curl --location --request POST 'http://localhost:9000/oauth2/token?grant_type=authorization_code&client_id=login-client&client_secret=openid-connect&redirect_uri=http://127.0.0.1:8080/authorized&code=ZHccPMG-odfrGRQZt5iU9i_I0xpn2S25CjsDonHJIWUO9piBGeNNlwIrlZ2t_jUhgKLnug3yrCsb53A6S-Zh5t2rcI3i9XEt5mQZIWLacmVgIlu5xboK16cWCNzHwXT6'

curl --location --request POST 'http://localhost:9000/oauth2/token?grant_type=authorization_code&redirect_uri=http://127.0.0.1:8080/authorized&code=3Opv5cyLcKG5gOB2BIkuhx8IUrIjPmzhq1PozNS-lF9nWFBQnatLwhzr2OXVKznmPCrdY3E1SHedNhiZUd5CsKdouSuxO5tkihPIo0R-VD6_dtVwoC5-jlSbTrmEMAFU' \
--header 'Authorization: Basic bG9naW4tY2xpZW50OnNlY3JldA=='

curl --location --request POST
'http://localhost:9000/oauth2/token?grant_type=refresh_token&client_id=login-client&client_secret=openid-connect&refresh_token=
5mxZe5wfyIzIRUuIQHR32pLRXdeooSHGPbw5IhXpR6zdBseG8jSbPf4EER-WkbugX4KEs-HOc5djtFjjo3zLRnjWhpoFzB1QDoDSqKyJm7dL_Mwztlpga6IoOZo7bm3J'

curl --location --request POST
'http://localhost:9000/oauth2/token?grant_type=client_credentials&scope=message:read'
\ --header 'Authorization: Basic bWVzc2FnaW5nLWNsaWVudDpzZWNyZXQ='

curl --location --request POST
'http://localhost:9000/oauth2/token?grant_type=client_credentials&client_id=messaging-client&client_secret=secret&scope=message:read'

// Spring官方测试脚本中得到的例子
private static final String S256_CODE_VERIFIER = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
private static final String S256_CODE_CHALLENGE = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
S256

http://localhost:9000/oauth2/authorize?response_type=code&client_id=login-client&scope=openid&state=state&redirect_uri=http://127.0.0.1:8080/authorized&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256

curl --location --request POST
'http://localhost:9000/oauth2/token?grant_type=authorization_code&client_id=login-client&redirect_uri=http://127.0.0.1:8080/authorized&code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk&code=C3PD5FrCuD9nIlqTOVkHm8CR1ASn0gd_Cu3DcgSPb80nLl8MzWWUVW822fUXsL_CrVwBOProla1mZL8GIWXrUGptWkqf7wv9D3v--d4F1K8MSogiiKDaa5KiwsdMq_Ki'

implementation 'org.springframework.security:spring-security-oauth2-authorization-server:0.2.3'
// 这个就不用引用了 implementation 'org.springframework.boot:spring-boot-starter-security'

server:
  port: 9000

@SpringBootTest
@AutoConfigureMockMvc
public class ClientCredentialsITests {
	private static final String CLIENT_ID="messaging-client";
	private static final String CLIENT_SECRET="secret";
	private final ObjectMapper objectMapper=new ObjectMapper();

	@Autowired
	private MockMvc mockMvc;

	private static final class BasicAuthenticationRequestPostProcessor implements RequestPostProcessor{
		private final String username;
		private final String password;
		private BasicAuthenticationRequestPostProcessor(String username,String password){
			this.username=username;
			this.password=password;
		}
		@Override
		public MockHttpServletRequest postProcessRequest(MockHttpServletRequest request){
			HttpHeaders headers=new HttpHeaders();
			headers.setBasicAuth(this.username,this.password);
			request.addHeader("Authorization",headers.getFirst("Authorization"));
			return request;
		}
	}

	private BasicAuthenticationRequestPostProcessor  basicAuth(String username,String password){
		return new BasicAuthenticationRequestPostProcessor(username,password);
	}

	@Test
	void performTokenRequestWhenValidClientCredentialsThenOk() throws Exception{
		this.mockMvc.perform(post("/oauth2/token")
						.param("grant_type","client_credentials")
						.param("scope","message:read")
						.with(basicAuth(CLIENT_ID,CLIENT_SECRET))
				)
				.andExpect(status().isOk())
				.andExpect(jsonPath("$.access_token").isString())
				.andExpect(jsonPath("$.expires_in").isNumber())
				.andExpect(jsonPath("$.scope").value("message:read"))
				.andExpect(jsonPath("$.token_type").value("Bearer"));
	}
}

spring:
  security:
    oauth2:
      client:
        registration:	<1>
          login-client:		<2>
            provider: spring	<3>
            client-id: login-client
            client-secret: openid-connect
            client-authentication-method: client_secret_basic
            authorization-grant-type: authorization_code
            redirect-uri: http://127.0.0.1:8080/login/oauth2/code/login-client
            scope: openid,profile	<4>
            client-name: Spring
        provider:	<5>
          spring:
            authorization-uri: http://localhost:9000/oauth2/authorize
            token-uri: http://localhost:9000/oauth2/token
            jwk-set-uri: http://localhost:9000/oauth2/jwks

@Controller
public class IndexController {
    @GetMapping("/")
    public String index(Model model, @RegisteredOAuth2AuthorizedClient OAuth2AuthorizedClient authorizedClient,
                        @AuthenticationPrincipal OAuth2User oauth2User) {
        model.addAttribute("userName", oauth2User.getName());
        model.addAttribute("clientName", authorizedClient.getClientRegistration().getClientName());
        model.addAttribute("userAttributes", oauth2User.getAttributes());
        return "index";
    }
}

String requestedRedirectHost = requestedRedirect.getHost();
		if (requestedRedirectHost == null || requestedRedirectHost.equals("localhost")) {
			// As per https://tools.ietf.org/html/draft-ietf-oauth-v2-1-01#section-9.7.1
			// While redirect URIs using localhost (i.e.,
			// "http://localhost:{port}/{path}") function similarly to loopback IP
			// redirects described in Section 10.3.3, the use of "localhost" is NOT RECOMMENDED.
			return false;
		}

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class LoopbackIpRedirectFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request
            , HttpServletResponse response
            , FilterChain filterChain)throws ServletException, IOException {

        if(request.getServerName().equals("localhost")&& request.getHeader("host")!=null){
            UriComponents uri= UriComponentsBuilder.fromHttpRequest(new ServletServerHttpRequest(request))
                    .host("127.0.0.1").build();
            response.sendRedirect(uri.toUriString());
            return;
        }
        filterChain.doFilter(request,response);
    }
}

spring:
  security:
    oauth2:
      client:
        registration:	<1>
          github:		<2>
            client-id: github-client-id
            client-secret: github-client-secret

ResultActions  resultActions=this.mvc.perform(get("/").with(oauth2Login()));

ClientRegistration clientRegistration = ClientRegistration.withRegistrationId("test")
    .authorizationGrantType(AuthorizationGrantType.PASSWORD)
    .clientId("my-client-id")
    .clientName("my-client-name")
    .tokenUri("https://token-uri.example.org")
    .build();
ResultActions  resultActions=this.mvc.perform(get("/").with(oauth2Login()
                                                            .clientRegistration(clientRegistration)
                                                            .attributes(a->a.put("sub","spring-security")) ));
resultActions.andExpect(model().attribute("userName","spring-security"));

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception{
    http.authorizeRequests(authorize->authorize.anyRequest().authenticated())
        .oauth2Login(oauth2->oauth2
                     .tokenEndpoint(token->token.accessTokenResponseClient(mockAccessTokenResponseClient()))
                     .userInfoEndpoint(userInfo->userInfo.userService(mockUserService()))
                    );

    return http.build();
}

private OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> mockAccessTokenResponseClient(){
    OAuth2AccessTokenResponse auth2AccessTokenResponse=OAuth2AccessTokenResponse.withToken("access-token-1234")
        .tokenType(OAuth2AccessToken.TokenType.BEARER).expiresIn(60*1000).build();

    //模拟系统中的OAuth2AccessTokenResponseClient，一旦发生了getTokenResponse，就返回自己的auth2AccessTokenResponse
    OAuth2AccessTokenResponseClient tokenResponseClient=mock(OAuth2AccessTokenResponseClient.class);
    when(tokenResponseClient.getTokenResponse(any())).thenReturn(auth2AccessTokenResponse);

    return tokenResponseClient;
}

AService aService=mock(AService.class)
when(aService.fun1(any())).thenReturn(对象)
return aService;

### 获取Token POST {{AuthServerUri}}/oauth2/token Authorization: Basic
messaging-client secret Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&scope=message:read > {%
client.log(response.body.access_token); client.test("Request executed
successfully", function() { client.assert(response.status === 200, "Response
status is not 200"); }); client.global.set("access_token",
response.body.access_token); %}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://localhost:9000
#          jwk-set-uri: http://localhost:9000/oauth2/jwks

@Test
void indexGreetsAuthenticatedUser() throws Exception{
    this.mockMvc.perform(get("/").with(jwt().jwt(jwt->jwt.subject("ch4mpy"))))
        .andExpect(content().string("Hello ch4mpy!"));

    this.mockMvc.perform(post("/message")
                         .content("Hello message")
                         .with(jwt().jwt(jwt->jwt.claim("scope","message:write")))
                        )
        .andExpect(status().isOk());
}

MockWebServer server = new MockWebServer();
MockResponse mockResponse = new MockResponse().setBody("hello, world!")
server.enqueue(mockResponse);
try {
    server.start(8080);
} catch (IOException e) {
    e.printStackTrace();
}

MockWebServer server = new MockWebServer();
final Dispatcher dispatcher = new Dispatcher() {

    @Override
    public MockResponse dispatch(RecordedRequest request) throws InterruptedException {

        if (request.getPath().equals("/v1/login/auth/")){
            return new MockResponse().setResponseCode(200);
        } else if (request.getPath().equals("/v1/check/version")){
            return new MockResponse().setResponseCode(200).setBody("version=9");
        } else if (request.getPath().equals("/v1/profile/info")) {
            return new MockResponse().setResponseCode(200).setBody("{\\\"info\\\":{\\\"name\":\"Lucas Albuquerque\",\"age\":\"21\",\"gender\":\"male\"}}");
        }
        return new MockResponse().setResponseCode(404);
    }
};
server.setDispatcher(dispatcher);

try {
    server.start(8099);
} catch (IOException e) {
    e.printStackTrace();
    System.exit(0);
}

{
  "keys": [
    {
      "alg": "RS256",
      "kty": "RSA",
      "use": "sig",
      "x5c": [
        "MIIC+DCCAeCgAwIBAgIJBIGjYW6hFpn2MA0GCSqGSIb3DQEBBQUAMCMxITAfBgNVBAMTGGN1c3RvbWVyLWRlbW9zLmF1dGgwLmNvbTAeFw0xNjExMjIyMjIyMDVaFw0zMDA4MDEyMjIyMDVaMCMxITAfBgNVBAMTGGN1c3RvbWVyLWRlbW9zLmF1dGgwLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMnjZc5bm/eGIHq09N9HKHahM7Y31P0ul+A2wwP4lSpIwFrWHzxw88/7Dwk9QMc+orGXX95R6av4GF+Es/nG3uK45ooMVMa/hYCh0Mtx3gnSuoTavQEkLzCvSwTqVwzZ+5noukWVqJuMKNwjL77GNcPLY7Xy2/skMCT5bR8UoWaufooQvYq6SyPcRAU4BtdquZRiBT4U5f+4pwNTxSvey7ki50yc1tG49Per/0zA4O6Tlpv8x7Red6m1bCNHt7+Z5nSl3RX/QYyAEUX1a28VcYmR41Osy+o2OUCXYdUAphDaHo4/8rbKTJhlu8jEcc1KoMXAKjgaVZtG/v5ltx6AXY0CAwEAAaMvMC0wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUQxFG602h1cG+pnyvJoy9pGJJoCswDQYJKoZIhvcNAQEFBQADggEBAGvtCbzGNBUJPLICth3mLsX0Z4z8T8iu4tyoiuAshP/Ry/ZBnFnXmhD8vwgMZ2lTgUWwlrvlgN+fAtYKnwFO2G3BOCFw96Nm8So9sjTda9CCZ3dhoH57F/hVMBB0K6xhklAc0b5ZxUpCIN92v/w+xZoz1XQBHe8ZbRHaP1HpRM4M7DJk2G5cgUCyu3UBvYS41sHvzrxQ3z7vIePRA4WF4bEkfX12gvny0RsPkrbVMXX1Rj9t6V7QXrbPYBAO+43JvDGYawxYVvLhz+BJ45x50GFQmHszfY3BR9TPK8xmMmQwtIvLu1PMttNCs7niCYkSiUv2sc2mlq1i3IashGkkgmo="
      ],
      "n": "yeNlzlub94YgerT030codqEztjfU_S6X4DbDA_iVKkjAWtYfPHDzz_sPCT1Axz6isZdf3lHpq_gYX4Sz-cbe4rjmigxUxr-FgKHQy3HeCdK6hNq9ASQvMK9LBOpXDNn7mei6RZWom4wo3CMvvsY1w8tjtfLb-yQwJPltHxShZq5-ihC9irpLI9xEBTgG12q5lGIFPhTl_7inA1PFK97LuSLnTJzW0bj096v_TMDg7pOWm_zHtF53qbVsI0e3v5nmdKXdFf9BjIARRfVrbxVxiZHjU6zL6jY5QJdh1QCmENoejj_ytspMmGW7yMRxzUqgxcAqOBpVm0b-_mW3HoBdjQ",
      "e": "AQAB",
      "kid": "NjVBRjY5MDlCMUIwNzU4RTA2QzZFMDQ4QzQ2MDAyQjVDNjk1RTM2Qg",
      "x5t": "NjVBRjY5MDlCMUIwNzU4RTA2QzZFMDQ4QzQ2MDAyQjVDNjk1RTM2Qg"
    }
  ]
}

@RestController
public class StaticResourceServerController {
    @GetMapping("/")
    public String index(@AuthenticationPrincipal Jwt jwt){
        return  String.format("Hello, %s!",jwt.getSubject());
    }

    @GetMapping("/message")
    public String  message(){
        return "secret message";
    }
}

@Configuration
public class StaticResourceServerConfiguration {
    @Value("${spring.security.oauth2.resourceserver.jwt.key-value}")
    RSAPublicKey key;

    @Bean
    public JwtDecoder jwtDecoder(){
        return NimbusJwtDecoder.withPublicKey(key).build();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeRequests(request->request
                .antMatchers("/message/**").hasAuthority("SCOPE_message:read")
                .anyRequest().authenticated()
        );
        //这里多余了这句话。可以使用默认的
        http.oauth2ResourceServer(oauth2->oauth2
                .jwt(Customizer.withDefaults())
        );
        return http.build();
    }
}

@SpringBootTest
@AutoConfigureMockMvc
//  是从官方jwe中复制过来的私钥与公钥。 正常的是自己生成的公钥
@ActiveProfiles("nimbus")
public class StaticResourceServerApplicationTest {

    @Value("${test.noScopesToken}")
    String noScopesToken;

    @Value("${test.messageReadToken}")
    String messageReadToken;

spring:
  security:
    oauth2:
      resourceserver:
        opaque:
          introspection-uri: http://localhost:9000/oauth2/introspect
          introspection-client-id: login-client
          introspection-client-secret: openid-connect
server:
  port: 8903

@EnableWebSecurity
public class OpaqueResourceServerSecurityConfiguration {
    @Value("${spring.security.oauth2.resourceserver.opaque.introspection-uri}")
    String introspectionUri;
    @Value("${spring.security.oauth2.resourceserver.opaque.introspection-client-id}")
    String clientId;
    @Value("${spring.security.oauth2.resourceserver.opaque.introspection-client-secret}")
    String clientSecret;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception{
        http.authorizeRequests(request->request
                .mvcMatchers(HttpMethod.GET,"/message/**").hasAuthority("SCOPE_message:read")
                .mvcMatchers(HttpMethod.POST,"message/**").hasAuthority("SCOPE_message:write")
                .anyRequest().authenticated()
        );

        http.oauth2ResourceServer(oauth2->oauth2
                .opaqueToken(opaque->opaque
                        .introspectionUri(this.introspectionUri)
                        .introspectionClientCredentials(this.clientId,this.clientSecret)
                )
        );
        return http.build();
    }
}