InMemoryClientDetailsServiceBuilder builder = clients.inMemory();

builder
        // 构建一个 id 为 oauth2 的客户端
        .withClient("oauth2")
        // 设置她的密钥，加密后的
        .secret("$2a$10$wlgcx61faSJ8O5I4nLiovO9T36HBQgh4RhOQAYNORCzvANlInVlw2")
        // 设置允许访问的资源 id
        .resourceIds("oauth2")
        // 授权的类型
        .authorizedGrantTypes("password", "authorization_code", "refresh_token")
        // 可以授权的角色
        .authorities("ROLE_ADMIN", "ROLE_USER")
        // 授权的范围
        .scopes("all")
        // token 有效期
        .accessTokenValiditySeconds(Math.toIntExact(Duration.ofHours(1).getSeconds()))
        // 刷新 token 的有效期
        .refreshTokenValiditySeconds(Math.toIntExact(Duration.ofHours(1).getSeconds()))
        // 授权码模式的重定向地址
        .redirectUris("http://example.com");

package cn.echocow.oauth.authorization;

import org.junit.Test;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

/**
 * 获取加密后的密码
 *
 * @author <a href="https://echocow.cn">EchoCow</a>
 * @date 19-7-13 下午4:36
 */
public class PasswordTest {

    @Test
    public void password() {
        // 每次打印的结果都不一样，不影响
        System.out.println(new BCryptPasswordEncoder().encode("oauth2"));
    }

}

@Data
@Configuration
@ConfigurationProperties("application.security.oauth")
public class ClientDetails {
    private List<BaseClientDetails> client;
}

application:
  security:
    oauth:
      client[0]:
        registered-redirect-uri: http://example.com
        # 客户端 id
        client-id: client1
        # 客户端密钥
        client-secret: $2a$10$wlgcx61faSJ8O5I4nLiovO9T36HBQgh4RhOQAYNORCzvANlInVlw2
        # 授权范围
        scope: all
        # token 有效期
        access-token-validity-seconds: 6000
        # 刷新 token 的有效期
        refresh-token-validity-seconds: 6000
        # 允许的授权类型
        grant-type: authorization_code,password,refresh_token
        # 可以访问的资源 id
        resource-ids: oauth2
      client[1]:
        registered-redirect-uri: http://example.com
        # 客户端 id
        client-id: client2
        # 客户端密钥
        client-secret: $2a$10$wlgcx61faSJ8O5I4nLiovO9T36HBQgh4RhOQAYNORCzvANlInVlw2
        # 授权范围
        scope: all
        # token 有效期
        access-token-validity-seconds: 6000
        # 刷新 token 的有效期
        refresh-token-validity-seconds: 6000
        # 允许的授权类型
        grant-type: authorization_code,password,refresh_token
        # 可以访问的资源 id
        resource-ids: oauth2

private void configClient(ClientDetailsServiceConfigurer clients) throws Exception {
        InMemoryClientDetailsServiceBuilder builder = clients.inMemory();
        for (BaseClientDetails client : clientDetails.getClient()) {
            ClientDetailsServiceBuilder<InMemoryClientDetailsServiceBuilder>.ClientBuilder clientBuilder =
                    builder.withClient(client.getClientId());
            clientBuilder
                    .secret(client.getClientSecret())
                    .resourceIds(client.getResourceIds().toArray(new String[0]))
                    .authorizedGrantTypes(client.getAuthorizedGrantTypes().toArray(new String[0]))
                    .authorities(
                            AuthorityUtils.authorityListToSet(client.getAuthorities())
                                    .toArray(new String[0]))
                    .scopes(client.getScope().toArray(new String[0]));
            if (client.getAutoApproveScopes() != null) {
                clientBuilder.autoApprove(
                        client.getAutoApproveScopes().toArray(new String[0]));
            }
            if (client.getAccessTokenValiditySeconds() != null) {
                clientBuilder.accessTokenValiditySeconds(
                        client.getAccessTokenValiditySeconds());
            }
            if (client.getRefreshTokenValiditySeconds() != null) {
                clientBuilder.refreshTokenValiditySeconds(
                        client.getRefreshTokenValiditySeconds());
            }
            if (client.getRegisteredRedirectUri() != null) {
                clientBuilder.redirectUris(
                        client.getRegisteredRedirectUri().toArray(new String[0]));
            }
        }
    }

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.formLogin()
        // 登录页面名称，他会去寻找 resources 下的 resources 和 static 目录
        .loginPage("/login.html")
        // 登录表单提交的路径
        .loginProcessingUrl("/authorization/form")
        .and()
        // 关闭 csrf 防护，因为对于我们的所有请求来说，都是需要携带身份信息的
        .csrf().disable();
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.httpBasic();
}

@Data
@Configuration
@ConfigurationProperties("application.security.oauth")
public class SecurityProperties {

    /**
     * 登录请求的路径，默认值 /authorization/form
     */
    private String loginProcessingUrl = "/authorization/form";

}

private final @NonNull SecurityProperties securityProperties;
@Override
protected void configure(HttpSecurity http) throws Exception {

    //        静态登录页面的配置
    http.formLogin()
        // 登录页面名称，他会去寻找 resources 下的 resources 和 static 目录
        // 静态页面
        //.loginPage("/login.html")
        // 模板引擎
        .loginPage("/oauth/login")
        // 登录表单提交的路径
        // 静态页面
        // .loginProcessingUrl("/authorization/form")
        // 模板引擎
        .loginProcessingUrl(securityProperties.getLoginProcessingUrl());
    //                .and()
    // 关闭 csrf 防护，因为对于我们的所有请求来说，都是需要携带身份信息的
    //                .csrf().disable();

}

@Controller
@RequestMapping("/oauth")
@RequiredArgsConstructor
public class OauthController {

    private final @NonNull SecurityProperties securityProperties;

    @GetMapping("login")
    public String loginView(Model model) {
        model.addAttribute("action", securityProperties.getLoginProcessingUrl());
        return "form-login";
    }

}

@Controller
@SessionAttributes("authorizationRequest")  // 重要！
public class AuthorizationController {
    @RequestMapping("/oauth/confirm_access")
    public ModelAndView getAccessConfirmation(Map<String, Object> model, HttpServletRequest request) throws Exception {
        AuthorizationRequest authorizationRequest = (AuthorizationRequest) model.get("authorizationRequest");
        ModelAndView view = new ModelAndView();
        view.setViewName("authorization");
        view.addObject("clientId", authorizationRequest.getClientId());
        return view;
    }
}

http://localhost:8000/oauth/authorize?response_type=code&client_id=oauth2&redirect_uri=http://example.com≻ope=all

{
    "error" :"access_denied",
    "error_description" : "User denied access"
}

@Controller
@SessionAttributes("authorizationRequest")
public class AuthorizationController {
    @RequestMapping("/oauth/confirm_access")
    public ModelAndView getAccessConfirmation(Map<String, Object> model, HttpServletRequest request) throws Exception {
        AuthorizationRequest authorizationRequest = (AuthorizationRequest) model.get("authorizationRequest");
        ModelAndView view = new ModelAndView();
        view.setViewName("authorization");
        view.addObject("clientId", authorizationRequest.getClientId());
        // 传递 scope 过去,Set 集合
        view.addObject("scopes", authorizationRequest.getScope());
        // 拼接一下名字
        view.addObject("scopeName", String.join(",", authorizationRequest.getScope()));
        return view;
    }
}

<div class="wrap-input100 validate-input m-b-23">
    <input type="hidden" name="user_oauth_approval" value="true">
    <div style="display: none" th:each="scope : ${scopes}">
        <input type="hidden" th:name="'scope.' + ${scope}" value="true">
    </div>
    <input type="hidden" name="_csrf" th:value="${_csrf.token}"/>
</div>