采用Spring Security AOuth2 和 JWT 的方式，避免每次请求都需要远程调度 Uaa 服务。采用Spring Security OAuth2 和 JWT 的方式，Uaa 服务只验证一次，返回JWT。返回的 JWT 包含了用户的所有信息，包括权限信息。
1.什么是JWT？#
JSON Web Token（JWT）是一种开放的标准（RFC 7519），JWT定义了一种紧凑且自包含的标准，该标准旨在将各个主体的信息包装为 JSON 对象。主体信息是通过数字签名进行加密和验证的。常使用 HMAC 算法或 RSA（公钥/私钥的非对称性加密）算法对JWT进行签名，安全性很高。
JWT 特点：
- 紧凑型：数据体积小，可通过 POST 请求参数或 HTTP 请求头发送。
- 自包含：JWT包含了主体的所有信息，避免了每个请求都需要向Uaa服务验证身份，降低了服务器的负载。
2.JWT的结构#
JWT结构：
- Header（头）
- Payload（有效载荷）
- Signature（签名）
因此，JWT的通常格式是：xxxxx.yyyyy.zzzzz
（1）Header
Header 通常是由两部分组成：令牌的类型（即JWT）和使用的算法类型，如 HMAC、SHA256和RSA。例如:
Copy
{
"typ": "JWT",
"alg": "HS256"
}
将 Header 用 Base64 编码作为 JWT 的第一部分。
（2）Payload
这是 JWT 的第二部分，包含了用户的一些信息和Claim（声明、权利）。有3类型的 Claim：保留、公开和私人。
Copy
{
"sub": "123456789",
"name": "John Doe",
"admin": true
}
将 Payload 用 Base64 编码作为 JWT 的第一部分。
（3）Signature
要创建签名部分，需要将 Base64 编码后的 Header、Payload 和秘钥进行签名，一个典型的格式如下:
Copy
HMACSHA256(
base64UrlEncode(header) + '.' +
base64UrlEncode(payload),
secret
)
3.如何使用JWT#
认证流程图如下，客户端获取JWT后，以后每次请求都不需要再通过Uaa服务来判断该请求的用户以及该用户的权限。在微服务中，可以利用JWT实现单点登录。
4.案例工程架构#
三个工程：
- eureka-server：注册服务中心，端口8761。这里不再演示搭建。
- auth-service：负责授权，授权需要用户提供客户端的 clientId 和 password，以及授权用户的username和password。这些信息准备无误之后，auth-service 返回JWT，该 JWT 包含了用户的基本信息和权限点信息，并通过 RSA 加密。
- user-service：作为资源服务，它的资源以及被保护起来了，需要相应的权限才能访问。user-service 服务得到用户请求的 JWT 后，先通过公钥解密JWT，得到该JWT对应的用户的信息和用户的权限信息，再判断该用户是否有权限访问该资源。
工程架构图:
5.构建auth-service工程#
1.新建Spring Boot工程，取名为 auth-service，其完整pom.xml文件为.
Copy
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<span ><<span >parent</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-starter-parent<span ></<span >artifactId</span>></span>
<span ><<span >version</span>></span>1.5.3.RELEASE<span ></<span >version</span>></span>
<span ><<span >relativePath</span>/></span> <span ><!-- lookup parent from repository --></span>
<span ></<span >parent</span>></span>
<span ><<span >groupId</span>></span>com.example<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>auth-service<span ></<span >artifactId</span>></span>
<span ><<span >version</span>></span>0.0.1-SNAPSHOT<span ></<span >version</span>></span>
<span ><<span >name</span>></span>auth-service<span ></<span >name</span>></span>
<span ><<span >description</span>></span>Demo project for Spring Boot<span ></<span >description</span>></span>
<span ><<span >properties</span>></span>
<span ><<span >java.version</span>></span>1.8<span ></<span >java.version</span>></span>
<span ><<span >spring-cloud.version</span>></span>Dalston.SR1<span ></<span >spring-cloud.version</span>></span>
<span ></<span >properties</span>></span>
<span ><<span >dependencies</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.cloud<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-cloud-starter-eureka<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-starter-web<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.security<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-security-jwt<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.security.oauth<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-security-oauth2<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-starter-data-jpa<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>mysql<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>mysql-connector-java<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-starter-test<span ></<span >artifactId</span>></span>
<span ><<span >scope</span>></span>test<span ></<span >scope</span>></span>
<span ></<span >dependency</span>></span>
<span ></<span >dependencies</span>></span>
<span ><<span >dependencyManagement</span>></span>
<span ><<span >dependencies</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.cloud<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-cloud-dependencies<span ></<span >artifactId</span>></span>
<span ><<span >version</span>></span>${spring-cloud.version}<span ></<span >version</span>></span>
<span ><<span >type</span>></span>pom<span ></<span >type</span>></span>
<span ><<span >scope</span>></span>import<span ></<span >scope</span>></span>
<span ></<span >dependency</span>></span>
<span ></<span >dependencies</span>></span>
<span ></<span >dependencyManagement</span>></span>
<span ><<span >build</span>></span>
<span ><<span >plugins</span>></span>
<span ><<span >plugin</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-maven-plugin<span ></<span >artifactId</span>></span>
<span ></<span >plugin</span>></span>
<span ><!--防止jks文件被mavne编译导致不可用--></span>
<span ><<span >plugin</span>></span>
<span ><<span >groupId</span>></span>org.apache.maven.plugins<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>maven-resources-plugin<span ></<span >artifactId</span>></span>
<span ><<span >configuration</span>></span>
<span ><<span >nonFilteredFileExtensions</span>></span>
<span ><<span >nonFilteredFileExtension</span>></span>cert<span ></<span >nonFilteredFileExtension</span>></span>
<span ><<span >nonFilteredFileExtension</span>></span>jks<span ></<span >nonFilteredFileExtension</span>></span>
<span ></<span >nonFilteredFileExtensions</span>></span>
<span ></<span >configuration</span>></span>
<span ></<span >plugin</span>></span>
<span ></<span >plugins</span>></span>
<span ></<span >build</span>></span>
</project>
2.配置application.yml文件
Copy
spring:
application:
name: auth-service
datasource:
driver-class-name: com.mysql.jdbc.Driver
url: jdbc:mysql://localhost:3306/spring-cloud-auth?useUnicode=true&characterEncoding=utf8&characterSetResults=utf8
username: root
password: 123456
jpa:
hibernate:
ddl-auto: update
show-sql: true
server:
port: 9999
eureka:
client:
serviceUrl:
defaultZone: http://localhost:8761/eureka/
3.配置Spring Security
Copy
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
<span >@Override</span>
<span >@Bean</span>
<span ><span >public</span> AuthenticationManager <span >authenticationManagerBean</span><span >()</span> <span >throws</span> Exception </span>{
<span >return</span> <span >super</span>.authenticationManagerBean();
}
<span >@Override</span>
<span ><span >protected</span> <span >void</span> <span >configure</span><span >(HttpSecurity http)</span> <span >throws</span> Exception </span>{
http
.csrf().disable() <span >//关闭CSRF</span>
.exceptionHandling()
.authenticationEntryPoint((request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
.and()
.authorizeRequests()
.antMatchers(<span >"/**"</span>).authenticated()
.and()
.httpBasic();
}
<span >@Autowired</span>
UserServiceDetail userServiceDetail;
<span >@Override</span>
<span ><span >protected</span> <span >void</span> <span >configure</span><span >(AuthenticationManagerBuilder auth)</span> <span >throws</span> Exception </span>{
auth.userDetailsService(userServiceDetail)
.passwordEncoder(<span >new</span> BCryptPasswordEncoder()); <span >//密码加密</span>
}
}
UserServiceDetail.java
Copy
@Service
public class UserServiceDetail implements UserDetailsService {
@Autowired
private UserDao userRepository;
<span >@Override</span>
<span ><span >public</span> UserDetails <span >loadUserByUsername</span><span >(String username)</span> <span >throws</span> UsernameNotFoundException </span>{
<span >return</span> userRepository.findByUsername(username);
}
}
UserDao.java
Copy
@Repository
public interface UserDao extends JpaRepository<User, Long> {
<span >User <span >findByUsername</span><span >(String username)</span></span>;
}
User对象和上一篇文章的内容一样，需要实现UserDetails接口，Role对象需要实现GrantedAuthority接口.
Copy
@Entity
public class User implements UserDetails, Serializable {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
<span >@Column</span>(nullable = <span >false</span>, unique = <span >true</span>)
<span >private</span> String username;
<span >@Column</span>
<span >private</span> String password;
<span >@ManyToMany</span>(cascade = CascadeType.ALL, fetch = FetchType.EAGER)
<span >@JoinTable</span>(name = <span >"user_role"</span>, joinColumns = <span >@JoinColumn</span>(name = <span >"user_id"</span>, referencedColumnName = <span >"id"</span>),
inverseJoinColumns = <span >@JoinColumn</span>(name = <span >"role_id"</span>, referencedColumnName = <span >"id"</span>))
<span >private</span> List<Role> authorities;
<span ><span >public</span> <span >User</span><span >()</span> </span>{
}
<span ><span >public</span> Long <span >getId</span><span >()</span> </span>{
<span >return</span> id;
}
<span ><span >public</span> <span >void</span> <span >setId</span><span >(Long id)</span> </span>{
<span >this</span>.id = id;
}
<span >@Override</span>
<span >public</span> Collection<? extends GrantedAuthority> getAuthorities() {
<span >return</span> authorities;
}
<span ><span >public</span> <span >void</span> <span >setAuthorities</span><span >(List<Role> authorities)</span> </span>{
<span >this</span>.authorities = authorities;
}
<span >@Override</span>
<span ><span >public</span> String <span >getUsername</span><span >()</span> </span>{
<span >return</span> username;
}
<span ><span >public</span> <span >void</span> <span >setUsername</span><span >(String username)</span> </span>{
<span >this</span>.username = username;
}
<span >@Override</span>
<span ><span >public</span> String <span >getPassword</span><span >()</span> </span>{
<span >return</span> password;
}
<span ><span >public</span> <span >void</span> <span >setPassword</span><span >(String password)</span> </span>{
<span >this</span>.password = password;
}
<span >@Override</span>
<span ><span >public</span> <span >boolean</span> <span >isAccountNonExpired</span><span >()</span> </span>{
<span >return</span> <span >true</span>;
}
<span >@Override</span>
<span ><span >public</span> <span >boolean</span> <span >isAccountNonLocked</span><span >()</span> </span>{
<span >return</span> <span >true</span>;
}
<span >@Override</span>
<span ><span >public</span> <span >boolean</span> <span >isCredentialsNonExpired</span><span >()</span> </span>{
<span >return</span> <span >true</span>;
}
<span >@Override</span>
<span ><span >public</span> <span >boolean</span> <span >isEnabled</span><span >()</span> </span>{
<span >return</span> <span >true</span>;
}
}
Copy
@Entity
public class Role implements GrantedAuthority {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
@Column(nullable = false)
private String name;
public Long getId() {
return id;
}
public void setId(Long id) {
this.id = id;
}
@Override
public String getAuthority() {
return name;
}
public void setName(String name) {
this.name = name;
}
@Override
public String toString() {
return name;
}
}
4.配置 Authorization Server
在 OAuth2Config 这个类中配置 AuthorizationServer，其代码如下:
Copy
@Configuration
@EnableAuthorizationServer
public class OAuth2Config extends AuthorizationServerConfigurerAdapter {
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory() //将客户端的信息存储在内存中
.withClient("user-service") //创建了一个Client为"user-service"的客户端
.secret("123456")
.scopes("service") //客户端的域
.authorizedGrantTypes("refresh_token", "password") //配置类验证类型为 refresh_token和password
.accessTokenValiditySeconds(12*300); //5min过期
}
<span >@Override</span>
<span ><span >public</span> <span >void</span> <span >configure</span><span >(AuthorizationServerEndpointsConfigurer endpoints)</span> <span >throws</span> Exception </span>{
endpoints.tokenStore(tokenStore()).tokenEnhancer(jwtTokenEnhancer()).authenticationManager(authenticationManager);
}
<span >@Autowired</span>
<span >@Qualifier</span>(<span >"authenticationManagerBean"</span>)
<span >private</span> AuthenticationManager authenticationManager;
<span >@Bean</span>
<span ><span >public</span> TokenStore <span >tokenStore</span><span >()</span> </span>{
<span >return</span> <span >new</span> JwtTokenStore(jwtTokenEnhancer());
}
<span >@Bean</span>
<span ><span >protected</span> JwtAccessTokenConverter <span >jwtTokenEnhancer</span><span >()</span> </span>{
<span >//注意此处需要相应的jks文件</span>
KeyStoreKeyFactory keyStoreKeyFactory = <span >new</span> KeyStoreKeyFactory(<span >new</span> ClassPathResource(<span >"fzp-jwt.jks"</span>), <span >"fzp123"</span>.toCharArray());
JwtAccessTokenConverter converter = <span >new</span> JwtAccessTokenConverter();
converter.setKeyPair(keyStoreKeyFactory.getKeyPair(<span >"fzp-jwt"</span>));
<span >return</span> converter;
}
}
5.生成 jks 文件
配置 JwtTokenStore 时需要使用 jks 文件作为 Token 加密的秘钥。
jks 文件需要Java keytool工具，保证Java环境变量没问题，打开计算机终端，输入命令:
keytool -genkeypair -alias fzp-jwt -validity 3650 -keyalg RSA -dname "CN=jwt,OU=jtw,O=jwt,L=zurich,S=zurich,C=CH" -keypass fzp123 -keystore fzp-jwt.jks -storepass fzp123
解释，-alias 选项为别名，-keypass 和 -storepass 为密码选项，-validity 为配置jks文件过期时间（单位：天）。
获取的 jks 文件作为私钥，只允许 Uaa 服务持有，并用作加密 JWT。也就是把生成的 jks 文件放到 auth-service 工程的resource目录下。那么 user-service 这样的资源服务，是如何解密 JWT 的呢？这时就需要使用 jks 文件的公钥。获取 jks 文件的公钥命令如下：
keytool -list -rfc --keystore fzp-jwt.jks | openssl x509 -inform pem -pubkey
这个命令要求你的计算机上安装了openSSL（下载地址），然后手动把安装的openssl.exe所在目录配置到环境变量。
输入密码fzp123后，显示的信息很多，我们只提取 PUBLIC KEY，即如下所示：
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlCFiWbZXIb5kwEaHjW+/
7J4b+KzXZffRl5RJ9rAMgfRXHqGG8RM2Dlf95JwTXzerY6igUq7FVgFjnPbexVt3
vKKyjdy2gBuOaXqaYJEZSfuKCNN/WbOF8e7ny4fLMFilbhpzoqkSHiR+nAHLkYct
OnOKMPK1SwmvkNMn3aTEJHhxGh1RlWbMAAQ+QLI2D7zCzQ7Uh3F+Kw0pd2gBYd8W
+DKTn1Tprugdykirr6u0p66yK5f1T9O+LEaJa8FjtLF66siBdGRaNYMExNi21lJk
i5dD3ViVBIVKi9ZaTsK9Sxa3dOX1aE5Zd5A9cPsBIZ12spYgemfj6DjOw6lk7jkG
9QIDAQAB
-----END PUBLIC KEY-----
新建一个 public.cert 文件，将上面的公钥信息复制到 public.cert 文件中并保存。并将文件放到 user-service 等资源服务的resources目录下。到目前为止，Uaa 服务已经搭建完毕。
需要注意的是，Maven 在项目编译时，可能会将 jks 文件编译，导致 jks 文件乱码，最后不可用。需要在工程的 pom 文件中添加以下内容:
Copy
<!--防止jks文件被mavne编译导致不可用-->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-resources-plugin</artifactId>
<configuration>
<nonFilteredFileExtensions>
<nonFilteredFileExtension>cert</nonFilteredFileExtension>
<nonFilteredFileExtension>jks</nonFilteredFileExtension>
</nonFilteredFileExtensions>
</configuration>
</plugin>
最后，别忘了在启动类注解@EnableEurekaClient开启服务注册.
Copy
@SpringBootApplication
@EnableEurekaClient
public class AuthServiceApplication {
public static void main(String[] args) {
SpringApplication.run(AuthServiceApplication.class, args);
}
}
6.构建user-service资源服务#
1.新建Spring Boot工程，取名为user-service，其完整pom.xml文件:
Copy
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>1.5.3.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<span ><<span >groupId</span>></span>com.example<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>user-service<span ></<span >artifactId</span>></span>
<span ><<span >version</span>></span>0.0.1-SNAPSHOT<span ></<span >version</span>></span>
<span ><<span >name</span>></span>user-service<span ></<span >name</span>></span>
<span ><<span >description</span>></span>Demo project for Spring Boot<span ></<span >description</span>></span>
<span ><<span >properties</span>></span>
<span ><<span >java.version</span>></span>1.8<span ></<span >java.version</span>></span>
<span ><<span >spring-cloud.version</span>></span>Dalston.SR1<span ></<span >spring-cloud.version</span>></span>
<span ></<span >properties</span>></span>
<span ><<span >dependencies</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.cloud<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-cloud-starter-eureka<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-starter-web<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.security.oauth<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-security-oauth2<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-starter-data-jpa<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>mysql<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>mysql-connector-java<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.cloud<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-cloud-starter-hystrix<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.cloud<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-cloud-starter-feign<span ></<span >artifactId</span>></span>
<span ></<span >dependency</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-starter-test<span ></<span >artifactId</span>></span>
<span ><<span >scope</span>></span>test<span ></<span >scope</span>></span>
<span ></<span >dependency</span>></span>
<span ></<span >dependencies</span>></span>
<span ><<span >dependencyManagement</span>></span>
<span ><<span >dependencies</span>></span>
<span ><<span >dependency</span>></span>
<span ><<span >groupId</span>></span>org.springframework.cloud<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-cloud-dependencies<span ></<span >artifactId</span>></span>
<span ><<span >version</span>></span>${spring-cloud.version}<span ></<span >version</span>></span>
<span ><<span >type</span>></span>pom<span ></<span >type</span>></span>
<span ><<span >scope</span>></span>import<span ></<span >scope</span>></span>
<span ></<span >dependency</span>></span>
<span ></<span >dependencies</span>></span>
<span ></<span >dependencyManagement</span>></span>
<span ><<span >build</span>></span>
<span ><<span >plugins</span>></span>
<span ><<span >plugin</span>></span>
<span ><<span >groupId</span>></span>org.springframework.boot<span ></<span >groupId</span>></span>
<span ><<span >artifactId</span>></span>spring-boot-maven-plugin<span ></<span >artifactId</span>></span>
<span ></<span >plugin</span>></span>
<span ></<span >plugins</span>></span>
<span ></<span >build</span>></span>
</project>
2.配置文件application.yml
在工程的配置文件application.yml中，配置程序名为 user-service，端口号为 9090，另外，需要配置 feign.hystrix.enable 为true，即开启 Feign 的 Hystrix 功能。完整的配置代码如下:
Copy
server:
port: 9090
eureka:
client:
service-url:
defaultZone: http://localhost:8761/eureka/
spring:
application:
name: user-service
datasource:
driver-class-name: com.mysql.jdbc.Driver
url: jdbc:mysql://localhost:3306/spring-cloud-auth?useUnicode=true&characterEncoding=utf8&characterSetResults=utf8
username: root
password: 123456
jpa:
hibernate:
ddl-auto: update
show-sql: true
feign:
hystrix:
enabled: true
3.配置Resource Server
在配置Resource Server之前，需要注入 JwtTokenStore 类型的 Bean。
Copy
@Configuration
public class JwtConfig {
@Autowired
JwtAccessTokenConverter jwtAccessTokenConverter;
<span >@Bean</span>
<span >@Qualifier</span>(<span >"tokenStore"</span>)
<span ><span >public</span> TokenStore <span >tokenStore</span><span >()</span> </span>{
<span >return</span> <span >new</span> JwtTokenStore(jwtAccessTokenConverter);
}
<span >@Bean</span>
<span ><span >protected</span> JwtAccessTokenConverter <span >jwtTokenEnhancer</span><span >()</span> </span>{
<span >//用作 JWT 转换器</span>
JwtAccessTokenConverter converter = <span >new</span> JwtAccessTokenConverter();
Resource resource = <span >new</span> ClassPathResource(<span >"public.cert"</span>);
String publicKey ;
<span >try</span> {
publicKey = <span >new</span> String(FileCopyUtils.copyToByteArray(resource.getInputStream()));
} <span >catch</span> (IOException e) {
<span >throw</span> <span >new</span> RuntimeException(e);
}
converter.setVerifierKey(publicKey); <span >//设置公钥</span>
<span >return</span> converter;
}
}
然后配置 Resource Server
Copy
@Configuration
@EnableResourceServer //开启Resource Server功能
public class ResourceServerConfig extends ResourceServerConfigurerAdapter{
@Autowired
TokenStore tokenStore;
<span >@Override</span>
<span ><span >public</span> <span >void</span> <span >configure</span><span >(HttpSecurity http)</span> <span >throws</span> Exception </span>{
http
.csrf().disable()
.authorizeRequests()
.antMatchers(<span >"/user/login"</span>,<span >"/user/register"</span>).permitAll()
.antMatchers(<span >"/**"</span>).authenticated();
}
<span >@Override</span>
<span ><span >public</span> <span >void</span> <span >configure</span><span >(ResourceServerSecurityConfigurer resources)</span> <span >throws</span> Exception </span>{
resources.tokenStore(tokenStore);
}
}
4.新建一个配置类 GlobalMethodSecurityConfig，在此类中通过 @EnableGlobalMethodSecurity(prePostEnabled = true)注解开启方法级别的安全验证。
Copy
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class GlobalMethodSecurityConfig {
}
5.编写用户注册接口
拷贝auth-service工程的User.java、Role.java 和 UserDao.java 到本工程。
在 Service 层的 UserService 写一个插入用户的方法，代码如下
Copy
@Service
public class UserServiceDetail {
<span >@Autowired</span>
<span >private</span> UserDao userRepository;
<span ><span >public</span> User <span >insertUser</span><span >(String username,String password)</span></span>{
User user=<span >new</span> User();
user.setUsername(username);
user.setPassword(BPwdEncoderUtil.BCryptPassword(password));
<span >return</span> userRepository.save(user);
}
}
BPwdEncoderUtil工具类
Copy
public class BPwdEncoderUtil {
<span >private</span> <span >static</span> <span >final</span> BCryptPasswordEncoder encoder = <span >new</span> BCryptPasswordEncoder();
<span ><span >public</span> <span >static</span> String <span >BCryptPassword</span><span >(String password)</span></span>{
<span >return</span> encoder.encode(password);
}
<span ><span >public</span> <span >static</span> <span >boolean</span> <span >matches</span><span >(CharSequence rawPassword, String encodedPassword)</span></span>{
<span >return</span> encoder.matches(rawPassword,encodedPassword);
}
}
在 Web 层，在 Controller 中写一个注册的 API 接口 “/user/register”,代码如下
Copy
@RestController
@RequestMapping("/user")
public class UserController {
@Autowired
UserServiceDetail userServiceDetail;
<span >@PostMapping</span>(<span >"/register"</span>)
<span ><span >public</span> User <span >postUser</span><span >(@RequestParam(<span >"username"</span>)</span> String username , @<span >RequestParam</span><span >(<span >"password"</span>)</span> String password)</span>{
<span >//参数判断，省略</span>
<span >return</span> userServiceDetail.insertUser(username,password);
}
}
6.编写用户登录接口
在Service层，在 UserServiceDetail 中添加一个 login（登录）方法，代码如下：
Copy
@Service
public class UserServiceDetail {
<span >@Autowired</span>
<span >private</span> AuthServiceClient client;
<span ><span >public</span> UserLoginDTO <span >login</span><span >(String username, String password)</span></span>{
User user=userRepository.findByUsername(username);
<span >if</span> (<span >null</span> == user) {
<span >throw</span> <span >new</span> UserLoginException(<span >"error username"</span>);
}
<span >if</span>(!BPwdEncoderUtil.matches(password,user.getPassword())){
<span >throw</span> <span >new</span> UserLoginException(<span >"error password"</span>);
}
<span >// 获取token</span>
JWT jwt=client.getToken(<span >"Basic dXNlci1zZXJ2aWNlOjEyMzQ1Ng=="</span>,<span >"password"</span>,username,password);
<span >// 获得用户菜单</span>
<span >if</span>(jwt==<span >null</span>){
<span >throw</span> <span >new</span> UserLoginException(<span >"error internal"</span>);
}
UserLoginDTO userLoginDTO=<span >new</span> UserLoginDTO();
userLoginDTO.setJwt(jwt);
userLoginDTO.setUser(user);
<span >return</span> userLoginDTO;
}
}
AuthServiceClient 通过向 auth-service 服务远程调用“/oauth/token” API接口，获取 JWT。在 "/oauth/token" API 接口，获取JWT。在“/oauth/token”API接口中需要在请求头传入 Authorization 信息，并需要传请求参数认证类型 grant_type、用户名 username 和密码 password，代码如下：
Copy
@FeignClient(value = "auth-service",fallback =AuthServiceHystrix.class )
public interface AuthServiceClient {
<span >@PostMapping</span>(value = <span >"/oauth/token"</span>)
<span >JWT <span >getToken</span><span >(@RequestHeader(value = <span >"Authorization"</span>)</span> String authorization, @<span >RequestParam</span><span >(<span >"grant_type"</span>)</span> String type,
@<span >RequestParam</span><span >(<span >"username"</span>)</span> String username, @<span >RequestParam</span><span >(<span >"password"</span>)</span> String password)</span>;
}
其中，AuthServiceHystrix 为AuthServiceClient 的熔断器，代码如下：
Copy
@Component
public class AuthServiceHystrix implements AuthServiceClient {
@Override
public JWT getToken(String authorization, String type, String username, String password) {
return null;
}
}
JWT 为一个 JavaBean，它包含了 access_token、token_type 和 refresh_token 等信息，代码如下：
Copy
public class JWT {
private String access_token;
private String token_type;
private String refresh_token;
private int expires_in;
private String scope;
private String jti;
//getter setter
UserLoginDTO 包含了一个 User 和一个 JWT 对象，用于返回数据的实体：
Copy
public class UserLoginDTO {
private JWT jwt;
private User user;
//setter getter
}
登录异常类 UserLoginException
Copy
public class UserLoginException extends RuntimeException{
public UserLoginException(String message) {
super(message);
}
}
统一异常处理
Copy
@ControllerAdvice
@ResponseBody
public class ExceptionHandle {
@ExceptionHandler(UserLoginException.class)
public ResponseEntity<String> handleException(Exception e) {
<span >return</span> <span >new</span> ResponseEntity(e.getMessage(), HttpStatus.OK);
}
}
在web层的 UserController 类补充一个登录的API接口“/user/login”.
Copy
@PostMapping("/login")
public UserLoginDTO login(@RequestParam("username") String username , @RequestParam("password") String password){
//参数判断，省略
return userServiceDetail.login(username,password);
}
为了测试权限，再补充一个"/foo"接口，该接口需要“ROLE_ADMIN”权限.
Copy
@RequestMapping(value = "/foo", method = RequestMethod.GET)
@PreAuthorize("hasAuthority('ROLE_ADMIN')")
public String getFoo() {
return "i'm foo, " + UUID.randomUUID().toString();
}
最后，在启动类注解开启Feign：
Copy
@SpringBootApplication
@EnableFeignClients
@EnableEurekaClient
public class UserServiceApplication {
public static void main(String[] args) {
SpringApplication.run(UserServiceApplication.class, args);
}
}
7.启动工程,开始测试#
经过千辛万苦，终于搭建了一个Demo工程，现在开始依次启动 eureka-server、auth-service 和 user-service工程。这里我们使用PostMan测试编写的接口。
1.注册用户
2.登录获取Token
3.访问/user/foo
复制 access_token到 Header头部，发起GET请求。
Copy
"Authorization":"Bearer {access_token}"
因为没有权限，访问被拒绝，我们手动在数据库添加"ROLE_ADMIN"权限，并与该用户关联。重新登录并获取Token，重新请求“/user/foo”接口
总结#
在本案例中，用户通过登录接口来获取授权服务的Token 。用户获取Token 成功后，在以后每次访问资源服务的请求中都需要携带该Token 。资源服务通过公钥解密Token ，解密成功后可以获取用户信息和权限信息，从而判断该Token 所对应的用户是谁， 具有什么权限。
这个架构的优点在于，一次获取Token ， 多次使用，不再每次询问Uaa 服务该Token 所对应的用户信息和用户的权限信息。这个架构也有缺点，例如一旦用户的权限发生了改变， 该Token 中存储的权限信息并没有改变， 需要重新登录获取新的Token 。就算重新获取了Token,如果原来的Token 没有过期，仍然是可以使用的，所以需要根据具体的业务场景来设置Token的过期时间。一种改进方式是将登录成功后获取的Token 缓存在网关上，如果用户的权限更改，将网关上缓存的Token 删除。当请求经过网关，判断请求的Token 在缓存中是否存在，如果缓存中不存在该Token ，则提示用户重新登录。
参考：《深入理解Spring Cloud与微服务构建》方志朋
JWT返回null问题解决
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
@Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory()
.withClient("client")
.redirectUris("http://www.baidu.com")
//此处的scopes是无用的，可以随意设置
.scopes("all","read", "write")
.secret(passwordEncoder.encode("secret"))//这块就是解决办法，原本secret换成passwordEncoder.encode("secret")
.authorizedGrantTypes("password", "authorization_code", "refresh_token")
//有效期时间
// .accessTokenValiditySeconds(accessTokenValiditySeconds) //刷新事件
// .refreshTokenValiditySeconds(refreshTokenValiditySeconds) .and()
.withClient("webapp")
.scopes("xx")
.authorizedGrantTypes("implicit");
}
|
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
