devbox
煮酒与君饮
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Gateway+Springsecurity+OAuth2.0+JWT 实现分布式统一认证授权！_spring cloud gateway + spring security oauth2 + jw

作者：煮酒与君饮 | 2024-06-23 05:48:50

赞

踩

spring cloud gateway + spring security oauth2 + jwt

目录

1. OAuth2.0授权服务

2. 资源服务

3. Gateway网关

4. 测试

 

在SpringSecurity+OAuth2.0 搭建认证中心和资源服务中心-CSDN博客 ​​​​​​

基础上整合网关和JWT实现分布式统一认证授权。

 

大致流程如下：

1、客户端发出请求给网关获取令牌

2、网关收到请求，直接转发给授权服务

3、授权服务验证用户名、密码等一系列身份，通过则颁发令牌给客户端

4、客户端携带令牌请求资源，请求直接到了网关层

5、网关对令牌进行校验（验签、过期时间校验....）、鉴权（对当前令牌携带的权限）和访问资源所需的权限进行比对，如果权限有交集则通过校验，直接转发给微服务

6、微服务进行逻辑处理

1. OAuth2.0授权服务

导入依赖

  1. <dependencies>
  2.         <dependency>
  3.             <groupId>org.springframework.boot</groupId>
  4.             <artifactId>spring-boot-starter-web</artifactId>
  5.         </dependency>
  6.         <dependency>
  7.             <groupId>org.springframework.cloud</groupId>
  8.             <artifactId>spring-cloud-starter-security</artifactId>
  9.             <version>2.2.5.RELEASE</version>
  10.         </dependency>
  11.         <dependency>
  12.             <groupId>org.springframework.cloud</groupId>
  13.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  14.             <version>2.2.5.RELEASE</version>
  15.         </dependency>
  16.         <dependency>
  17.             <groupId>mysql</groupId>
  18.             <artifactId>mysql-connector-java</artifactId>
  19.             <version>8.0.28</version>
  20.         </dependency>
  21.         <dependency>
  22.             <groupId>com.baomidou</groupId>
  23.             <artifactId>mybatis-plus-boot-starter</artifactId>
  24.             <version>3.3.2</version>
  25.         </dependency>
  26.         <dependency>
  27.             <groupId>org.springframework.security</groupId>
  28.             <artifactId>spring-security-oauth2-resource-server</artifactId>
  29.         </dependency>
  30.         <dependency>
  31.             <groupId>org.projectlombok</groupId>
  32.             <artifactId>lombok</artifactId>
  33.             <version>1.18.30</version>
  34.         </dependency>
  35.         <dependency>
  36.             <groupId>org.springframework.boot</groupId>
  37.             <artifactId>spring-boot-starter-test</artifactId>
  38.         </dependency>
  39.         <dependency>
  40.             <groupId>com.alibaba.cloud</groupId>
  41.             <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
  42.         </dependency>
  43.     </dependencies>

application.yaml

  1. server:
  2.   port: 8080
  3. spring:
  4.   application:
  5.     name: oauth2-cloud-auth-server
  6.   cloud:
  7.     nacos:
  8.       ## 注册中心配置
  9.       discovery:
  10.         # nacos的服务地址，nacos-server中IP地址:端口号
  11.         server-addr: 127.0.0.1:8848
  12.   datasource:
  13.     driver-class-name: com.mysql.cj.jdbc.Driver
  14.     url: jdbc:mysql://localhost:3306/rbac?useUnicode=true&characterEncoding=UTF-8&serverTimezone=UTC
  15.     username: root
  16.     password: 123456

 这里展示部分代码

AccessTokenConfig类

  1. /**
  2.  * 令牌的配置
  3.  */
  4. @Configuration
  5. public class AccessTokenConfig {
  6.     /**
  7.      * JWT的秘钥
  8.      * TODO 实际项目中需要统一配置到配置文件中，资源服务也需要用到
  9.      */
  10.     private final static String SIGN_KEY="jwt";
  11.  
  12.     /**
  13.      * 令牌的存储策略
  14.      */
  15.     @Bean
  16.     public TokenStore tokenStore() {
  17.         //使用JwtTokenStore生成JWT令牌
  18.         return new JwtTokenStore(jwtAccessTokenConverter());
  19.     }
  20.  
  21.     /**
  22.      * JwtAccessTokenConverter
  23.      * TokenEnhancer的子类，在JWT编码的令牌值和OAuth身份验证信息之间进行转换。
  24.      * TODO：后期可以使用非对称加密
  25.      */
  26.     @Bean
  27.     public JwtAccessTokenConverter jwtAccessTokenConverter(){
  28.         JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  29.         // 设置秘钥
  30.         converter.setSigningKey(SIGN_KEY);
  31.         return converter;
  32.     }
  33.  
  34.     @Bean
  35.     PasswordEncoder passwordEncoder() {
  36.         return new BCryptPasswordEncoder();
  37.     }
  38. }

MyAuthorizationConfig类

  1. @Configuration
  2. @EnableAuthorizationServer
  3. public class MyAuthorizationConfig extends AuthorizationServerConfigurerAdapter {
  4.  
  5.    @Autowired
  6.    private TokenStore tokenStore;
  7.     /**
  8.      * 客户端存储策略，这里使用内存方式，后续可以存储在数据库
  9.      */
  10.     @Autowired
  11.     private ClientDetailsService clientDetailsService;
  12.  
  13.     /**
  14.      * Security的认证管理器，密码模式需要用到
  15.      */
  16.     @Autowired
  17.     private AuthenticationManager authenticationManager;
  18.  
  19.     @Autowired
  20.     private JwtAccessTokenConverter jwtAccessTokenConverter;
  21.  
  22.     /**
  23.      * 配置令牌访问的安全约束
  24.      */
  25.     @Override
  26.     public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
  27.         security
  28.                 //开启/oauth/token_key验证端口权限访问
  29.                 .tokenKeyAccess("permitAll()")
  30.                 //开启/oauth/check_token验证端口认证权限访问
  31.                 .checkTokenAccess("permitAll()")
  32.                 //表示支持 client_id 和 client_secret 做登录认证
  33.                 .allowFormAuthenticationForClients();
  34.     }
  35.     //配置客户端
  36.     @Override
  37.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  38.         //内存模式
  39.         clients.inMemory()
  40.                 //客户端id
  41.                 .withClient("test")
  42.                 //客户端秘钥
  43.                 .secret(new BCryptPasswordEncoder().encode("123456"))
  44.                 //资源id，唯一，比如订单服务作为一个资源,可以设置多个
  45.                 .resourceIds("order")
  46.                 //授权模式，总共四种，1. authorization_code（授权码模式）、password（密码模式）、client_credentials（客户端模式）、implicit（简化模式）
  47.                 //refresh_token并不是授权模式，
  48.                 .authorizedGrantTypes("authorization_code","password","client_credentials","implicit","refresh_token")
  49.                 //允许的授权范围，客户端的权限，这里的all只是一种标识，可以自定义，为了后续的资源服务进行权限控制
  50.                 .scopes("all")
  51.                 //false 则跳转到授权页面
  52.                 .autoApprove(false)
  53.                 //授权码模式的回调地址
  54.                 .redirectUris("http://www.baidu.com"); //可以and继续添加客户端
  55.     }
  56.  
  57.  
  58.     @Bean
  59.     public AuthorizationServerTokenServices tokenServices() {
  60.         DefaultTokenServices services = new DefaultTokenServices();
  61.         //客户端端配置策略
  62.         services.setClientDetailsService(clientDetailsService);
  63.         //支持令牌的刷新
  64.         services.setSupportRefreshToken(true);
  65.         //令牌服务
  66.         services.setTokenStore(tokenStore);
  67.         //access_token的过期时间
  68.         services.setAccessTokenValiditySeconds(60 * 60 * 2);
  69.         //refresh_token的过期时间
  70.         services.setRefreshTokenValiditySeconds(60 * 60 * 24 * 3);
  71.  
  72.         //设置令牌增强，使用jwt
  73.         services.setTokenEnhancer(jwtAccessTokenConverter);
  74.         return services;
  75.     }
  76.     /**
  77.      * 授权码模式的service，使用授权码模式authorization_code必须注入
  78.      */
  79.     @Bean
  80.     public AuthorizationCodeServices authorizationCodeServices() {
  81.         //授权码存在内存中
  82.         return new InMemoryAuthorizationCodeServices();
  83.     }
  84.  
  85.     /**
  86.      * 配置令牌访问的端点
  87.      */
  88.     @Override
  89.     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  90.         endpoints
  91.                 //授权码模式所需要的authorizationCodeServices
  92.                 .authorizationCodeServices(authorizationCodeServices())
  93.                 //密码模式所需要的authenticationManager
  94.                 .authenticationManager(authenticationManager)
  95.                 //令牌管理服务，无论哪种模式都需要
  96.                 .tokenServices(tokenServices())
  97.                 //只允许POST提交访问令牌，uri：/oauth/token
  98.                 .allowedTokenEndpointRequestMethods(HttpMethod.POST);
  99.     }
  100. }

SecurityConfig类

  1. /**
  2.  * spring security的安全配置
  3.  */
  4. @Configuration
  5. @EnableWebSecurity
  6. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  7.  
  8.     /**
  9.      * 加密算法
  10.      */
  11.  
  12.     @Autowired
  13.     JwtTokenUserDetailsService userDetailsService;
  14.  
  15.     @Override
  16.     protected void configure(HttpSecurity http) throws Exception {
  17.         //todo 允许表单登录
  18.         http.authorizeRequests()
  19.                 .anyRequest().authenticated()
  20.                 .and()
  21.                 .formLogin()
  22.                 .loginProcessingUrl("/login")
  23.                 .permitAll()
  24.                 .and()
  25.                 .csrf()
  26.                 .disable();
  27.     }
  28.  
  29.     @Override
  30.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  31.        //从数据库中查询用户信息
  32.         auth.userDetailsService(userDetailsService);
  33.     }
  34.  
  35.  
  36.  
  37.     /**
  38.      * AuthenticationManager对象在OAuth2认证服务中要使用，提前放入IOC容器中
  39.      * Oauth的密码模式需要
  40.      */
  41.     @Override
  42.     @Bean
  43.     public AuthenticationManager authenticationManagerBean() throws Exception {
  44.         return super.authenticationManagerBean();
  45.     }
  46. }

2. 资源服务

导入依赖

  1.   <dependency>
  2.             <groupId>org.springframework.boot</groupId>
  3.             <artifactId>spring-boot-starter-web</artifactId>
  4.         </dependency>
  5.         <dependency>
  6.         <groupId>cn.hutool</groupId>
  7.         <artifactId>hutool-all</artifactId>
  8.        </dependency>
  9.         <dependency>
  10.             <groupId>com.alibaba</groupId>
  11.             <artifactId>fastjson</artifactId>
  12.             <version>1.2.78</version>
  13.         </dependency>
  14.         <dependency>
  15.             <groupId>org.projectlombok</groupId>
  16.             <artifactId>lombok</artifactId>
  17.             <version>1.18.30</version>
  18.         </dependency>
  19.         <dependency>
  20.             <groupId>com.alibaba.cloud</groupId>
  21.             <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
  22.         </dependency>

application.yaml

  1. server:
  2.   port: 8081
  3. spring:
  4.   application:
  5.     name: oauth2-cloud-service
  6.   cloud:
  7.     nacos:
  8.       ## 注册中心配置
  9.       discovery:
  10.         # nacos的服务地址，nacos-server中IP地址:端口号
  11.         server-addr: 127.0.0.1:8848

 AuthenticationFilter类

  1. @Component
  2. public class AuthenticationFilter extends OncePerRequestFilter {
  3.     /**
  4.      * 具体方法主要分为两步
  5.      * 1. 解密网关传递的信息
  6.      * 2. 将解密之后的信息封装放入到request中
  7.      */
  8.     @Override
  9.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
  10.         //获取请求头中的用户信息
  11.         String token = request.getHeader("token");
  12.         if (token!=null){
  13.             //解密
  14.             String json = Base64.decodeStr(token);
  15.             JSONObject jsonObject = JSON.parseObject(json);
  16.             //获取用户身份信息、权限信息
  17.             String principal = jsonObject.getString("user_name");
  18.             JSONArray tempJsonArray = jsonObject.getJSONArray("authorities");
  19.             //权限
  20.             String[] authorities =  tempJsonArray.toArray(new String[0]);
  21.             //放入LoginVal
  22.             LoginVal loginVal = new LoginVal();
  23.           
  24.             loginVal.setUsername(principal);
  25.             loginVal.setAuthorities(authorities);
  26.             
  27.             //放入request的attribute中
  28.             request.setAttribute("login_message",loginVal);
  29.         }
  30.         filterChain.doFilter(request,response);
  31.     }
  32. }

ServiceController类

  1. @RestController
  2. public class ServiceController {
  3.  
  4.     @RequestMapping("/test")
  5.     public LoginVal test(HttpServletRequest httpServletRequest){
  6.        return  (LoginVal)httpServletRequest.getAttribute("login_message");
  7.     }
  8. }

3. Gateway网关

导入依赖

  1.  <dependencies>
  2.         <dependency>
  3.             <groupId>org.springframework.cloud</groupId>
  4.             <artifactId>spring-cloud-starter-gateway</artifactId>
  5.         </dependency>
  6.         <dependency>
  7.             <groupId>org.springframework.cloud</groupId>
  8.             <artifactId>spring-cloud-starter-security</artifactId>
  9.             <version>2.2.5.RELEASE</version>
  10.         </dependency>
  11.         <dependency>
  12.             <groupId>org.springframework.cloud</groupId>
  13.             <artifactId>spring-cloud-starter-oauth2</artifactId>
  14.             <version>2.2.5.RELEASE</version>
  15.         </dependency>
  16.         <dependency>
  17.             <groupId>org.springframework.security</groupId>
  18.             <artifactId>spring-security-oauth2-resource-server</artifactId>
  19.         </dependency>
  20.         <dependency>
  21.             <groupId>com.alibaba.cloud</groupId>
  22.             <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>org.projectlombok</groupId>
  26.             <artifactId>lombok</artifactId>
  27.         </dependency>
  28.         <dependency>
  29.             <groupId>cn.hutool</groupId>
  30.             <artifactId>hutool-all</artifactId>
  31.         </dependency>
  32.         <dependency>
  33.             <groupId>com.alibaba</groupId>
  34.             <artifactId>fastjson</artifactId>
  35.             <version>1.2.78</version>
  36.         </dependency>
  37.         <dependency>
  38.             <groupId>org.springframework.cloud</groupId>
  39.             <artifactId>spring-cloud-starter-loadbalancer</artifactId>
  40.         </dependency>
  41.     </dependencies>

application.yaml

  1. server:
  2.   port: 7000
  3. spring:
  4.   main:
  5.     allow-bean-definition-overriding: true
  6.   application:
  7.     name: oauth2-cloud-gateway
  8.   cloud:
  9.     nacos:
  10.       ## 注册中心配置
  11.       discovery:
  12.         # nacos的服务地址，nacos-server中IP地址:端口号
  13.         server-addr: 127.0.0.1:8848
  14.     gateway:
  15.       ## 路由
  16.       routes:
  17.         ## id只要唯一即可，名称任意
  18.         - id: oauth2-cloud-auth-server
  19.           uri: lb://oauth2-cloud-auth-server
  20.           predicates:
  21.             ## Path Route Predicate Factory断言
  22.             - Path=/oauth/**
  23.         - id: oauth2-cloud-order
  24.           uri: lb://oauth2-cloud-service
  25.           predicates:
  26.             ## Path Route Predicate Factory断言
  27.             - Path=/test/**
  29. oauth2:
  30.   cloud:
  31.     sys:
  32.       parameter:
  33.         ignoreUrls:
  34.           - /oauth/token
  35.           - /oauth/authorize

 AccessTokenConfig类

  1. /**
  2.  * 令牌的配置
  3.  */
  4. @Configuration
  5. public class AccessTokenConfig {
  6.     private final static String SIGN_KEY="jwt";
  7.  
  8.     /**
  9.      * 令牌的存储策略
  10.      */
  11.     @Bean
  12.     public TokenStore tokenStore() {
  13.         //使用JwtTokenStore生成JWT令牌
  14.         return new JwtTokenStore(jwtAccessTokenConverter());
  15.     }
  16.  
  17.     /**
  18.      * JwtAccessTokenConverter
  19.      * TokenEnhancer的子类，在JWT编码的令牌值和OAuth身份验证信息之间进行转换。
  20.      * TODO：后期可以使用非对称加密
  21.      */
  22.     @Bean
  23.     public JwtAccessTokenConverter jwtAccessTokenConverter(){
  24.         JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  25.         // 设置秘钥
  26.         converter.setSigningKey(SIGN_KEY);
  27.         return converter;
  28.     }
  29. }

JwtAccessManager类

  1. @Slf4j
  2. @Component
  3. //经过认证管理器JwtAuthenticationManager认证成功后，就需要对令牌进行鉴权，如果该令牌无访问资源的权限，则不允通过。
  4. public class JwtAccessManager implements ReactiveAuthorizationManager<AuthorizationContext> {
  5.  
  6.  
  7.  
  8.     @Override
  9.     public Mono<AuthorizationDecision> check(Mono<Authentication> mono, AuthorizationContext authorizationContext) {
  10.  
  11.         URI uri = authorizationContext.getExchange().getRequest().getURI();
  12.         //设计权限角色，这里简单写一下，实际上应该从数据库或者缓存中获取
  13.         List<String> authorities = new ArrayList<>();
  14.         authorities.add("ROLE_admin");
  15.         //认证通过且角色匹配的用户可访问当前路径
  16.         return mono
  17.                 //判断是否认证成功
  18.                 .filter(Authentication::isAuthenticated)
  19.                 //获取认证后的全部权限
  20.                 .flatMapIterable(Authentication::getAuthorities)
  21.                 .map(GrantedAuthority::getAuthority)
  22.                 //如果权限包含则判断为true
  23.                 .any(authorities::contains)
  24.                 .map(AuthorizationDecision::new)
  25.                 .defaultIfEmpty(new AuthorizationDecision(false));
  26.     }
  27.  
  28. }

JwtAuthenticationManager类

  1. /**
  2.  * JWT认证管理器，主要的作用就是对携带过来的token进行校验，比如过期时间，加密方式等
  3.  * 一旦token校验通过，则交给鉴权管理器进行鉴权
  4.  */
  5. @Component
  6. public class JwtAuthenticationManager implements ReactiveAuthenticationManager {
  7.     /**
  8.      * 使用JWT令牌进行解析令牌
  9.      */
  10.     @Autowired
  11.     private TokenStore tokenStore;
  12.  
  13.     @Override
  14.     public Mono<Authentication> authenticate(Authentication authentication) {
  15.         return Mono.justOrEmpty(authentication)
  16.                 .filter(a -> a instanceof BearerTokenAuthenticationToken)
  17.                 .cast(BearerTokenAuthenticationToken.class)
  18.                 .map(BearerTokenAuthenticationToken::getToken)
  19.                 .flatMap((accessToken -> {
  20.                     OAuth2AccessToken oAuth2AccessToken = this.tokenStore.readAccessToken(accessToken);
  21.                     //根据access_token从数据库获取不到OAuth2AccessToken
  22.                     if (oAuth2AccessToken == null) {
  23.                         return Mono.error(new InvalidTokenException("无效的token！"));
  24.                     } else if (oAuth2AccessToken.isExpired()) {
  25.                         return Mono.error(new InvalidTokenException("token已过期！"));
  26.                     }
  27.                     OAuth2Authentication oAuth2Authentication = this.tokenStore.readAuthentication(accessToken);
  28.                     if (oAuth2Authentication == null) {
  29.                         return Mono.error(new InvalidTokenException("无效的token！"));
  30.                     } else {
  31.                         return Mono.just(oAuth2Authentication);
  32.                     }
  33.                 })).cast(Authentication.class);
  34.     }
  35. }

SecurityConfig类

  1. @Configuration
  2. @EnableWebFluxSecurity
  3. public class SecurityConfig {
  4.  
  5.     /**
  6.      * JWT的鉴权管理器
  7.      */
  8.     @Autowired
  9.     private ReactiveAuthorizationManager<AuthorizationContext> accessManager;
  10.  
  11.     @Autowired
  12.     private RequestAuthenticationEntryPoint requestAuthenticationEntryPoint;
  13.  
  14.     @Autowired
  15.     private RequestAccessDeniedHandler requestAccessDeniedHandler;
  16.  
  17.     /**
  18.      * 系统参数配置
  19.      */
  20.     @Autowired
  21.     private SysParameterConfig sysConfig;
  22.  
  23.     /**
  24.      * token校验管理器
  25.      */
  26.     @Autowired
  27.     private ReactiveAuthenticationManager tokenAuthenticationManager;
  28.  
  29.     @Autowired
  30.     private CorsFilter corsFilter;
  31.  
  32.     @Bean
  33.     SecurityWebFilterChain webFluxSecurityFilterChain(ServerHttpSecurity http) throws Exception{
  34.         //认证过滤器，放入认证管理器tokenAuthenticationManager
  35.         AuthenticationWebFilter authenticationWebFilter = new AuthenticationWebFilter(tokenAuthenticationManager);
  36.         authenticationWebFilter.setServerAuthenticationConverter(new ServerBearerTokenAuthenticationConverter());
  37.  
  38.         http
  39.                 .httpBasic().disable()
  40.                 .csrf().disable()
  41.                 .authorizeExchange()
  42.                 //白名单直接放行
  43.                 .pathMatchers(ArrayUtil.toArray(sysConfig.getIgnoreUrls(),String.class)).permitAll()
  44.                 //其他的请求必须鉴权，使用鉴权管理器
  45.                 .anyExchange().access(accessManager)
  46.                 //异常处理
  47.                 .and().exceptionHandling()
  48.                 .authenticationEntryPoint(requestAuthenticationEntryPoint)
  49.                 .accessDeniedHandler(requestAccessDeniedHandler)
  50.                 .and()
  51.                 // 跨域过滤器
  52.                 .addFilterAt(corsFilter, SecurityWebFiltersOrder.CORS)
  53.                 //token的认证过滤器，用于校验token和认证
  54.                 .addFilterAt(authenticationWebFilter, SecurityWebFiltersOrder.AUTHENTICATION);
  55.         return http.build();
  56.     }
  57. }

RequestAccessDeniedHandler

  1. /**
  3.  * 自定义返回结果：没有权限访问时
  4.  */
  5. @Component
  6. public class RequestAccessDeniedHandler implements ServerAccessDeniedHandler {
  7.     @Override
  8.     public Mono<Void> handle(ServerWebExchange exchange, AccessDeniedException denied) {
  9.         ServerHttpResponse response = exchange.getResponse();
  10.         response.setStatusCode(HttpStatus.OK);
  11.         response.getHeaders().add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE);
  12.         String body= JSONUtil.toJsonStr(new ResultMsg(1005,"无权限访问",null));
  13.         DataBuffer buffer =  response.bufferFactory().wrap(body.getBytes(Charset.forName("UTF-8")));
  14.         return response.writeWith(Mono.just(buffer));
  15.     }
  16. }

GlobalAuthenticationFilter

  1. /**
  2.  * 全局过滤器，对token的拦截，解析token放入header中，便于下游微服务获取用户信息
  3.  * 分为如下几步：
  4.  *  1、白名单直接放行
  5.  *  2、校验token
  6.  *  3、读取token中存放的用户信息
  7.  *  4、重新封装用户信息，加密成功json数据放入请求头中传递给下游微服务
  8.  */
  9. @Component
  10. @Slf4j
  11. public class GlobalAuthenticationFilter implements GlobalFilter, Ordered {
  12.     /**
  13.      * JWT令牌的服务
  14.      */
  15.     @Autowired
  16.     private TokenStore tokenStore;
  17.  
  18.  
  19.  
  20.     /**
  21.      * 系统参数配置
  22.      */
  23.     @Autowired
  24.     private SysParameterConfig sysConfig;
  25.  
  26.  
  27.     @Override
  28.     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
  29.         String requestUrl = exchange.getRequest().getPath().value();
  30.         //1、白名单放行，比如授权服务、静态资源.....
  31.         if (checkUrls(sysConfig.getIgnoreUrls(),requestUrl)){
  32.             return chain.filter(exchange);
  33.         }
  34.  
  35.         //2、 检查token是否存在
  36.         String token = getToken(exchange);
  37.         if (StringUtils.isBlank(token)) {
  38.             return invalidTokenMono(exchange);
  39.         }
  40.  
  41.         //3 判断是否是有效的token
  42.         OAuth2AccessToken oAuth2AccessToken;
  43.         try {
  44.             //解析token，使用tokenStore
  45.             oAuth2AccessToken = tokenStore.readAccessToken(token);
  46.             Map<String, Object> additionalInformation = oAuth2AccessToken.getAdditionalInformation();
  47.             System.out.println(additionalInformation);
  48.  
  49.             //取出用户身份信息
  50.             String user_name = additionalInformation.get("user_name").toString();
  51.             //获取用户权限
  52.             List<String> authorities = (List<String>) additionalInformation.get("authorities");
  53.  
  54.             //将用户名和权限进行Base64加密
  55.             JSONObject jsonObject=new JSONObject();
  56.             jsonObject.put("user_name", user_name);
  57.             jsonObject.put("authorities",authorities);
  58.             String base = Base64.encode(jsonObject.toJSONString());
  59.  
  60.  
  61.            // ServerHttpRequest 中的 mutate 方法是用于创建一个修改后的请求对象的方法，而不改变原始请求对象。这个方法是为了在处理请求过程中创建一个新的请求对象，以便进行一些修改或增强。
  62.             ServerHttpRequest tokenRequest = exchange.getRequest().mutate().header("token",base).build();
  63.             ServerWebExchange build = exchange.mutate().request(tokenRequest).build();
  64.             return chain.filter(build);
  65.         } catch (InvalidTokenException e) {
  66.             //解析token异常，直接返回token无效
  67.             return invalidTokenMono(exchange);
  68.         }
  69.  
  70.  
  71.     }
  72.  
  73.     @Override
  74.     public int getOrder() {
  75.         return 0;
  76.     }
  77.  
  78.     /**
  79.      * 对url进行校验匹配
  80.      */
  81.     private boolean checkUrls(List<String> urls,String path){
  82.         AntPathMatcher pathMatcher = new AntPathMatcher();
  83.         for (String url : urls) {
  84.             if (pathMatcher.match(url,path))
  85.                 return true;
  86.         }
  87.         return false;
  88.     }
  89.  
  90.     /**
  91.      * 从请求头中获取Token
  92.      */
  93.     private String getToken(ServerWebExchange exchange) {
  94.         String tokenStr = exchange.getRequest().getHeaders().getFirst("Authorization");
  95.         if (StringUtils.isBlank(tokenStr)) {
  96.             return null;
  97.         }
  98.         String token = tokenStr.split(" ")[1];
  99.         if (StringUtils.isBlank(token)) {
  100.             return null;
  101.         }
  102.         return token;
  103.     }
  104.  
  105.     /**
  106.      * 无效的token
  107.      */
  108.     private Mono<Void> invalidTokenMono(ServerWebExchange exchange) {
  109.         return buildReturnMono(ResultMsg.builder()
  110.                 .code(1004)
  111.                 .msg("无效的token")
  112.                 .build(), exchange);
  113.     }
  114.  
  115.  
  116.     private Mono<Void> buildReturnMono(ResultMsg resultMsg, ServerWebExchange exchange) {
  117.         ServerHttpResponse response = exchange.getResponse();
  118.         byte[] bits = JSON.toJSONString(resultMsg).getBytes(StandardCharsets.UTF_8);
  119.         DataBuffer buffer = response.bufferFactory().wrap(bits);
  120.         response.setStatusCode(HttpStatus.UNAUTHORIZED);
  121.         response.getHeaders().add("Content-Type", "application/json;charset:utf-8");
  122.         return response.writeWith(Mono.just(buffer));
  123.     }
  124. }

SysParameterConfig

  1. @ConfigurationProperties(prefix = "oauth2.cloud.sys.parameter")
  2. @Data
  3. @Component
  4. public class SysParameterConfig {
  5.     /**
  6.      * 白名单
  7.      */
  8.     private List<String> ignoreUrls;
  9. }

4. 测试

 

代码链接：Gateway+Springsecurity+OAuth2.0+JWT实现分布式统一认证授权资源-CSDN文库 

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/煮酒与君饮/article/detail/748871
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号