如何创建用于测试Java OAuth 2.0服务器的模拟OpenID Connect提供商？

方案选择：Spring Authorization Server #

这是Spring官方推出的OAuth 2.0授权服务器实现，完全基于Java Spring技术栈，和你的Spring Boot项目无缝兼容，适合本地搭建测试，无需依赖外部平台。

步骤1：创建Spring Boot项目并引入依赖 #

在pom.xml（Maven）中添加以下依赖：

<dependencies>
    <!-- OAuth2授权服务器核心依赖 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-authorization-server</artifactId>
    </dependency>
    <!-- Web依赖，用于提供HTTP端点 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <!-- Spring Security核心依赖 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
</dependencies>

步骤2：配置授权服务器核心组件 #

创建配置类AuthorizationServerConfig，定义客户端信息、授权流程、令牌配置等：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
import org.springframework.security.oauth2.core.oidc.OidcScopes;

@Configuration
@EnableWebSecurity
public class AuthorizationServerConfig {

    // 配置授权服务器安全过滤链
    @Bean
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
                .oidc(oidc -> oidc.enabled(true)); // 启用OpenID Connect（可选，用于身份认证）
        http.formLogin(form -> form.loginPage("/login")); // 配置登录页面，用于用户认证
        return http.build();
    }

    // 配置客户端信息（模拟你的业务Spring Boot服务作为客户端）
    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        RegisteredClient testClient = RegisteredClient.withId("test-client-id")
                .clientId("test-client")
                .clientSecret(passwordEncoder().encode("test-secret"))
                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
                .redirectUri("http://localhost:8081/login/oauth2/code/test-client") // 你的业务服务回调地址
                .scope(OidcScopes.OPENID)
                .scope(OidcScopes.PROFILE)
                .build();
        return new InMemoryRegisteredClientRepository(testClient);
    }

    // 配置测试用户（内存存储，快速测试用）
    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails testUser = User.withUsername("test-user")
                .password(passwordEncoder().encode("test-password"))
                .roles("USER")
                .build();
        return new InMemoryUserDetailsManager(testUser);
    }

    // 密码加密器
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // 授权服务器基础设置
    @Bean
    public AuthorizationServerSettings authorizationServerSettings() {
        return AuthorizationServerSettings.builder().build();
    }
}

步骤3：理解OAuth 2.0核心流程（授权码模式） #

模拟服务器启动后，按以下流程测试：

• 获取授权码：访问授权端点 http://localhost:8080/oauth2/authorize?response_type=code&client_id=test-client&redirect_uri=http://localhost:8081/login/oauth2/code/test-client&scope=openid，输入测试账号密码（test-user/test-password），授权后会跳转到回调地址并携带授权码code。
• 交换令牌：向令牌端点http://localhost:8080/oauth2/token发送POST请求，参数包括grant_type=authorization_code、code=授权码、redirect_uri=回调地址、client_id=test-client、client_secret=test-secret，会返回访问令牌access_token和刷新令牌refresh_token。
• 获取用户信息：携带access_token向用户信息端点http://localhost:8080/userinfo发送GET请求，即可获取用户身份信息。

步骤4：配置你的业务Spring Boot客户端 #

在业务服务中添加OAuth2客户端依赖，并配置application.yml：

spring:
  security:
    oauth2:
      client:
        registration:
          test-client:
            client-id: test-client
            client-secret: test-secret
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/test-client"
            scope: openid, profile
        provider:
          test-client:
            issuer-uri: http://localhost:8080

其他可选方案 #

如果需要更复杂的功能（如角色管理、多租户），可以考虑使用Keycloak（Java编写的开源身份管理系统），但Spring Authorization Server更轻量，适合快速验证OAuth2.0协议流程。

内容的提问来源于stack exchange，提问作者MiguelMunoz