• SpringCloud-OAuth2（四）：改造篇

    本片主要讲SpringCloud Oauth2篇的实战改造，如动态权限、集成JWT、更改默认url、数据库加载client信息等改造。
同时，这应该也是我这系列博客的完结篇。

关于Oauth2，我也想说几句：
如果真的要应用到企业级项目当中去，必须要进行充足的准备，因为默认的配置、UI等很多都不是通用的（不适用于各个公司），
但是这套框架还好留了很多适配方法等，因此其需要修改的配置、处理器、方法重写等逻辑确实很多很多。

话不多说，正文开始。

    1：动态权限

    常用的权限校验机制如以下几点：

    参考：SpringCloud+SpringSecurity+Oauth2实现角色权限四种方案 - 知乎

    类型示例
    硬编码如在接口上添加注解：@PreAuthorize("hasAnyRole('ROLE_ADMIN')")
    HttpSecurity动态增加在资源服务配置类中配置，如：.authorizeRequests().anyRequest().authenticated()

    如果出现用户所拥有的权限出现变化时，上述两种是无法满足的。

    百度了几天后网上确实有同学给出了不错的示例，其工作机制如下：

    1.1：AccessDecisionManager重写

    1. @Component
    2. public class VipAccessDecisionManager implements AccessDecisionManager {
    3.  
    4.     /**
    5.      * 决定当前用户是否有权限访问该请求
    6.      **/
    7.     @Override
    8.     public void decide(Authentication authentication, Object object,
    9.                        Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
    10.         for (ConfigAttribute configAttribute : configAttributes) {
    11.             //将访问所需资源或用户拥有资源进行比对
    12.             String needAuthority = configAttribute.getAttribute();
    13.             if (needAuthority == null) {
    14.                 continue;
    15.             }
    16.             for (GrantedAuthority grantedAuthority : authentication.getAuthorities()) {
    17.                 if (needAuthority.trim().equals(grantedAuthority.getAuthority())) {
    18.                     return;
    19.                 }
    20.             }
    21.         }
    22.         throw new AccessDeniedException("抱歉，您没有访问权限");
    23.     }
    24.  
    25.     @Override
    26.     public boolean supports(ConfigAttribute configAttribute) {
    27.         return true;
    28.     }
    29.  
    30.     @Override
    31.     public boolean supports(Class aClass) {
    32.         return true;
    33.     }
    34.  
    35. }

    1.2：FilterInvocationSecurityMetadataSource重写

    1. public class VipSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
    2.  
    3.     private static final AntPathMatcher ANT_PATH_MATCHER = new AntPathMatcher();
    4.  
    5.     private Set<PermRoleEntity> permRoleEntitySet;
    6.  
    7.     private final FilterInvocationSecurityMetadataSource superMetadataSource;
    8.     private final VipSecurityOauthService vipSecurityOauthService;
    9.  
    10.     public VipSecurityMetadataSource(FilterInvocationSecurityMetadataSource superMetadataSource, 
    11.                                      VipSecurityOauthService vipSecurityOauthService) {
    12.         this.superMetadataSource = superMetadataSource;
    13.         this.vipSecurityOauthService = vipSecurityOauthService;
    14.     }
    15.  
    16.     private void loadPerms() {
    17.         permRoleEntitySet = vipSecurityOauthService.loadPerms();
    18.     }
    19.  
    20.     /**
    21.      * 返回能访问该请求的所有角色集合
    22.      **/
    23.     @Override
    24.     public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
    25.         loadPerms();
    26.  
    27.         FilterInvocation fi = (FilterInvocation) object;
    28.         String access_uri = fi.getRequestUrl();
    29.  
    30.         for (PermRoleEntity permRoleEntity : permRoleEntitySet) {
    31.             if (ANT_PATH_MATCHER.match(permRoleEntity.getAccessUri(), access_uri))
    32.                 return permRoleEntity.getConfigAttributeList();
    33.         }
    34.  
    35.         return superMetadataSource.getAttributes(object);
    36.     }
    37.  
    38.     @Override
    39.     public Collection<ConfigAttribute> getAllConfigAttributes() {
    40.         loadPerms();
    41.  
    42.         Set<ConfigAttribute> attributeSet = new HashSet<>();
    43.         permRoleEntitySet.stream().map(PermRoleEntity::getConfigAttributeList).forEach(attributeSet::addAll);
    44.         return attributeSet;
    45.     }
    46.  
    47.     @Override
    48.     public boolean supports(Class clazz) {
    49.         return FilterInvocation.class.isAssignableFrom(clazz);
    50.     }
    51. }

    1.3：动态权限入口（自定义）

    VipSecurityOauthService：权限的动态加载api
    这里写成静态的，好参考。

    1. @Component
    2. public class VipSecurityOauthService {
    3.  
    4.     /**
    5.      * 动态加载权限-角色信息
    6.      **/
    7.     public Set loadPerms() {
    8.         Set permRoleEntitySet = new HashSet<>();
    9.         permRoleEntitySet.add(new PermRoleEntity().setAccessUri("/demo/admin").setConfigAttributeList(SecurityConfig.createList("admin")));
    10.         permRoleEntitySet.add(new PermRoleEntity().setAccessUri("/auth/**").setConfigAttributeList(SecurityConfig.createList("admin")));
    11.  
    12.         permRoleEntitySet.add(new PermRoleEntity().setAccessUri("/demo/sp-admin").setConfigAttributeList(SecurityConfig.createList("sp_admin")));
    13.  
    14.         return permRoleEntitySet;
    15.     }
    16.  
    17. }

    PermRoleEntity：url和角色对应关系

    1. @Data
    2. @Accessors(chain = true)
    3. public class PermRoleEntity {
    4.  
    5.     /**
    6.      * 访问的接口
    7.      **/
    8.     private String accessUri;
    9.  
    10.     /**
    11.      * 可访问该接口的角色集合
    12.      **/
    13.     private List<ConfigAttribute> configAttributeList;
    14. }

    1.4：ResourceServer进行配置

    1.5：测试

    获取用户角色为admin的token，进行接口访问

    ①：用户admin角色的用户访问admin管理的接口

    ①：用户admin角色的用户访问sp-admin管理的接口

    2：集成JWT

    2.1：需要配置的bean

    1.     @Bean
    2.     public TokenStore tokenStore(JwtAccessTokenConverter jwtAccessTokenConverter) {
    3.         return new JwtTokenStore(jwtAccessTokenConverter);
    4.     }
    5.  
    6.     @Bean
    7.     @Primary
    8.     public AuthorizationServerTokenServices defaultTokenServices(TokenStore tokenStore,
    9.                                                                  JwtAccessTokenConverter jwtAccessTokenConverter,
    10.                                                                  ClientDetailsService clientDetailsService,
    11.                                                                  AuthenticationManager authenticationManager) {
    12.         DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
    13.         defaultTokenServices.setSupportRefreshToken(true);
    14.         defaultTokenServices.setTokenStore(tokenStore);
    15.         defaultTokenServices.setTokenEnhancer(jwtAccessTokenConverter);
    16.         defaultTokenServices.setAccessTokenValiditySeconds(3600);
    17.         defaultTokenServices.setRefreshTokenValiditySeconds(7200);
    18.         defaultTokenServices.setClientDetailsService(clientDetailsService);
    19.         defaultTokenServices.setAuthenticationManager(authenticationManager);
    20.  
    21.         return defaultTokenServices;
    22.     }
    23.  
    24.     @Bean
    25.     public JwtAccessTokenConverter jwtAccessTokenConverter() {
    26.         JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
    27.         // 签名密钥
    28.         jwtAccessTokenConverter.setSigningKey("sign_key");
    29.         // 验证密钥
    30.         jwtAccessTokenConverter.setVerifier(new MacSigner("sign_key"));
    31.         return jwtAccessTokenConverter;
    32.     }

    2.2：认证服务配置更改

    tokenservice： 创建token、刷新token的地方。

    获取token

    2.3：OAuth2 Client

    在前文中提到 OAuth2 Client Service 处理请求的时候是无法识别token的，需要远程提交给认证中心（OAuth2 Server）去识别token。
    token换成JWT后客户端服务（OAuth2 Client Service）也可以识别token了，均需做如下配置：

    1.    @Bean
    2.     public TokenStore tokenStore(JwtAccessTokenConverter jwtAccessTokenConverter) {
    3.         return new JwtTokenStore(jwtAccessTokenConverter);
    4.     }
    5.  
    6.     @Bean
    7.     public JwtAccessTokenConverter jwtAccessTokenConverter() {
    8.         JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
    9.         // 签名密钥
    10.         jwtAccessTokenConverter.setSigningKey("sign_key");
    11.         // 验证密钥
    12.         jwtAccessTokenConverter.setVerifier(new MacSigner("sign_key"));
    13.         return jwtAccessTokenConverter;
    14.     }

    前文中提到的这项配置也可以丢弃了。

    访问客户端服务的接口测试：

    3：更改默认url

    3.1：框架提供的接口

    默认url作用
    /oauth/authorize授权端点
    /oauth/token令牌端点
    /oauth/confirm_access用户批准授权的端点
    /oauth/error用于渲染授权服务器的错误
    /oauth/check_token资源服务器解码access token
    /oauth/check_token当使用JWT的时候，暴露公钥的端点

    3.2：如何更改

    可以按照下面这张方法进行重新转交接口地址：

    自定义处理接口代码：

    1. @RestController
    2. public class AuthController extends WebApiController {
    3.     private static final Logger logger = LoggerFactory.getLogger(AuthController.class);
    4.  
    5.     private final ConsumerTokenServices consumerTokenServices;
    6.     private final TokenEndpoint tokenEndpoint;
    7.     private final AuthorizationEndpoint authorizationRequest;
    8.     private final WhitelabelApprovalEndpoint whitelabelApprovalEndpoint;
    9.     private final WhitelabelErrorEndpoint whitelabelErrorEndpoint;
    10.  
    11.     public AuthController(ConsumerTokenServices consumerTokenServices, TokenEndpoint tokenEndpoint,
    12.                           AuthorizationEndpoint authorizationRequest, WhitelabelApprovalEndpoint whitelabelApprovalEndpoint,
    13.                           WhitelabelErrorEndpoint whitelabelErrorEndpoint) {
    14.         this.consumerTokenServices = consumerTokenServices;
    15.         this.tokenEndpoint = tokenEndpoint;
    16.         this.authorizationRequest = authorizationRequest;
    17.         this.whitelabelApprovalEndpoint = whitelabelApprovalEndpoint;
    18.         this.whitelabelErrorEndpoint = whitelabelErrorEndpoint;
    19.     }
    20.  
    21.     /**
    22.      * 自定义登录接口
    23.      */
    24.     @PostMapping(value = "/login")
    25.     public ResponseEntity<String> login(@RequestBody UserLoginDto userLoginDto, Principal principal) throws HttpRequestMethodNotSupportedException {
    26.         Map<String, String> mapDto = ObjectMapperUtil.str2Obj(userLoginDto, new TypeReference<Map<String, String>>() {
    27.         });
    28.         mapDto.put(GrantTypeConstants.GRANT_TYPE, GrantTypeConstants.PASSWORD);
    29.  
    30.         OAuth2AccessToken token;
    31.         try {
    32.             token = tokenEndpoint.postAccessToken(principal, mapDto).getBody();
    33.             if (token == null) {
    34.                 throw new ServiceException("登录异常");
    35.             }
    36.         } catch (Exception e) {
    37.             if (e instanceof InvalidGrantException) {
    38.                 throw new ServiceException("用户名密码错误");
    39.             } else {
    40.                 throw e;
    41.             }
    42.         }
    43.         return response(WebApiResponse.ok(AuthToken.build(token)));
    44.     }
    45. }

    3.3：测试

    4：数据库加载client信息

    前文中以ProcessOn举例的QQ第三方登录就提到ProcessOn会向QQ申请一个client_id（客户端凭证），那么QQ第三方登录配置申请的入口必须将数据存放在数据库中，这样才能做到动态的新增、删除等，代码配置写死是不可能的。
    注意：需要引入数据源、mysql驱动的依赖，并配置好数据源。

    4.1：schema.sql

    因为官方给的sql是hql的，我用的mysql8，因此做了一些类型上的修改。

    1. SET NAMES utf8mb4;
    2. SET FOREIGN_KEY_CHECKS = 0;
    3.  
    4. -- ----------------------------
    5. -- Table structure for clientdetails
    6. -- ----------------------------
    7. DROP TABLE IF EXISTS `clientdetails`;
    8. CREATE TABLE `clientdetails`  (
    9.   `appId` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
    10.   `resourceIds` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    11.   `appSecret` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    12.   `scope` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    13.   `grantTypes` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    14.   `redirectUrl` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    15.   `authorities` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    16.   `access_token_validity` int(0) NULL DEFAULT NULL,
    17.   `refresh_token_validity` int(0) NULL DEFAULT NULL,
    18.   `additionalInformation` varchar(4096) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    19.   `autoApproveScopes` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    20.   PRIMARY KEY (`appId`) USING BTREE
    21. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = DYNAMIC;
    22.  
    23. -- ----------------------------
    24. -- Records of clientdetails
    25. -- ----------------------------
    26.  
    27. -- ----------------------------
    28. -- Table structure for oauth_access_token
    29. -- ----------------------------
    30. DROP TABLE IF EXISTS `oauth_access_token`;
    31. CREATE TABLE `oauth_access_token`  (
    32.   `token_id` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    33.   `token` binary(1) NULL DEFAULT NULL,
    34.   `authentication_id` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
    35.   `user_name` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    36.   `client_id` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    37.   `authentication` binary(1) NULL DEFAULT NULL,
    38.   `refresh_token` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    39.   PRIMARY KEY (`authentication_id`) USING BTREE
    40. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = DYNAMIC;
    41.  
    42. -- ----------------------------
    43. -- Records of oauth_access_token
    44. -- ----------------------------
    45.  
    46. -- ----------------------------
    47. -- Table structure for oauth_approvals
    48. -- ----------------------------
    49. DROP TABLE IF EXISTS `oauth_approvals`;
    50. CREATE TABLE `oauth_approvals`  (
    51.   `userId` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    52.   `clientId` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    53.   `scope` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    54.   `status` varchar(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    55.   `expiresAt` timestamp(0) NOT NULL DEFAULT CURRENT_TIMESTAMP(0) ON UPDATE CURRENT_TIMESTAMP(0),
    56.   `lastModifiedAt` timestamp(0) NOT NULL DEFAULT CURRENT_TIMESTAMP(0)
    57. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = DYNAMIC;
    58.  
    59. -- ----------------------------
    60. -- Records of oauth_approvals
    61. -- ----------------------------
    62.  
    63. -- ----------------------------
    64. -- Table structure for oauth_client_details
    65. -- ----------------------------
    66. DROP TABLE IF EXISTS `oauth_client_details`;
    67. CREATE TABLE `oauth_client_details`  (
    68.   `client_id` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
    69.   `resource_ids` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    70.   `client_secret` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    71.   `scope` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    72.   `authorized_grant_types` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    73.   `web_server_redirect_uri` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    74.   `authorities` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    75.   `access_token_validity` int(0) NULL DEFAULT NULL,
    76.   `refresh_token_validity` int(0) NULL DEFAULT NULL,
    77.   `additional_information` varchar(4096) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    78.   `autoapprove` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    79.   PRIMARY KEY (`client_id`) USING BTREE
    80. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = DYNAMIC;
    81.  
    82. -- ----------------------------
    83. -- Records of oauth_client_details
    84. -- ----------------------------
    85. INSERT INTO `oauth_client_details` VALUES ('admin', 'admin', 'tgMj02VG9dkpeKUN5lSWSsKotIt2yTIElkFcvsqLnwGOspNYhe+Teg==', 'test,all', 'authorization_code,client_credentials,password,implicit,refresh_token', 'http://www.baidu.com', 'admin', NULL, NULL, NULL, 'all');
    86.  
    87. -- ----------------------------
    88. -- Table structure for oauth_client_token
    89. -- ----------------------------
    90. DROP TABLE IF EXISTS `oauth_client_token`;
    91. CREATE TABLE `oauth_client_token`  (
    92.   `token_id` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    93.   `token` binary(1) NULL DEFAULT NULL,
    94.   `authentication_id` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
    95.   `user_name` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    96.   `client_id` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    97.   PRIMARY KEY (`authentication_id`) USING BTREE
    98. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = DYNAMIC;
    99.  
    100. -- ----------------------------
    101. -- Records of oauth_client_token
    102. -- ----------------------------
    103.  
    104. -- ----------------------------
    105. -- Table structure for oauth_code
    106. -- ----------------------------
    107. DROP TABLE IF EXISTS `oauth_code`;
    108. CREATE TABLE `oauth_code`  (
    109.   `code` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    110.   `authentication` binary(1) NULL DEFAULT NULL
    111. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = DYNAMIC;
    112.  
    113. -- ----------------------------
    114. -- Records of oauth_code
    115. -- ----------------------------
    116.  
    117. -- ----------------------------
    118. -- Table structure for oauth_refresh_token
    119. -- ----------------------------
    120. DROP TABLE IF EXISTS `oauth_refresh_token`;
    121. CREATE TABLE `oauth_refresh_token`  (
    122.   `token_id` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
    123.   `token` binary(1) NULL DEFAULT NULL,
    124.   `authentication` binary(1) NULL DEFAULT NULL
    125. ) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_general_ci ROW_FORMAT = DYNAMIC;
    126.  
    127. -- ----------------------------
    128. -- Records of oauth_refresh_token
    129. -- ----------------------------
    130.  
    131. SET FOREIGN_KEY_CHECKS = 1;
     

    在这个表中配置数据即可，参考代码静态配置：
     

     

    4.2：配置
     

    1.    @Override
    2.     public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    3.  
    4.         clients.jdbc(dataSource);
    5.  
    6.     }
     

    做好以上配置，认证服务就可以从数据库加载客户端凭证信息了。
    
                
    
                    
    
                
    • 

                
  • 

                    相关阅读:
    
                    
IDEA 关闭SpringBoot启动Logo/图标                            
    
【一】1D测量 Measuring——measure_thresh()算子                            
    
图扑税务信息化系统管理平台，构建项目管理“一张网”                            
    
【web-渗透测试方法】(15.7)测试功能方面的输入漏洞                            
    
机器学习：详解朴素贝叶斯分类原理 | 例题分析 | Python实现                            
    
GenerationMixin类                            
    
手动模拟 calico 网络                            
    
NTMFS4C05NT1G N-CH 30V 11.9A MOS管,PDF                            
    
虚拟信用卡：如何获取、推荐平台及对注册开发者账号的应用                            
    
共享变量之不可变对象与保护性拷贝!                            
    
                        
                
    • 
                
  • 
                    原文地址：https://blog.csdn.net/weixin_45985053/article/details/126033290
                
    •