@Configuration(proxyBeanMethods = false)
@EnableRedisRepositories
public class RedisConfig {
    // fields omitted

    @PostConstruct
    public void postConstruct() throws IOException {
        redisServer.start();
    }

    @PreDestroy
    public void preDestroy() throws IOException {
        redisServer.stop();
    }

    @Bean
    @Order(1)
    public JedisConnectionFactory redisConnectionFactory() {
        RedisStandaloneConfiguration redisStandaloneConfiguration
          = new RedisStandaloneConfiguration(redisHost, redisPort);

        return new JedisConnectionFactory(redisStandaloneConfiguration);
    }

    @Bean
    @Order(2)
    public RedisTemplate<?, ?> redisTemplate(JedisConnectionFactory connectionFactory) {
        RedisTemplate<byte[], byte[]> template = new RedisTemplate<>();
        template.setConnectionFactory(connectionFactory);
        return template;
    }

    @Bean
    @Order(3)
    public RedisCustomConversions redisCustomConversions() {
        return new RedisCustomConversions(
          Arrays.asList(
            new UsernamePasswordAuthenticationTokenToBytesConverter(), 
            new BytesToUsernamePasswordAuthenticationTokenConverter(), 
            new OAuth2AuthorizationRequestToBytesConverter(), 
            new BytesToOAuth2AuthorizationRequestConverter(), 
            new ClaimsHolderToBytesConverter(),
            new BytesToClaimsHolderConverter()));
    }

    @Bean
    @Order(4)
    public RedisRegisteredClientRepository registeredClientRepository(
      OAuth2RegisteredClientRepository registeredClientRepository) {
        RedisRegisteredClientRepository redisRegisteredClientRepository 
          = new RedisRegisteredClientRepository(registeredClientRepository);
        redisRegisteredClientRepository.save(RegisteredClients.messagingClient());

        return redisRegisteredClientRepository;
    }

    @Bean
    @Order(5)
    public RedisOAuth2AuthorizationService authorizationService(
      RegisteredClientRepository registeredClientRepository,
      OAuth2AuthorizationGrantAuthorizationRepository authorizationGrantAuthorizationRepository) {
        return new RedisOAuth2AuthorizationService(registeredClientRepository, 
          authorizationGrantAuthorizationRepository);
    }

    @Bean
    @Order(6)
    public RedisOAuth2AuthorizationConsentService authorizationConsentService(
      OAuth2UserConsentRepository userConsentRepository) {
        return new RedisOAuth2AuthorizationConsentService(userConsentRepository);
    }
}

The RedisConfig class provides the Spring beans for Redis and the Core Components of the Authorization Service with Redis:

• @PostConstruct and @PreDestroy annotations are used to start and stop the embedded Redis Server
• JedisConnectionFactory and RedisTemplate beans are used for connecting to Redis
• The RedisCustomConversions bean is needed for the Object-to-hash conversions needed for persisting to Redis
• RedisRegisteredClientRepository is used to set the registeredClientRepository bean and then register a client, as we’ll be explained in the next section
• RedisOAuth2AuthorizationService is registered as the authorizationService bean, with the appropriate repositories set
• Similarly, RedisOAuth2AuthorizationConsentService is registered as the authorizationConsentService bean

3.5. Registered Clients

. This is a built-in feature for the Spring Authorization Service, starting from version 3.1.0, that uses the OAuth2AuthorizationServerProperties class.

.

We can follow different approaches to resolve this, like using the OAuth2AuthorizationServerProperties class and doing the mapping and storage to the custom repository, using hardcoded values directly, and more. Since this is a tutorial, we’ll go with the less complex way, which is to use hardcoded values and store the RegisteredClient in the RedisRegisteredClientRepository directly, in the config (as shown in the previous section).

Let’s create a RegisteredClient using code:

public class RegisteredClients {
    public static RegisteredClient messagingClient() {
        return RegisteredClient.withId(UUID.randomUUID().toString())
          .clientId("articles-client")
          .clientSecret("{noop}secret")
          .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
          .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
          .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
          .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
          .authorizationGrantType(AuthorizationGrantType.DEVICE_CODE)
          .redirectUri("http://127.0.0.1:8080/login/oauth2/code/articles-client-oidc")
          .redirectUri("http://127.0.0.1:8080/authorized")
          .postLogoutRedirectUri("http://127.0.0.1:9000/login")
          .scope(OidcScopes.OPENID)
          .scope("articles.read")
          .build();
    }
}

This configuration should be familiar, since it is a copy of the property-based registered clients from the base project. Note that we use all four authorization grant types we created entities for.

4. 使用 Redis 的授權服務演示

讓我們看看如何訪問 articles 資源。首先啓動所有三個模塊。我們這裏使用 IntelliJ 來完成：

現在，導航到 http://127.0.0.1:8080/articles。該頁面會將我們重定向到登錄頁面：

在該頁面，用户可以選擇通過點擊 articles-client-authorization-code 或 articles-client-oidc 進行身份驗證。在兩種情況下，他們都需要提供用户名和密碼 (“admin”, “password”, 作為 UserDetailsService bean 中設置的)

這樣，他們驗證了授權服務器，並獲得了訪問 articles-client 的權限。如果用户選擇第一個選項進行身份驗證，登錄成功後，他們必須點擊第二個鏈接才能導航到 articles 頁面。如果用户選擇了第二個選項，則一切自動完成：

在圖像中，我們可以看到，在成功登錄後，用户可以訪問資源。我們還可以看到添加到瀏覽器的 cookie。

另外需要注意的是，由於我們實現了 Spring Authorization Service 的核心服務，因此現在我們可以看到 Redis 服務器存儲了會話信息以及更多信息：

oauth2_registered_client 對象是在登錄之前在 Redis 中存在的唯一對象。登錄成功後，其餘所有數據都是我們存儲的。

5. 結論

在本文中，我們討論了 Spring Authorization Service 與 Redis 的核心服務。我們回顧了需要修改以從默認的內存存儲切換到使用 Redis 的組件。最後，我們觀察了授權用户訪問資源的過程，以及 Authorization Server 如何在 Redis 中存儲令牌。