sso-merryyou Documentation

This project implements Single Sign-On (SSO) using the OAuth2 protocol. The flow works as follows:

1. Access Client: User visits client1.
2. Redirect: client1 redirects the request to sso-server.
3. Authorization: User agrees to the authorization.
4. Authorization Code: sso-server returns an authorization code (code) to client1.
5. Token Request: client1 exchanges the code for a token.
6. JWT Token: sso-server returns a JWT token.
7. Login: client1 parses the token and logs the user in.
8. Cross-Client Access: When the user visits client2, client2 redirects to sso-server.
9. Seamless Auth: Since the user is already authenticated at sso-server, the authorization is granted automatically.
10. Token Exchange: client2 receives a code, exchanges it for a JWT token, and logs the user in.

Key Note: While client1 and client2 receive different tokens, the underlying user information extracted from the tokens is identical because they are issued by the same sso-server.

User session state and credential verification are managed exclusively by the sso-server authentication center.

To integrate a Spring Boot application as an SSO client, use the @EnableOAuth2Sso annotation. You must configure the application.yml with the following properties to point to the sso-server:

• auth-server: The base URL of the SSO server.
• security.oauth2.client.client-id: The ID of the client registered on the server.
• security.oauth2.client.client-secret: The secret for the client.
• security.oauth2.client.user-authorization-uri: The server's authorization endpoint (usually ${auth-server}/oauth/authorize).
• security.oauth2.client.access-token-uri: The server's token endpoint (usually ${auth-server}/oauth/token).
• security.resource.jwt.key-uri: The endpoint on the server used to retrieve the public key for parsing JWT tokens (usually ${auth-server}/oauth/token_key).

auth-server: http://localhost:8082/uaa
server:
  context-path: /client1
  port: 8083
security:
  oauth2:
    client:
      client-id: merryyou1
      client-secret: merryyousecrect1
      user-authorization-uri: ${auth-server}/oauth/authorize
      access-token-uri: ${auth-server}/oauth/token
    resource:
      jwt:
        key-uri: ${auth-server}/oauth/token_key

You can deploy the entire Single Sign-On (SSO) ecosystem using a single docker-compose.yml file. The setup includes the central SSO server and multiple client applications that link back to the server for authentication.

Services Overview

Network Connectivity

Clients (sso-taobao, sso-tmall, and sso-resource) are configured to link to the sso-login service, allowing them to communicate with the central authentication server for SSO flows.

version: '3'
services:
  sso-login:
   image: hub.c.163.com/longfeizheng/sso-server:1.0
   restart: always
   ports:
     - "8082:8082"
  sso-taobao:
    image: hub.c.163.com/longfeizheng/sso-client1:1.0
    restart: always
    ports:
      - 8083:8083
    links:
      - sso-login
  sso-tmall:
    image: hub.c.163.com/longfeizheng/sso-client2:1.0
    restart: always
    ports:
      - 8084:8084
    links:
      - sso-login
  sso-resource:
    image: hub.c.163.com/longfeizheng/sso-resource:1.0
    restart: always
    ports:
      - 8085:8085
    links:
      - sso-login

The sso-server acts as the central authentication authority. It uses SsoAuthorizationServerConfig to define clients and token management.

Client Configuration

Clients are registered in memory using ClientDetailsServiceConfigurer. Each client requires a client-id, secret, authorizedGrantTypes, and scopes.

JWT Token Management

The server uses JwtAccessTokenConverter to sign tokens. You must define a signingKey to ensure clients can verify the tokens.

Security Configuration

Use WebSecurityConfigurerAdapter to define the login page (e.g., /authentication/require), the login processing URL (e.g., /authentication/form), and which paths are permitted without authentication (static assets, login endpoints).

@Configuration
@EnableAuthorizationServer
public class SsoAuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("merryyou1")
                .secret("merryyousecrect1")
                .authorizedGrantTypes("authorization_code", "refresh_token")
                .scopes("all")
                .and()
                .withClient("merryyou2")
                .secret("merryyousecrect2")
                .authorizedGrantTypes("authorization_code", "refresh_token")
                .scopes("all");
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(jwtTokenStore()).accessTokenConverter(jwtAccessTokenConverter());
    }

    @Bean
    public JwtAccessTokenConverter jwtAccessTokenConverter(){
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey("merryyou");
        return converter;
    }
}