils.getMessage;@Override
@PreAuthorize")
public void generateId(GenerateIdRequest request,StreamObserver& responseObserver) {
GenerateXxxResponse response = GenerateXxxResponse.newBuilder
.setCode
.setMsg
// TODO 填充业务数据
.build;responseObserver.onNext;responseObserver.onCompleted;}
}

application.yml 配置示例

spring:
security:
oauth2这方面，resourceserver:
jwt的观点是。jwk-set-uri: http://localhost:8080/oauth2/jwks

Pain Point：客户端在每一次调用前都需要获取并缓存 Token，而如果缓存失效或者刷新失败会导致大量无效请求。方法是使用 Spring 的授权管理器自动处理 Token 生命周期，并通过全局拦截器统一注入。不过，

引入依赖

dependency>
groupid"
test">

artifactid" test">

version" test">

&