/oauth/authorize：验证接口， AuthorizationEndpoint
/oauth/token：获取token
/oauth/confirm_access：用户授权
/oauth/error：认证失败
/oauth/check_token：资源服务器用来校验token
/oauth/token_key：jwt模式下获取公钥；位于：TokenKeyEndpoint ，通过 JwtAccessTokenConverter 访问key

     * Oauth2 密码模式
     * @param passwordLoginParamDto
     * @param request
     * @param response
     * @throws IOException
     */
    @ApiOperation(value = "用户名密码获取token")
    @RequestMapping(value = "/oauth/user/token", method = RequestMethod.POST, consumes = MediaType.APPLICATION_JSON_VALUE)
    public void userTokenInfo(@RequestBody PasswordLoginParamDto passwordLoginParamDto,
                              HttpServletRequest request, HttpServletResponse response) throws IOException {
        String userName = "";
        if(passwordLoginParamDto.getUserType() == 1){
            userName = String.format("%s,%s", passwordLoginParamDto.getUsername(), passwordLoginParamDto.getUserType());
        }else{
            userName = String.format("%s;%s,%s", passwordLoginParamDto.getUsername(), passwordLoginParamDto.getShopId(), passwordLoginParamDto.getUserType());
        }

        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(userName, passwordLoginParamDto.getPassword());
        TokenTransferDto dto = getTokenTransferDto("username or password error!");
        dto.request = request;
        dto.response = response;
        dto.token = token;
        writerDefaultToken(dto);
    }

    /**
     * Oauth2 客户端模式
     * @param request
     * @param response
     * @throws IOException
     */
    @ApiOperation(value = "clientId获取token")
    @PostMapping("/oauth/client/token")
    public void clientTokenInfo(HttpServletRequest request, HttpServletResponse response)throws IOException {
        TokenTransferDto dto = getTokenTransferDto("clientId or secret error.");
        dto.request = request;
        dto.response = response;
        writerClientToken(dto);
    }

@ApiOperation(value = "openId获取token")
    @PostMapping("/oauth/openId/token")
    public void getTokenByOpenId(
            @RequestBody OpenIdLoginParamDto openIdLoginParamDto,
            HttpServletRequest request, HttpServletResponse response) throws IOException {
        OpenIdAuthenticationToken token = new OpenIdAuthenticationToken(openIdLoginParamDto.getOpenId());
        TokenTransferDto dto = getTokenTransferDto("openId error!");
        dto.request = request;
        dto.response = response;
        dto.token = token;
        writerDefaultToken(dto);
    }

/**
 * @author lbj
 */
public class OpenIdAuthenticationProvider implements AuthenticationProvider {

    private MySocialUserDetailsService userDetailsService;

    @Override
    public Authentication authenticate(Authentication authentication) {
        OpenIdAuthenticationToken authenticationToken = (OpenIdAuthenticationToken) authentication;
        String openId = (String) authenticationToken.getPrincipal();
        UserDetails user = userDetailsService.loadUserByOpenId(openId);
        if (user == null) {
            throw new InternalAuthenticationServiceException("openId result user is null.");
        }
        OpenIdAuthenticationToken authenticationResult = new OpenIdAuthenticationToken(user, user.getAuthorities());
        authenticationResult.setDetails(authenticationToken.getDetails());
        return authenticationResult;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return OpenIdAuthenticationToken.class.isAssignableFrom(authentication);
    }

    public MySocialUserDetailsService getUserDetailsService() {
        return userDetailsService;
    }

    public void setUserDetailsService(MySocialUserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }
}

/**
 * openId的相关处理配置
 *
 * @author lbj
 */
@Component
public class OpenIdAuthenticationSecurityConfig extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {
    @Autowired
    private MySocialUserDetailsService userDetailsService;

    @Override
    public void configure(HttpSecurity http) {
        //openId provider
        OpenIdAuthenticationProvider provider = new OpenIdAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        http.authenticationProvider(provider);
    }
}

@Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().httpBasic().disable().authorizeRequests().anyRequest().permitAll()
        .and().apply(openIdAuthenticationSecurityConfig); //就是这里对OpenId生效

        // 基于密码 等模式可以无session,不支持授权码模式
        if (authenticationEntryPoint != null) {
            http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
                    .accessDeniedHandler(customAccessDeniedHandler);
            http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        } else {
            // 授权码模式单独处理，需要session的支持，此模式可以支持所有oauth2的认证
            http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
        }

        // 解决不允许显示在iframe的问题
        http.headers().frameOptions().disable();
        http.headers().cacheControl();

    }

dhgate:
  oauth2:
    token:
      store:
        type: resJwt

public class JWTfaultUserAuthenticationConverter extends DefaultUserAuthenticationConverter {
            private Collection<? extends GrantedAuthority> defaultAuthorities;

            public Authentication extractAuthentication(Map<String, ?> map) {
                if (map.containsKey("user_info")) {
                    Object principal = map.get("user_info");
                //  Collection<? extends GrantedAuthority> authorities = getAuthorities(map);
                    LoginAppUser loginUser = new LoginAppUser();
                    if (principal instanceof Map) {
                        loginUser = BeanUtil.mapToBean((Map) principal, LoginAppUser.class, true);
                    }
                    return new UsernamePasswordAuthenticationToken(loginUser, "N/A", loginUser.getAuthorities());
                }
                return null;
            }
        }

/**
 * @author 作者 lbj
 * @version 创建时间：2020年07月01日 上午20:57:51 获取用户信息
 */
public class SysUserUtil {

    /**
     * 获取登陆的 LoginAppUser
     *
     * @return
     */
    public static LoginAppUser getLoginAppUser() {
        
        // 当OAuth2AuthenticationProcessingFilter设置当前登录时，直接返回
        // 强认证时处理
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        if (authentication instanceof OAuth2Authentication) {
            OAuth2Authentication oAuth2Auth = (OAuth2Authentication) authentication;
            authentication = oAuth2Auth.getUserAuthentication();

            if (authentication instanceof UsernamePasswordAuthenticationToken) {
                UsernamePasswordAuthenticationToken authenticationToken = (UsernamePasswordAuthenticationToken) authentication;

                if (authenticationToken.getPrincipal() instanceof LoginAppUser) {
                    return (LoginAppUser) authenticationToken.getPrincipal();
                } else if (authenticationToken.getPrincipal() instanceof Map) {

                    LoginAppUser loginAppUser = BeanUtil.mapToBean((Map) authenticationToken.getPrincipal(), LoginAppUser.class, true);
                    return loginAppUser;
                }
            } else if (authentication instanceof PreAuthenticatedAuthenticationToken) {
                // 刷新token方式
                PreAuthenticatedAuthenticationToken authenticationToken = (PreAuthenticatedAuthenticationToken) authentication;
                return (LoginAppUser) authenticationToken.getPrincipal();
            }
        }
       
        return null;
    }
}

/**
 * webflux资源服务器配置
 *
 * @author lbj
 * @date 2020/07/02
 */
@EnableConfigurationProperties(SecurityProperties.class)
public class ResourceServerConfiguration {
    @Autowired
    private SecurityProperties securityProperties;

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private PermitAuthenticationWebFilter permitAuthenticationWebFilter;

    @Bean
    SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http.addFilterBefore(permitAuthenticationWebFilter, SecurityWebFiltersOrder.AUTHENTICATION);
        //认证处理器
        ReactiveAuthenticationManager customAuthenticationManager = new CustomAuthenticationManager(tokenStore);
        JsonAuthenticationEntryPoint entryPoint = new JsonAuthenticationEntryPoint();
        //token转换器
        ServerBearerTokenAuthenticationConverter tokenAuthenticationConverter = new ServerBearerTokenAuthenticationConverter();
        tokenAuthenticationConverter.setAllowUriQueryParameter(true);
        //oauth2认证过滤器
        AuthenticationWebFilter oauth2Filter = new AuthenticationWebFilter(customAuthenticationManager);
        oauth2Filter.setServerAuthenticationConverter(tokenAuthenticationConverter);
        oauth2Filter.setAuthenticationFailureHandler(new ServerAuthenticationEntryPointFailureHandler(entryPoint));
        oauth2Filter.setAuthenticationSuccessHandler(new Oauth2AuthSuccessHandler());
        http.addFilterAt(oauth2Filter, SecurityWebFiltersOrder.AUTHENTICATION);

        ServerHttpSecurity.AuthorizeExchangeSpec authorizeExchange = http.authorizeExchange();
//        if (securityProperties.getAuth().getHttpUrls().length > 0) {
//            authorizeExchange.pathMatchers(securityProperties.getAuth().getHttpUrls()).authenticated();
//        }
        if (securityProperties.getIgnore().getUrls().length > 0) {
            authorizeExchange.pathMatchers(securityProperties.getIgnore().getUrls()).permitAll();
        }

        ServerHttpSecurity.AuthorizeExchangeSpec.Access access = authorizeExchange
                .pathMatchers(HttpMethod.OPTIONS).permitAll()
                .anyExchange();
        setAuthenticate(access);

                //.anyExchange().authenticated()  //这个跟下面那行是一样的，只是下面能更细的控制权限
                   // .access(permissionAuthManager)   // 应用api权限控制 后期权限控制会用，暂时先不做
        http
            .exceptionHandling()
                .accessDeniedHandler(new JsonAccessDeniedHandler())
                .authenticationEntryPoint(entryPoint)
        .and()
            .headers()
                .frameOptions()
                .disable()
        .and()
            .httpBasic().disable()
            .csrf().disable();

        return http.build();
    }

    /**
     * url权限控制，默认是认证就通过，可以重写实现个性化 permisson设置
     * @param authorizedAccess
     */
    public ServerHttpSecurity setAuthenticate(ServerHttpSecurity.AuthorizeExchangeSpec.Access authorizedAccess) {
        return authorizedAccess.authenticated().and();
    }
}

[
    {
        "id": "ebay-service",
        "predicates": [{
            "name": "Path",
            "args": {
                "pattern": "/ebay/**"
            }
        }],
        "uri": "lb://ebay-service",
        "filters": [{
            "name": "StripPrefix",
            "args": {
                "parts": "1"
            }
        }]
    }
]

  security:
    ignore:
      httpUrls: >
        /uaa/**,
        /dsuser/users-anon/**,
        /dsuser/api/**,
        /buser/users-anon/**,
        /buser/api/**,
        /shopify/dhgate/shopify/unauth/**,
        /myyshop/everybody/**,
        /umc/email/**,
        /myyshop-order/everybody/**,
        /myyshop/everybody/**,
        /umc/email/**,
        /myyshop-order/order/payCallBack,
        /search/myyshop/search,
        /myyshop-order/shipping/api/**

http.addFilterBefore(permitAuthenticationWebFilter, SecurityWebFiltersOrder.AUTHENTICATION);

/**
 * webflux资源服务器配置
 *
 * @author lbj
 * @date 2020/07/02
 */
@EnableConfigurationProperties(SecurityProperties.class)
public class ResourceServerConfiguration {
    @Autowired
    private SecurityProperties securityProperties;

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private PermitAuthenticationWebFilter permitAuthenticationWebFilter;

    @Bean
    SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http.addFilterBefore(permitAuthenticationWebFilter, SecurityWebFiltersOrder.AUTHENTICATION);
        //认证处理器
        ReactiveAuthenticationManager customAuthenticationManager = new CustomAuthenticationManager(tokenStore);
        JsonAuthenticationEntryPoint entryPoint = new JsonAuthenticationEntryPoint();
        //token转换器
        ServerBearerTokenAuthenticationConverter tokenAuthenticationConverter = new ServerBearerTokenAuthenticationConverter();
        tokenAuthenticationConverter.setAllowUriQueryParameter(true);
        //oauth2认证过滤器
        AuthenticationWebFilter oauth2Filter = new AuthenticationWebFilter(customAuthenticationManager);
        oauth2Filter.setServerAuthenticationConverter(tokenAuthenticationConverter);
        oauth2Filter.setAuthenticationFailureHandler(new ServerAuthenticationEntryPointFailureHandler(entryPoint));
        oauth2Filter.setAuthenticationSuccessHandler(new Oauth2AuthSuccessHandler());
        http.addFilterAt(oauth2Filter, SecurityWebFiltersOrder.AUTHENTICATION);

        ServerHttpSecurity.AuthorizeExchangeSpec authorizeExchange = http.authorizeExchange();
//        if (securityProperties.getAuth().getHttpUrls().length > 0) {
//            authorizeExchange.pathMatchers(securityProperties.getAuth().getHttpUrls()).authenticated();
//        }
        if (securityProperties.getIgnore().getUrls().length > 0) {
            authorizeExchange.pathMatchers(securityProperties.getIgnore().getUrls()).permitAll();
        }

        ServerHttpSecurity.AuthorizeExchangeSpec.Access access = authorizeExchange
                .pathMatchers(HttpMethod.OPTIONS).permitAll()
                .anyExchange();
        setAuthenticate(access);

                //.anyExchange().authenticated()  //这个跟下面那行是一样的，只是下面能更细的控制权限
                   // .access(permissionAuthManager)   // 应用api权限控制 后期权限控制会用，暂时先不做
        http
            .exceptionHandling()
                .accessDeniedHandler(new JsonAccessDeniedHandler())
                .authenticationEntryPoint(entryPoint)
        .and()
            .headers()
                .frameOptions()
                .disable()
        .and()
            .httpBasic().disable()
            .csrf().disable();

        return http.build();
    }

    /**
     * url权限控制，默认是认证就通过，可以重写实现个性化 permisson设置
     * @param authorizedAccess
     */
    public ServerHttpSecurity setAuthenticate(ServerHttpSecurity.AuthorizeExchangeSpec.Access authorizedAccess) {
        return authorizedAccess.authenticated().and();
    }
}

private static final int INITIAL_ORDER = 100;
    private static final int ORDER_STEP = 100;
    private final Map<String, Integer> filterToOrder = new HashMap();

    FilterComparator() {
        FilterComparator.Step order = new FilterComparator.Step(100, 100);
        this.put(ChannelProcessingFilter.class, order.next());
        this.put(ConcurrentSessionFilter.class, order.next());
        this.put(WebAsyncManagerIntegrationFilter.class, order.next());
        this.put(SecurityContextPersistenceFilter.class, order.next());
        this.put(HeaderWriterFilter.class, order.next());
        this.put(CorsFilter.class, order.next());
        this.put(CsrfFilter.class, order.next());
        this.put(LogoutFilter.class, order.next());
        this.filterToOrder.put("org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter", order.next());
        this.filterToOrder.put("org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationRequestFilter", order.next());
        this.put(X509AuthenticationFilter.class, order.next());
        this.put(AbstractPreAuthenticatedProcessingFilter.class, order.next());
        this.filterToOrder.put("org.springframework.security.cas.web.CasAuthenticationFilter", order.next());
        this.filterToOrder.put("org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter", order.next());
        this.filterToOrder.put("org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter", order.next());
        this.put(UsernamePasswordAuthenticationFilter.class, order.next());
        this.put(ConcurrentSessionFilter.class, order.next());
        this.filterToOrder.put("org.springframework.security.openid.OpenIDAuthenticationFilter", order.next());
        this.put(DefaultLoginPageGeneratingFilter.class, order.next());
        this.put(DefaultLogoutPageGeneratingFilter.class, order.next());
        this.put(ConcurrentSessionFilter.class, order.next());
        this.put(DigestAuthenticationFilter.class, order.next());
        this.filterToOrder.put("org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter", order.next());
        this.put(BasicAuthenticationFilter.class, order.next());
        this.put(RequestCacheAwareFilter.class, order.next());
        this.put(SecurityContextHolderAwareRequestFilter.class, order.next());
        this.put(JaasApiIntegrationFilter.class, order.next());
        this.put(RememberMeAuthenticationFilter.class, order.next());
        this.put(AnonymousAuthenticationFilter.class, order.next());
        this.filterToOrder.put("org.springframework.security.oauth2.client.web.OAuth2AuthorizationCodeGrantFilter", order.next());
        this.put(SessionManagementFilter.class, order.next());
        this.put(ExceptionTranslationFilter.class, order.next());
        this.put(FilterSecurityInterceptor.class, order.next());
        this.put(SwitchUserFilter.class, order.next());
    }