/*** 用戶管理業務類* Created by macro on 2020/6/19.*/
@Service
public class UserServiceImpl implements UserDetailsService {private List<UserDTO> userList;@Autowiredprivate PasswordEncoder passwordEncoder;@PostConstructpublic void initData() {String password = passwordEncoder.encode("123456");userList = new ArrayList<>();userList.add(new UserDTO(1L,"macro", password,1, CollUtil.toList("ADMIN")));userList.add(new UserDTO(2L,"andy", password,1, CollUtil.toList("TEST")));}@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {List<UserDTO> findUserList = userList.stream().filter(item -> item.getUsername().equals(username)).collect(Collectors.toList());if (CollUtil.isEmpty(findUserList)) {throw new UsernameNotFoundException(MessageConstant.USERNAME_PASSWORD_ERROR);}SecurityUser securityUser = new SecurityUser(findUserList.get(0));if (!securityUser.isEnabled()) {throw new DisabledException(MessageConstant.ACCOUNT_DISABLED);} else if (!securityUser.isAccountNonLocked()) {throw new LockedException(MessageConstant.ACCOUNT_LOCKED);} else if (!securityUser.isAccountNonExpired()) {throw new AccountExpiredException(MessageConstant.ACCOUNT_EXPIRED);} else if (!securityUser.isCredentialsNonExpired()) {throw new CredentialsExpiredException(MessageConstant.CREDENTIALS_EXPIRED);}return securityUser;}}
/*** JWT內容增強器* Created by macro on 2020/6/19.*/
@Component
public class JwtTokenEnhancer implements TokenEnhancer {@Overridepublic OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {SecurityUser securityUser = (SecurityUser) authentication.getPrincipal();Map<String, Object> info = new HashMap<>();//把用戶ID設置到JWT中info.put("id", securityUser.getId());((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(info);return accessToken;}
}
由于我們的網關服務需要RSA的公鑰來驗證簽名是否合法，所以認證服務需要有個接口把公鑰暴露出來；
/*** 獲取RSA公鑰接口* Created by macro on 2020/6/19.*/
@RestController
public class KeyPairController {@Autowiredprivate KeyPair keyPair;@GetMapping("/rsa/publicKey")public Map<String, Object> getKey() {RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();RSAKey key = new RSAKey.Builder(publicKey).build();return new JWKSet(key).toJSONObject();}}
不要忘了還需要配置Spring Security，允許獲取公鑰接口的訪問；
/*** SpringSecurity配置* Created by macro on 2020/6/19.*/
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {@Overrideprotected void configure(HttpSecurity http) throws Exception {http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll().antMatchers("/rsa/publicKey").permitAll().anyRequest().authenticated();}@Bean@Overridepublic AuthenticationManager authenticationManagerBean() throws Exception {return super.authenticationManagerBean();}@Beanpublic PasswordEncoder passwordEncoder() {return new BCryptPasswordEncoder();}}
/*** 資源與角色匹配關系管理業務類* Created by macro on 2020/6/19.*/
@Service
public class ResourceServiceImpl {private Map<String, List<String>> resourceRolesMap;@Autowiredprivate RedisTemplate<String,Object> redisTemplate;@PostConstructpublic void initData() {resourceRolesMap = new TreeMap<>();resourceRolesMap.put("/api/hello", CollUtil.toList("ADMIN"));resourceRolesMap.put("/api/user/currentUser", CollUtil.toList("ADMIN", "TEST"));redisTemplate.opsForHash().putAll(RedisConstant.RESOURCE_ROLES_MAP, resourceRolesMap);}
}
/*** 資源服務器配置* Created by macro on 2020/6/19.*/
@AllArgsConstructor
@Configuration
@EnableWebFluxSecurity
public class ResourceServerConfig {private final AuthorizationManager authorizationManager;private final IgnoreUrlsConfig ignoreUrlsConfig;private final RestfulAccessDeniedHandler restfulAccessDeniedHandler;private final RestAuthenticationEntryPoint restAuthenticationEntryPoint;@Beanpublic SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {http.oauth2ResourceServer().jwt().jwtAuthenticationConverter(jwtAuthenticationConverter());http.authorizeExchange().pathMatchers(ArrayUtil.toArray(ignoreUrlsConfig.getUrls(),String.class)).permitAll()//白名單配置.anyExchange().access(authorizationManager)//鑒權管理器配置.and().exceptionHandling().accessDeniedHandler(restfulAccessDeniedHandler)//處理未授權.authenticationEntryPoint(restAuthenticationEntryPoint)//處理未認證.and().csrf().disable();return http.build();}@Beanpublic Converter<Jwt, ? extends Mono<? extends AbstractAuthenticationToken>> jwtAuthenticationConverter() {JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();jwtGrantedAuthoritiesConverter.setAuthorityPrefix(AuthConstant.AUTHORITY_PREFIX);jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName(AuthConstant.AUTHORITY_CLAIM_NAME);JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);return new ReactiveJwtAuthenticationConverterAdapter(jwtAuthenticationConverter);}}
/*** 測試接口* Created by macro on 2020/6/19.*/
@RestController
public class HelloController {@GetMapping("/hello")public String hello() {return "Hello World.";}}
創建一個LoginUserHolder組件，用于從請求的Header中直接獲取登錄用戶信息；
/*** 獲取登錄用戶信息* Created by macro on 2020/6/17.*/
@Component
public class LoginUserHolder {public UserDTO getCurrentUser(){//從Header中獲取用戶信息ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();HttpServletRequest request = servletRequestAttributes.getRequest();String userStr = request.getHeader("user");JSONObject userJsonObject = new JSONObject(userStr);UserDTO userDTO = new UserDTO();userDTO.setUsername(userJsonObject.getStr("user_name"));userDTO.setId(Convert.toLong(userJsonObject.get("id")));userDTO.setRoles(Convert.toList(String.class,userJsonObject.get("authorities")));return userDTO;}
}
創建一個獲取當前用戶信息的接口。
/*** 獲取登錄用戶信息接口* Created by macro on 2020/6/19.*/
@RestController
@RequestMapping("/user")
public class UserController{@Autowiredprivate LoginUserHolder loginUserHolder;@GetMapping("/currentUser")public UserDTO currentUser() {return loginUserHolder.getCurrentUser();}}
