Spring Security实现分布式系统授权

1234567891011121314151617181920212223

spring: application: name: distributed-discoveryserver: port: 53000 #启动端口eureka: server: enable-self-preservation: false #关闭服务器自我保护，客户端心跳检测15分钟内错误达到80%服务会保护，导致别人还认为是好用的服务 eviction-interval-timer-in-ms: 10000 #清理间隔（单位毫秒，默认是60*1000）5秒将客户端剔除的服务在服务注册列表中剔除# shouldUseReadOnlyResponseCache: true #eureka是CAP理论种基于AP策略，为了保证强一致性关闭此切换CP 默认不关闭 false关闭 client: register-with-eureka: false #false:不作为一个客户端注册到注册中心 fetch-registry: false #为true时，可以启动，但报异常：Cannot execute request on any known server instance-info-replication-interval-seconds: 10 serviceUrl: defaultZone: http://localhost:${server.port}/eureka/ instance: hostname: ${spring.cloud.client.ip-address} prefer-ip-address: true instance-id: ${spring.application.name}:${spring.cloud.client.ip-address}:${spring.application.instance_id:${server.port}}

12345

zuul.routes.uaa-service.stripPrefix = falsezuul.routes.uaa-service.path = /uaa/**zuul.routes.order-service.stripPrefix = falsezuul.routes.order-service.path = /order/**

123456789101112131415161718

@Configurationpublic class TokenConfig { private String SIGNING_KEY = "uaa123"; @Bean public TokenStore tokenStore() { //JWT令牌存储方案 return new JwtTokenStore(accessTokenConverter()); } @Bean public JwtAccessTokenConverter accessTokenConverter() { JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); converter.setSigningKey(SIGNING_KEY); //对称秘钥，资源服务器使用该秘钥来验证 return converter; }}

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748

@Configurationpublic class ResouceServerConfig { public static final String RESOURCE_ID = "res1"; //uaa资源服务配置 @Configuration @EnableResourceServer public class UAAServerConfig extends ResourceServerConfigurerAdapter { @Autowired private TokenStore tokenStore; @Override public void configure(ResourceServerSecurityConfigurer resources){ resources.tokenStore(tokenStore).resourceId(RESOURCE_ID) .stateless(true); } @Override public void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/uaa/**").permitAll(); } } //order资源服务配置 @Configuration @EnableResourceServer public class OrderServerConfig extends ResourceServerConfigurerAdapter { @Autowired private TokenStore tokenStore; @Override public void configure(ResourceServerSecurityConfigurer resources){ resources.tokenStore(tokenStore).resourceId(RESOURCE_ID) .stateless(true); } @Override public void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/order/**").access("#oauth2.hasScope('ROLE_API')"); } } //配置其它的资源服务..}

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556

public class AuthFilter extends ZuulFilter { @Override public boolean shouldFilter() { return true; } @Override public String filterType() { return "pre"; } @Override public int filterOrder() { return 0; } @Override public Object run() throws ZuulException { /** * 1.获取令牌内容 */ RequestContext ctx = RequestContext.getCurrentContext(); //从安全上下文中拿到用户身份对象 Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); //无token访问网关内资源的情况，目前仅有uua服务直接暴露 if (!(authentication instanceof OAuth2Authentication)) { return null; } OAuth2Authentication oAuth2Authentication = (OAuth2Authentication) authentication; Authentication userAuthentication = oAuth2Authentication.getUserAuthentication(); //取出用户身份信息 String principal = userAuthentication.getName(); /** * 2.组装明文token，转发给微服务，放入header，名称为json‐token */ //取出用户权限 List<String> authorities = new ArrayList<>(); //从userAuthentication取出权限，放在authorities userAuthentication.getAuthorities().stream().forEach(c -> authorities.add(((GrantedAuthority) c).getAuthority())); OAuth2Request oAuth2Request = oAuth2Authentication.getOAuth2Request(); Map<String, String> requestParameters = oAuth2Request.getRequestParameters(); Map<String, Object> jsonToken = new HashMap<>(requestParameters); if (userAuthentication != null) { jsonToken.put("principal", principal); jsonToken.put("authorities", authorities); } //把身份信息和权限信息放在json中，加入http的header中,转发给微服务 ctx.addZuulRequestHeader("json-token", EncryptUtil.encodeUTF8StringBase64(JSON.toJSONString(jsonToken))); return null; }}

123456789101112131415161718192021222324

@Configurationpublic class ZuulConfig { @Bean public AuthFilter preFilter() { return new AuthFilter(); } @Bean public FilterRegistrationBean corsFilter() { final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); final CorsConfiguration config = new CorsConfiguration(); config.setAllowCredentials(true); config.addAllowedOrigin("*"); config.addAllowedHeader("*"); config.addAllowedMethod("*"); config.setMaxAge(18000L); source.registerCorsConfiguration("/**", config); CorsFilter corsFilter = new CorsFilter(source); FilterRegistrationBean bean = new FilterRegistrationBean(corsFilter); bean.setOrder(Ordered.HIGHEST_PRECEDENCE); return bean; }}

123456789101112131415161718192021

@PreAuthorize("hasAuthority('p1')")@GetMapping(value = "/r1")public String r1() { UserDTO user = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal(); return user.getUsername() + "访问资源1";}@PreAuthorize("hasAuthority('p2')")@GetMapping(value = "/r2")public String r2() { //通过Spring Security API获取当前登录用户 UserDTO user = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal(); return user.getUsername() + "访问资源2";}@GetMapping(value = "/r3")public String r3() { //通过Spring Security API获取当前登录用户 UserDTO user = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal(); return user.getUsername() + "访问资源3";}

123456789101112131415161718192021222324252627

@Configuration@EnableResourceServerpublic class ResouceServerConfig extends ResourceServerConfigurerAdapter { public static final String RESOURCE_ID = "res1"; @Autowired TokenStore tokenStore; @Override public void configure(ResourceServerSecurityConfigurer resources) { resources.resourceId(RESOURCE_ID)//资源 id //.tokenServices(tokenService())//验证令牌的服务 .tokenStore(tokenStore) .stateless(true); resources.authenticationEntryPoint(new SimpleAuthenticationEntryPoint()); resources.accessDeniedHandler(new SimpleAccessDeniedHandler()); } @Override public void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/**").access("#oauth2.hasScope('ROLE_ADMIN')") .and().csrf().disable() .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); }}

1234567891011121314151617181920212223242526

@Componentpublic class TokenAuthenticationFilter extends OncePerRequestFilter { @Override protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException { //1.解析出头中的token String token = httpServletRequest.getHeader("json-token"); if (token != null) { String json = EncryptUtil.decodeUTF8StringBase64(token); //将token转成json对象 JSONObject jsonObject = JSON.parseObject(json); //用户身份信息 UserDTO userDTO = JSON.parseObject(jsonObject.getString("principal"), UserDTO.class); //用户权限 JSONArray authoritiesArray = jsonObject.getJSONArray("authorities"); String[] authorities = authoritiesArray.toArray(new String[authoritiesArray.size()]); //2.新建并填充authentication UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDTO, null, AuthorityUtils.createAuthorityList(authorities)); authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpServletRequest)); //3.将authenticationToken填充到安全上下文 SecurityContextHolder.getContext().setAuthentication(authenticationToken); } filterChain.doFilter(httpServletRequest, httpServletResponse); }}

1

UserDTO user = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();

1234567891011121314151617181920212223242526

@Servicepublic class SpringDataUserDetailsService implements UserDetailsService { @Autowired UserDao userDao; //根据账号查询用户信息 @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { //连接数据库根据账号查询用户信息 UserDto userDto = userDao.getUserByUsername(username); if(userDto == null){ //如果用户查不到，返回null，由provider来抛出异常 return null; } //根据用户的id查询用户的权限 List<String> permissions = userDao.findPermissionsByUserId(userDto.getId()); //将permissions转成数组 String[] permissionArray = new String[permissions.size()]; permissions.toArray(permissionArray); //将userDto转成json String principal = JSON.toJSONString(userDto); UserDetails userDetails = User.withUsername(principal).password(userDto.getPassword()).authorities(permissionArray).build(); return userDetails; }}

12345

Authentication userAuthentication = oAuth2Authentication.getUserAuthentication();//取出用户身份信息，UserDto的JSON字符串String principal = userAuthentication.getName();...jsonToken.put("principal", principal);

123456789

//用户身份信息UserDTO userDTO = JSON.parseObject(jsonObject.getString("principal"), UserDTO.class);//用户权限JSONArray authoritiesArray = jsonObject.getJSONArray("authorities");String[] authorities = authoritiesArray.toArray(new String[authoritiesArray.size()]);//将用户信息和权限填充 到用户身份token对象中UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDTO, null, AuthorityUtils.createAuthorityList(authorities));authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpServletRequest));