Spring Security实现统一登录与权限控制（springsecurity过滤器链）

1 项目介绍最开始是一个单体应用，所有功能模块都写在一个项目里，后来觉得项目越来越大，于是决定把一些功能拆分出去，形成一个一个独立的微服务，于是就有个问题了，登录、退出、权限控制这些东西怎么办呢？总不能每个服务都复制一套吧，最好的方式是将认证与鉴权也单独抽离出来作为公共的服务，业务系统只专心做业务接口开发即可，完全不用理会权限这些与之不相关的东西了。

于是，便有了下面的架构图：

下面重点看一下统一认证中心和业务网关的建设2 统一认证中心这里采用 Spring Security + Spring Security OAuth2OAuth2是一种认证授权的协议，是一种开放的标准最长用到的是授权码模式和密码模式，在本例中，用这两种模式都可以。

, n. b) i2 ]7 w5 @+ @. D

首先，引入相关依赖最主要的依赖是 spring-cloud-starter-oauth2 ，引入它就够了org.springframework.cloud

>spring-cloud-starter-oauth22.2.5.RELEASE这里Spring Boot的版本是2.6.3 完整的pom如下：

2 ?$ S7 P' V7 V8 ]

xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"><

modelVersion>4.0.0com.tgftgf-service-parent

6 }0 \8 L: l, a# C) ]

>1.3.0com.soa.supervision.uaa

7 q' _, C1 @, q& v# o3 P

soas-uaa0.0.1-SNAPSHOTsoas-uaa

2 c1 U5 Z" Y2 [* {: Z. o6 F; u: h

>1.82021.0.0

% y- B2 `2 Y- l R

>org.springframework.bootspring-boot-starter-data-redis

. v _- \1 o: ^8 s

>org.springframework.bootspring-boot-starter-web

org.springframework.cloudspring-cloud-starter

org.springframework.cloudspring-cloud-starter-oauth2

2.2.5.RELEASEcom.nimbusds

0 Y" Z1 r8 b( F4 A2 m6 \3 Y

nimbus-jose-jwt9.19com.baomidou

mybatis-plus-boot-startercom.baomidou

mybatis-plus-generator3.5.1

5 v$ O F+ Q' x5 a. r

>org.mybatis.scriptingmybatis-freemarker1.2.3

5 ~& ~9 ^9 b2 m; x. `) Q% G

>mysqlmysql-connector-java

; T( I5 _7 Y s. C( }( x6 J

>runtimeorg.projectlomboklombok

>trueorg.springframework.boot

>spring-boot-starter-testtest

) q+ B9 ]! `2 z4 K1 I

>org.springframework.cloudspring-cloud-dependencies

${spring-cloud.version}pomimport

>org.springframework.boot

>spring-boot-maven-pluginorg.projectlombok

lombok

7 ?3 E% x8 J& M* a2 B h2 A

>配置授权服务器在授权服务器中，主要是配置如何生成Token，以及注册的客户端有哪些package com.soa.supervision.uaa.config; 4 l% b2 A, E, w3 o, N2 l/ y " }. z2 H" \ x! ^ import com.soa.supervision.uaa.constant.AuthConstants; + p$ X, n1 n. `" |

6 f$ ^! `4 H! \4 |7 e/ L

import com.soa.supervision.uaa.domain.SecurityUser; + {( A# Y$ ]7 S$ N' T8 o+ k import org.springframework.beans.factory.annotation.Autowired;

3 Z8 |- a* ]- ^- z8 J* U5 v

import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; % E8 L: d9 s6 W

& C: s% t! N% z! g6 J

import org.springframework.core.io.ClassPathResource; import org.springframework.security.authentication.AuthenticationManager;

: \+ r/ B0 e( b+ y* c! j+ K+ V

import org.springframework.security.oauth2.common.DefaultOAuth2AccessToken; import org.springframework.security.oauth2.common.OAuth2AccessToken; ; a- E' I; C$ o! D+ N5 Y* o/ q

9 R+ K7 n) X) q) [% l

import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer; % q5 r: S% V! j' ]/ m

8 M( I! |, h: t

import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;

( {( g: R0 O- D z2 x' L% D: Q

import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;

) X* i5 }4 Z$ b, Z a. I

import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer; 8 t4 C0 a [ |5 }

import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;

import org.springframework.security.oauth2.provider.OAuth2Authentication; 1 L6 b! A( K- @& I import org.springframework.security.oauth2.provider.client.JdbcClientDetailsService; 4 x& \) I5 o! B8 r8 O6 r Z; H

7 O k5 I% n$ P' M& W/ |1 i

import org.springframework.security.oauth2.provider.endpoint.TokenKeyEndpoint; import org.springframework.security.oauth2.provider.token.TokenEnhancer;

import org.springframework.security.oauth2.provider.token.TokenEnhancerChain; import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter; 6 h5 G! i/ V, D, i- D# G

import org.springframework.security.oauth2.provider.token.store.KeyStoreKeyFactory; ; `8 r: t4 }& f' z import javax.annotation.Resource; & F. a" u4 j. K. d3 u$ G

$ R3 ~ G* _( E0 v4 t7 X0 {, g

import javax.sql.DataSource; import java.security.KeyPair; % s( E- Q( M5 q; m$ C, [& o import java.util.ArrayList; ! c7 w3 y9 z* N1 U import java.util.HashMap; 1 e3 v1 [) ]( P2 m' V' x

import java.util.List; ) } h" L8 E# a( y1 b, y import java.util.Map; ' a3 N& B( W, M8 {2 q /** * 授权服务器配置 8 c' s) Q/ R: M3 x7 m$ L* l0 p * 1、配置客户端 3 P! E p1 e: j. W * 2、配置Access_Token生成 ( h( T8 L. g; S * * @Author

/ \$ v; D1 s' @/ p' i$ ?5 M, S0 ?4 r

ChengJianSheng 2 n* |& P3 O* S * @Date 2022/2/14 / N& g( u, ^' R% f0 _ */@Configuration@EnableAuthorizationServerpublicclassAuthorizationServerConfig

extendsAuthorizationServerConfigurerAdapter{ @Resourceprivate DataSource dataSource; f( Y3 |0 x: n* \- g6 k8 ]) m4 g @Autowired

private AuthenticationManager authenticationManager; 8 p) E) g! v4 I: E+ W$ O 3 y$ J8 ^ P8 l! M# c! ?! `7 F7 O# D @Overridepublicvoidconfigure(ClientDetailsServiceConfigurer clients)

throws Exception { % \0 s6 j& p0 j9 C! G clients.withClientDetails(new JdbcClientDetailsService(dataSource)); 6 k! E* H! @6 d$ s- ?9 ` }

& T/ H) G8 p6 ~1 N0 p

@Overridepublicvoidconfigure(AuthorizationServerSecurityConfigurer security)throws Exception { + O2 W# I+ w/ x" P1 y7 T7 q security.allowFormAuthenticationForClients();

// security.tokenKeyAccess("permitAll()"); } * ~" C, |: B* B; l$ s; [: ] @Overridepublicvoidconfigure(AuthorizationServerEndpointsConfigurer endpoints)

7 i3 T1 y, N: c

throws Exception { List tokenEnhancerList = new ArrayList<>(); 5 P( H5 D8 ^: h( @. s tokenEnhancerList.add(jwtTokenEnhancer()); # e' U. n" \# b2 w( {9 R/ s tokenEnhancerList.add(jwtAccessTokenConverter()); TokenEnhancerChain tokenEnhancerChain =

, l! L# c0 y% ]- T5 ]1 P2 E# P7 C2 a

new TokenEnhancerChain(); 6 {# L7 l$ N3 P' L2 g; @0 ~ tokenEnhancerChain.setTokenEnhancers(tokenEnhancerList); 8 X1 E j$ U; |0 M- e endpoints.accessTokenConverter(jwtAccessTokenConverter()) 5 `- h8 T z( @1 N: W .tokenEnhancer(tokenEnhancerChain).authenticationManager(authenticationManager); 5 s2 y- R; P5 e5 b2 D! k& Q } 2 ^3 M- h* k+ t/ \/ v6 n # R, C( X( r% J1 c3 o2 ]6 D

/** 1 L: f$ }# f* C/ f' o% K * Token增强 */public TokenEnhancer jwtTokenEnhancer(){ * I8 I+ q, r+ R) j returnnew TokenEnhancer() { 0 U& ]5 x, N0 r, d; ]

@Overridepublic OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication)

3 T F3 O3 |# |1 g6 `1 T, X

{ SecurityUser securityUser = (SecurityUser) authentication.getPrincipal(); : f6 V9 ?6 i3 h! k$ _, I6 J0 V Map additionalInformation =

new HashMap<>(); # J8 U# ~0 Q& Q9 f, G additionalInformation.put(AuthConstants.JWT_USER_ID_KEY, securityUser.getUserId()); y! ]; `: E I$ w. X2 C( e4 x$ x additionalInformation.put(AuthConstants.JWT_USER_NAME_KEY, securityUser.getUsername()); additionalInformation.put(AuthConstants.JWT_DEPT_ID_KEY, securityUser.getDeptId()); ((DefaultOAuth2AccessToken)accessToken).setAdditionalInformation(additionalInformation); + b& z; X/ `- A% u. @9 J0 e

. d# P% O* |2 A0 {/ O" M# P+ ?; b

return accessToken; } , l1 P+ U+ U' i$ _3 P: J }; ) z/ j5 P4 L8 T( \: W } 4 ?! S% J3 X) D% ?0 u- V- C' G' z /** ! i5 e! ` P& O! D * 采用RSA加密算法对JWT进行签名 : l: j/ a1 `+ b */public JwtAccessTokenConverter

. Z! e/ g/ }! W/ y- G

jwtAccessTokenConverter(){ . |0 i3 ~. @/ T5 {& } JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter(); 3 c2 {4 j, C' T6 j jwtAccessTokenConverter.setKeyPair(keyPair());

$ I7 F7 O/ s$ [/ [7 Q

return jwtAccessTokenConverter; } 2 [3 Z! a2 p/ Y/ H9 e /** ' H! M( C" x n * 密钥对 6 F/ N- d; }8 e8 N8 i2 ^3 l */@Beanpublic KeyPair keyPair(){ 0 v. h- X3 X2 T- `0 J' x' J KeyStoreKeyFactory keyStoreKeyFactory =

- H' ?* I$ W4 q5 k6 }* Z! q3 \

new KeyStoreKeyFactory(new ClassPathResource("jwt.jks"), "123456".toCharArray()); 4 l. w- I' _6 l3 u return keyStoreKeyFactory.getKeyPair(

"jwt", "123456".toCharArray()); } @Beanpublic TokenKeyEndpoint tokenKeyEndpoint(){ return

new TokenKeyEndpoint(jwtAccessTokenConverter()); 3 _& c7 G0 ^1 i5 } } }说明：客户端是从数据库加载的密码模式下必须设置一个AuthenticationManager

采用JWT生成token是因为它轻量级，无需存储可以减小服务端的存储压力但是，为了实现退出功能，不得不将它存储到Redis中必须要对JWT进行加密，资源服务器在拿到客户端传的token时会去校验该token是否合法，否则客户端可能伪造token。

& \' R" F8 e1 H9 X

此处对token进行了增强，在token中加了几个字段分别表示用户ID和部门ID客户端表结构如下：DROPTABLEIFEXISTS`oauth_client_details`; 6 h3 Z% }) N- a6 ^! { CREATETABLE

5 e3 R- p1 K. f6 G

`oauth_client_details` ( `client_id`varchar(256) CHARACTERSET utf8 COLLATE utf8_general_ci NOTNULL

COMMENT客户端ID, `resource_ids`varchar(256) CHARACTERSET utf8 COLLATE utf8_general_ci NULLDEFAULTNULL, : _6 ?( ?7 G- E4 \, q

! b3 I' q" x' g3 t! z

`client_secret`varchar(256) CHARACTERSET utf8 COLLATE utf8_general_ci NULLDEFAULTNULLCOMMENT客户端密钥,

/ M6 m, F" P. U3 ]4 v" I( W

`scope`varchar(256) CHARACTERSET utf8 COLLATE utf8_general_ci NULLDEFAULTNULL, ; P# z8 a# v. G/ G+ M `authorized_grant_types`

- Q5 R" G( o& v2 S% \9 h) p

varchar(256) CHARACTERSET utf8 COLLATE utf8_general_ci NULLDEFAULTNULLCOMMENT授权类型, 3 u0 a6 N5 l6 L1 @ `web_server_redirect_uri`

8 C' S- J/ I6 E: I# U/ w

varchar(256) CHARACTERSET utf8 COLLATE utf8_general_ci NULLDEFAULTNULL, ?! o8 k" l* [) H `authorities`varchar(256) CHARACTER

SET utf8 COLLATE utf8_general_ci NULLDEFAULTNULL, X8 F$ G6 ~7 [; B# u9 S/ a `access_token_validity`int(11) NULLDEFAULTNULLCOMMENT

access_token的有效时间, % w1 g$ s) ?% D0 W `refresh_token_validity`int(11) NULLDEFAULTNULLCOMMENTrefresh_token的有效时间, `additional_information`

varchar(4096) CHARACTERSET utf8 COLLATE utf8_general_ci NULLDEFAULTNULL, 8 z& ] w/ M7 [+ T$ `" o `autoapprove`varchar(256)

. f9 _. m. [1 Y. I7 ^

CHARACTERSET utf8 COLLATE utf8_general_ci NULLDEFAULTNULLCOMMENT是否允许自动授权, PRIMARY KEY (`client_id`)

3 e+ Y4 \! m: v" _6 r1 q7 y. Q" g

USING BTREE 6 Y/ h5 x/ ^% w2 ]. L ) ENGINE = InnoDBCHARACTERSET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = DYNAMIC; INSERT

+ {9 }( G( p# P% a& C

INTO`oauth_client_details`VALUES (hello, order-resource, $2a$10$1Vun/h63tI4C48BqLsy2Zel5q5M2VW6w8KThoMfxww49wf9uv/dKy

, all, authorization_code,password,refresh_token, http://www.baidu.com, NULL, 7200, 7260, NULL, true);

INSERTINTO`oauth_client_details`VALUES (sso-client-1, NULL, $2a$10$CxEwmODmsp/HOB7LloeBJeqUjotmNzjpk2WmjxtPxAeOYifQWLfhW

3 N+ h: P z' h ?0 Z7 a7 H

, all, authorization_code, http://localhost:9001/sso-client-1/login/oauth2/code/custom, NULL, 180, 240

, NULL, true);本例中采用RSA非对称加密，密钥文件用的是java自带的keytools生成的

, }" j) l# t ^2 W& a- b

将来，认证服务器用私钥对token加密，然后将公钥公开package com.soa.supervision.uaa.controller; 3 B5 q' H6 d# g" {( b . t7 d* a% @8 e7 [! }2 h! v import com.nimbusds.jose.jwk.JWKSet; R# Y) p# p- ~6 r' M, @

import com.nimbusds.jose.jwk.RSAKey; ( d Q1 X t& Y' r% O, C import org.springframework.beans.factory.annotation.Autowired; & M/ z+ j/ |0 r/ C- n- R# G import

6 e$ B! @; e' g# L- M& t/ D

org.springframework.web.bind.annotation.GetMapping; 7 Z% ]" x+ {+ p' J* S" p import org.springframework.web.bind.annotation.RestController; ! C1 J" J, K9 v$ |& ?6 o

import java.security.KeyPair; # U" `' F) q, W( e import java.security.interfaces.RSAPublicKey; . _2 g% w7 w" K" Z' B0 S2 X( {2 u import java.util.Map; ; {; A6 w" G, `& m. j /** *

@Author ChengJianSheng * @Date 2022/2/15 */@RestControllerpublicclassKeyPairController{ @Autowired

private KeyPair keyPair; @GetMapping("/rsa/publicKey")public Map getKey() { RSAPublicKey publicKey = (RSAPublicKey)

this.keyPair.getPublic(); RSAKey key = new RSAKey.Builder(publicKey).build(); return new JWKSet(key).toJSONObject(); % T* ^$ Q2 @( _# l4 I/ x6 ~2 ? } # v+ M6 H, k$ ]; B& Y }

配置WebSecurity在WebSecurity中主要是配置用户，以及哪些请求需要认证以后才能访问package com.soa.supervision.uaa.config; " r: \; ^: A6 z" } import com.soa.supervision.uaa.service.impl.UserDetailsServiceImpl;

6 |4 i" d: t) D4 m V G0 U; k3 x/ N

import org.springframework.beans.factory.annotation.Autowired; ' h# {. B1 B) i3 q% a6 ~- p import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest; : x5 N2 | M5 [; i3 W

( c7 r+ p* r- |6 L; S

import org.springframework.context.annotation.Bean; 0 c% @. C0 J- G+ i- v" ` import org.springframework.context.annotation.Configuration; ) {" t4 w/ Z& Y, ?' t2 t% U# R

import org.springframework.security.authentication.AuthenticationManager; $ j, ]) r; S3 K& G; { import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

+ f2 F+ [5 b; L( y4 p" C0 X% K

import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

8 Y& a# M; s2 i8 f

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

4 a0 }! o& ^, }2 T4 B- q# u; O

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; 2 v _+ Q, ?* d( r0 J2 O0 L

/** 2 g$ m; H& }7 q! k% }/ j * @Author ChengJianSheng * @Date 2022/2/14 */@Configuration@EnableWebSecuritypublicclassWebSecurityConfig

extendsWebSecurityConfigurerAdapter{ ) u0 Q7 c! N6 Q% @% K3 {/ `; q0 M& u @Autowiredprivate UserDetailsServiceImpl userDetailsService; ; X% b6 A+ q" X4 k; @, J ; L( I* P- p6 Y3 g! ^& |% ^# s$ i

@Overrideprotectedvoidconfigure(HttpSecurity http)throws Exception { 7 E, D' R6 x8 f8 a http.authorizeRequests() + @% i( l# ]- a+ b( W- Z0 R .requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll() ( ?. d0 n. ~( {! A+ o; S/ v# ] .antMatchers(

8 F; O5 H' O, o

"/rsa/publicKey", "/menu/tree").permitAll() 9 L: ^/ ?/ J; h .anyRequest().authenticated() .and().formLogin().permitAll() 3 Q+ ?% p6 `3 x$ U7 ^: U! _+ O# P .and() .csrf().disable(); }

6 U D' G! |" S* P* i# o% C! c

@Overrideprotectedvoidconfigure(AuthenticationManagerBuilder auth)throws Exception { auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); }

@Bean@Overridepublic AuthenticationManager authenticationManagerBean()throws Exception { return

( ]$ F* @, b- k- N! j& f7 M

super.authenticationManagerBean(); v0 ?+ _7 \5 D/ Z$ H& c( d1 J } ' S! q2 t4 G1 s# u @Beanpublic PasswordEncoder passwordEncoder(){ ' f( W2 x) {- ^3 ?9 t+ ?

5 x; N$ B" g: n ?2 m

returnnew BCryptPasswordEncoder(); 1 s6 Z" y% h& f m } }UserDetailsService实现类package com.soa.supervision.uaa.service.impl;

import com.soa.supervision.uaa.domain.AuthUserDTO; ' n' B" e# N6 } A0 L" N) f7 F import com.soa.supervision.uaa.domain.SecurityUser;

import com.soa.supervision.uaa.service.SysUserService; 6 H, g ?: h+ [ import org.springframework.beans.factory.annotation.Autowired; # F8 u' e, ~- Q3 B5 I- t( s

{# x/ k* y1 x, T

import org.springframework.security.authentication.LockedException; & T: M! }! T( ^! Y& A& E% q; ^. k import org.springframework.security.core.authority.SimpleGrantedAuthority;

! A0 ^9 \& S3 h1 X2 C

import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; 9 w6 |1 x0 K8 F

import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service;

( V8 W8 W4 i5 m+ W3 \6 Q7 z

import java.util.Set; , x( h4 L1 Y* ^ import java.util.stream.Collectors; : U2 w- m- x- t+ B% {0 N' O' i4 u9 |3 K /** ; k: y7 t9 V, T! ]7 | * @Author ChengJianSheng * @Date 2022/2/14 */

@ServicepublicclassUserDetailsServiceImplimplementsUserDetailsService{ 2 o& u0 i9 m/ O9 R6 f' f& L @Autowiredprivate SysUserService sysUserService; 5 P* G$ z5 E9 c3 l3 G

@Overridepublic UserDetails loadUserByUsername(String username)throws UsernameNotFoundException { AuthUserDTO authUserDTO = sysUserService.getAuthUserByUsername(username); , j; ]# B) `6 l. `

if (null == authUserDTO) { 8 k1 O1 ]* y2 `6 I3 Y% M9 u; H thrownew UsernameNotFoundException("用户不存在"); & n* ~$ y9 y5 n } " ~& m' w w" b; ]4 f `% t+ I/ O

if (!authUserDTO.isEnabled()) { thrownew LockedException("账号被禁用"); } Set authorities = authUserDTO.getRoles().stream().map(SimpleGrantedAuthority::

new).collect(Collectors.toSet()); 9 D' ?1 Z8 C4 h% t# l returnnew SecurityUser(authUserDTO.getUserId(), authUserDTO.getDeptId(), authUserDTO.getUsername(), authUserDTO.getPassword(), authUserDTO.isEnabled(), authorities); . E) l+ \; X/ t2 J9 ~# ` } }

6 [* O* l" R+ m9 r6 H$ g

SysUserServicepackage com.soa.supervision.uaa.service; 5 u t( E3 m2 R1 q: c' p9 Y # J% E# C* t+ S" a8 ^ G. I7 @ import com.soa.supervision.uaa.domain.AuthUserDTO; $ Z) k* T% K/ n: T' U+ W* \+ o

/ K2 V7 _9 z4 d% Q4 x

import com.soa.supervision.uaa.entity.SysUser; : X( f6 M* j0 T: z* o) w; C import com.baomidou.mybatisplus.extension.service.IService; 5 l" A0 j* Q* h5 \! ~" H

- ~4 n* x9 P& T$ }

/** # f+ g: M, O2 B *

! w+ v$ J' [) v9 F! D * 用户表 服务类 & j1 t; w; Q0 u- n+ j) o *

9 h0 E4 o8 C4 f) K3 C1 ~ * # M u1 y/ B* @$ q; R) n! q! m * @author ChengJianSheng * @since 2022-02-14 / Q0 {4 G3 @# {' M4 ` */publicinterfaceSysUserService

extendsIService { ( R+ a. d/ f9 ^+ L6 x( Q AuthUserDTO getAuthUserByUsername(String username); ( }* i7 B; ^! a. ?4 \/ f8 S& m9 P+ ^ }AuthUserDTOpackage

com.soa.supervision.uaa.domain; import lombok.Data; 8 O) t1 X5 `7 ?* T' I3 `1 l import java.io.Serializable; + x( {- r R) c# [! G4 T import java.util.List; 2 Q6 q; \8 t6 V S6 H

/** * @Author ChengJianSheng * @Date 2022/2/15 1 V x" B R- u( X4 n; k */@DatapublicclassAuthUserDTOimplementsSerializable

! v9 `6 g! z O7 F3 \$ a

{ . {/ l# K" f. J% _* V1 B private Integer userId; % I/ U) V% o) t0 V; ? T private String username; private String password; ) A3 W3 t% C/ v) U0 B" z private Integer deptId;

1 k3 C! T9 w7 S I

privateboolean enabled; ( I4 h" v! V ^0 Y: I- v& n! | private List roles; 9 h3 `) o! i0 s4 H6 Z/ v }SysUserServiceImplpackagecom.soa.supervision

.uaa.service.impl; importcom.soa.supervision.uaa.domain.AuthUserDTO; importcom.soa.supervision.uaa.entity

.SysUser; % u* {$ z4 U; M+ n importcom.soa.supervision.uaa.mapper.SysUserMapper; importcom.soa.supervision.uaa.service.SysUserService

; , o( e7 U% t, Y, s; o# W importcom.baomidou.mybatisplus.extension.service.impl.ServiceImpl; * D; M6 o0 c8 v2 _' v5 Z. ]' ~% f importorg.springframework.beans.factory

# _1 n l/ j ~! X! @7 j) J

.annotation.Autowired; importorg.springframework.stereotype.Service; B2 _0 |# J5 E, O+ q $ F! ^, h$ X' a /** *

& |" V. B- G4 W2 @4 ~2 ^" x _5 X9 P * 用户表 服务实现类 4 q) X9 e* t# ?' O O5 S7 D0 w *

& v3 y& T: H b* l9 g * * @author ChengJianSheng * @since 2022-02-14 */

@Service ( K/ Z3 G; o4 Q- u" p( f public class SysUserServiceImpl extends ServiceImpl implements SysUserService { % M; q" x/ D3 q* G4 N% D: q% O I

) y1 w% u# K/ M5 x4 w

@Autowired 8 |* x |5 B8 M' P) b3 r" l private SysUserMapper sysUserMapper; 2 Z- D5 g( [6 S2 _- g @Override public AuthUserDTO getAuthUserByUsername(String username) {

' z; j/ |# t% p5 O( ]/ A: j

returnsysUserMapper.selectAuthUserByUsername(username); } }SysUserMapperpackage com.soa.supervision.uaa.mapper; C9 g: O! |/ U8 I. e- W# S

import com.soa.supervision.uaa.domain.AuthUserDTO; import com.soa.supervision.uaa.entity.SysUser; % U; A3 J1 {" Q$ R" |9 h8 M4 G4 e import

com.baomidou.mybatisplus.core.mapper.BaseMapper; 3 D- |1 d" B6 @! d W4 X2 }7 Z /** * 用户表 Mapper 接口 # W5 K* x z" D% u" p * ! @! m% I. ]+ m4 y * @author ChengJianSheng *

1 o% \- u4 v' G& o

@since 2022-02-14 */publicinterfaceSysUserMapperextendsBaseMapper { AuthUserDTO selectAuthUserByUsername

. f. ?2 I9 e% _$ b% D' F

(String username); }SysUserMapper.xml

"http://mybatis.org/dtd/mybatis-3-mapper.dtd">

>

column="id"/>

" @7 u' d( i1 m3 Q* }

/>

) ~/ f8 I/ I/ j9 N: e3 {2 L

="roles"ofType="string"javaType="list">

8 o& ~5 f: U+ [% d SELECT ( G# s8 { `# V9 O t1.id, t1.username, ; l& |! ~! x& |5 y' r' }, l8 s t1.`password`, : a# [5 v4 g0 H, ^9 E t1.dept_id, t1.enabled, . t; E# ^7 Y7 o( X/ O3 d8 U t3.`code` AS role_code FROM sys_user t1 7 j. q1 i* N% z$ j9 P$ [8 E. Z LEFT JOIN sys_user_role t2 ON t1.id = t2.user_id + E+ D/ ]$ w. l LEFT JOIN sys_role t3 ON t2.role_id = t3.id WHERE / Y9 X7 L9 q% J0 `4 {. g! @ t1.username = #{username} & Y3 [4 V% J) j4 U1 Z

5 l# {( w1 P: Q' e+ N! P3 x

UserDetailspackage com.soa.supervision.uaa.domain; ; w8 N7 v: Z8 t& B2 \/ M1 }+ N! b ; h; f( k. T( f, {: G import lombok.AllArgsConstructor;

5 D; ^' |7 w& |" B& M

import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority;

1 ^; [/ |% N+ P

import org.springframework.security.core.userdetails.UserDetails; import java.util.Collection; . f8 v: w3 U/ B( d l, \ import

9 j# y% S% H) t, k8 x8 U* B% t

java.util.Set; /** * P+ R; H9 f2 F% ~# @+ r * @Author ChengJianSheng 9 q$ t& Z; m2 B8 Z' a/ M* R * @Date 2022/2/14 */@AllArgsConstructorpublicclassSecurityUser

^3 l4 a4 k! R3 s8 Q* ^

implementsUserDetails{ /** * 扩展字段 ; n4 I& g9 _" M0 v4 d, A0 U */private Integer userId; private Integer deptId; / K# [) M( g+ k: }

' I$ E7 x# u' U$ `+ ]) B. z

private String username; # U0 j' A. [0 U/ G4 t3 z private String password; privateboolean enabled; private Set authorities; ) a2 H; }; k! c( w/ @ k % N2 U; q ]# G3 @$ H2 R

@Overridepublic Collection getAuthorities() { return authorities; } + H; S. m, A4 ?9 D4 m7 b 7 y/ `0 r. Q7 j5 }. z

5 `$ {8 F1 ^& F' Z3 l

@Overridepublic String getPassword(){ return password; } # k1 p) E1 r" M q @Overridepublic String getUsername

$ U- X: J* q. ^. [6 F/ n

(){ & H$ _. N! J1 `$ x return username; } 9 B T) e/ V% Y1 m @OverridepublicbooleanisAccountNonExpired(){ returntrue

! @+ `" }6 Y# F

; } 9 |7 w, V6 o9 F7 q/ e - d' g I1 L4 Y" r! ^" M @OverridepublicbooleanisAccountNonLocked(){ returntrue; } 6 o* b8 W4 I: [ R. o @Overridepublic

: b5 l% }+ p0 y6 {& I6 \

booleanisCredentialsNonExpired(){ returntrue; } @OverridepublicbooleanisEnabled(){ 8 O+ a9 C7 B" m! M3 A2 k5 z3 K

! ]% m" @& N |2 ` @3 ]

return enabled; } ( e2 E( v- T3 S( k5 C4 @ L2 ?5 v: ~ public Integer getUserId(){ return userId; 7 U! J* E1 o# _/ |1 D1 G! V- C } ! o9 x5 d9 y/ K" V' y5 F3 i8 k public Integer

: H& x" f+ p F9 G7 Y

getDeptId(){ return deptId; 5 p) [* B1 v. r8 g. f4 } } }登录默认的登录url是/login，本例中没有自定义登录页面，而是使用默认的登录页面 正常的密码模式下，输入用户名和密码，登录成功以后返回token。

本例中使用密码模式，所以写了个登录接口，而且也是取巧，覆盖了默认的/oauth/token端点package com.soa.supervision.uaa.controller; 8 _0 m7 T2 l6 w. ]5 N- N8 [& \ import com.tgf.common.domain.RespResult;

n; ~9 o: W" f' I

import com.tgf.common.util.RespUtils; 5 c- {6 {! y! U- o9 z/ f% c import org.springframework.beans.factory.annotation.Autowired; 3 N2 _; C/ J1 ^

import org.springframework.security.oauth2.common.OAuth2AccessToken; 3 ?8 ?9 {4 U! d+ R import org.springframework.security.oauth2.provider.endpoint.TokenEndpoint;

; ~4 R! S5 |3 I) m( g) K, N- r7 O0 c

import org.springframework.web.HttpRequestMethodNotSupportedException; import org.springframework.web.bind.

annotation.*; import java.security.Principal; import java.util.HashMap; import java.util.Map; $ o/ e/ c9 c/ e1 y$ z( \ /** *

- j# A! @$ K! B' g4 B' m1 P) Q

@Author ChengJianSheng * @Date 2022/2/18 " I, A! D# \. M */@RestController@RequestMapping("/oauth")publicclassAuthorizationController

* m6 d+ u- V1 |2 \7 p: K8 |* D0 m

{ 7 _! j. z% S& X: W* x3 f* S @Autowiredprivate TokenEndpoint tokenEndpoint; 4 \/ M+ }: W G9 | /** * 密码模式 登录 * @param principal % S0 u: S N8 W% H, L *

@param parameters * V# l! n2 G( w* u1 ` * @return * @throws HttpRequestMethodNotSupportedException */@PostMapping(

"/token")public RespResult postAccessToken(Principal principal, @RequestParam Map parameters) throws HttpRequestMethodNotSupportedException { ' T' ^* G2 b8 e) R# |' x OAuth2AccessToken oAuth2AccessToken = tokenEndpoint.postAccessToken(principal, parameters).getBody(); Map map = new HashMap<>(); # Y$ L& G3 u1 I" O# X

1 u) H: Z- P7 ?& \# m" Z0 F- \

// 缓存return RespUtils.success(); : d1 J! _# q7 E& N9 d8 a } /** . K' v: ?5 A& p! v * 退出 * @return */@PostMapping("/logout"

& s9 b2 O- G3 i, P: m8 E

)public RespResult logout() { // JSONObject payload = JwtUtils.getJwtPayload();// String jti = payload.getStr(SecurityConstants.JWT_JTI); // JWT唯一标识

3 |9 G- e- i+ E8 n3 @ ^* t# X( X

// Long expireTime = payload.getLong(SecurityConstants.JWT_EXP); // JWT过期时间戳(单位：秒)// if (expireTime != null) {

& o. f, S; {5 u3 ?$ @ X$ O

// long currentTime = System.currentTimeMillis() / 1000;// 当前时间（单位：秒）// if (expireTime > currentTime) { // token未过期，添加至缓存作为黑名单限制访问，缓存时间为token过期剩余时间

) H* `& ^$ Z5 e g4 \9 p

// redisTemplate.opsForValue().set(SecurityConstants.TOKEN_BLACKLIST_PREFIX + jti, null, (expireTime - currentTime), TimeUnit.SECONDS);

( l" q( c8 |" K! `- T4 f5 {+ y% A

// }// } else { // token 永不过期则永久加入黑名单// redisTemplate.opsForValue().set(SecurityConstants.TOKEN_BLACKLIST_PREFIX + jti, null);

// }// return Result.success("注销成功");return RespUtils.success(); } 7 ]! K9 u9 I" c1 V. p$ u# c* E }补充：授权码模式获取access_token

菜单登录以后，前端会查询菜单并展示，下面是菜单相关接口 SysMenuControllerpackage com.soa.supervision.uaa.controller; * c/ |3 r$ \! J Z* I+ e# j8 Z' E' Y import com.soa.supervision.uaa.domain.MenuVO;

2 ~- s5 d8 U! v

import com.soa.supervision.uaa.service.SysMenuService; import com.tgf.common.domain.RespResult; # I4 v( q# R) Q1 t* } import

com.tgf.common.util.RespUtils; ) F5 H" ~! X, c import org.springframework.beans.factory.annotation.Autowired; ! h9 k- U$ o% k- _, d import

" [) x1 O" {# R* O& O. b

org.springframework.web.bind.annotation.GetMapping; ) N5 }+ D7 N: y$ ? import org.springframework.web.bind.annotation.RequestMapping; + M* \4 m9 V5 q$ e6 [7 H" ^6 u! e

& M9 a6 A9 K/ f

import org.springframework.web.bind.annotation.RestController; 7 x3 e4 z: c* Z& }, n ) i4 P8 e2 ?6 z$ w% @7 w! H import java.util.Arrays; ; e! t3 M/ G' h" B Q( ]* }" d# ?. L import java.util.List; # |8 G, n$ H, @ 9 L+ w, L, q" D H; R4 O

! B" b. ]/ R9 c9 f. z9 t5 N

/** ; X+ W) Q0 ~8 \0 \7 u& y9 R, y *

, d8 k! _1 g2 v- X% U! ^

2 l. H, J" m8 r- i2 F * 菜单表 前端控制器 *

4 l, \( {$ j7 u * * @author ChengJianSheng ( }& S$ s3 f/ V3 _ c1 V Z! U * @since 2022-02-21 */@RestController@RequestMapping(

"/menu")publicclassSysMenuController{ @Autowiredprivate SysMenuService sysMenuService; . ?1 a* S6 R8 T- ~, F2 ~: _ @GetMapping(

"/tree")public RespResult tree(String systemCode) { List roleIds = Arrays.asList(1,2

' K0 v Q" d" P2 U% U) l2 |

); List voList = sysMenuService.getMenuByUserRoles(systemCode, roleIds); return

RespUtils.success(voList); ! S/ F+ \3 k6 w } v. Q0 A) r9 I# I }SysMenuServicepackage com.soa.supervision.uaa.service; import com.soa.supervision.uaa.domain.MenuVO; 9 z1 |. o7 r6 Z) M5 x+ \

# J6 x8 F( e& m8 y+ t5 x. i8 r+ V! ^8 v, F

import com.soa.supervision.uaa.entity.SysMenu; import com.baomidou.mybatisplus.extension.service.IService; ) L! w& W( x7 ^6 \6 g6 q

import java.util.List; & ~& n% C5 X: p! ]- M % n5 j/ P1 r4 W /** ) V1 G% V& q# G% X *

( {* G1 W. E3 s( S/ n. b * 菜单表 服务类 *

) O! X& w+ D* D5 I * * @author ChengJianSheng * @since 2022-02-21 - [6 I1 w5 `4 K b. y* e6 U */

publicinterfaceSysMenuServiceextendsIService { 8 O- L# H, m5 Q9 M$ ~8 g) Z List getMenuByUserRoles(String systemCode, List roleIds)

; 2 R- W! A; z$ _4 h( @; h' f" u }SysMenuServiceImplpackage com.soa.supervision.uaa.service.impl; $ @& z' |9 ?0 x& }5 `5 D import com.soa.supervision.uaa.domain.MenuVO;

import com.soa.supervision.uaa.entity.SysMenu; * B0 L- n! Q D import com.soa.supervision.uaa.mapper.SysMenuMapper; import

: t6 c* U o# u+ L+ G; h

com.soa.supervision.uaa.service.SysMenuService; - E, G8 J3 {; I; [0 C) S import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl; : l; I) o# x6 c' V

import org.springframework.beans.BeanUtils; , N- o( l% z' V import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.stereotype.Service; import java.util.ArrayList; ) `2 Q! p- m6 C* w8 z3 j" H import java.util.List; import

java.util.stream.Collectors; /** 8 i+ I; n( x M( @ *

& H9 F. ~5 N& g$ W# T

* 菜单表 服务实现类 8 z( F( v* y( k8 ]3 q *

* 4 q5 m' |+ ^9 O6 [ }" _ * @author ChengJianSheng * @since

2022-02-21 */@ServicepublicclassSysMenuServiceImplextendsServiceImpl implements

# {/ N& H/ s& S m3 u$ Z; F! n! n

SysMenuService{ " H5 q/ E( |/ F* r6 W @Autowiredprivate SysMenuMapper sysMenuMapper; . L9 `, w8 Q' z5 g2 S /** * 构造菜单树 ' K- K5 ^8 v4 A+ g& u * @param

' S" I; z$ {. u8 P! b) z% f

systemCode * @param roleIds }" D6 x9 [/ M) f0 f: D * @return */@Overridepublic List getMenuByUserRoles(String systemCode, List roleIds) { List voList = new ArrayList<>(); / W s2 X2 ^ B# i& K* D + _! \( r. G1 b, r# P List sysMenuList = sysMenuMapper.selectMenuByRole(systemCode, roleIds); # C `* d% E$ w# S

if (null == sysMenuList || sysMenuList.size() == 0) { ( r3 a" w. l- V7 d5 L! h return voList; } List menuVOList = sysMenuList.stream().map(e->{ MenuVO vo = new MenuVO(); 8 E/ @0 \2 o" K8 H; T9 l BeanUtils.copyProperties(e, vo); vo.setChildren(new ArrayList<>());

8 l; W4 x6 ?5 t8 V4 x! x9 b

return vo; }).distinct().collect(Collectors.toList()); ' x( U& x/ e& y+ k - R6 u$ a! G8 ?: y8 |5 m for (int i = 0; i < menuVOList.size(); i++) { : J. K+ _0 c5 E" T0 b

$ \- H+ F6 E9 j4 z% J0 H( ~; {

for (int j = 0; j < menuVOList.size(); j++) { if (menuVOList.get(i).getId().equals(menuVOList.

; P4 p; s4 B9 L) @5 V* L* b% m

get(j).getId())) { continue; 3 B& M7 i- q/ [ ^4 c. y, x } 7 ?) {4 E7 }3 @8 V if (menuVOList.get

% t, v8 Y& N7 r$ Y5 z+ X

(i).getId().equals(menuVOList.get(j).getParentId())) { 8 \/ }# o: ~4 p3 D' a4 ~4 f% D menuVOList.get(i).getChildren().add(menuVOList.

4 I6 H# h' _3 }+ m, r$ d

get(j)); } 2 F! R6 L; C/ t! j } } 8 F% ~: b% M; v. l. e* O& F& K6 X: c 8 Z: o/ v$ Y7 z; L return menuVOList.stream().filter(e->0==e.getParentId()).collect(Collectors.toList()); 6 c& [$ p" ]; _+ w: E) G& l } * I) a% u6 w6 Z$ R$ n5 }8 k }

MenuVOpackage com.soa.supervision.uaa.domain; * |8 C! A w% ~3 T! q7 ^" r2 n ; \$ h, X3 A6 \ import lombok.Data; % J: |3 g/ n5 G& U! z import java.io.Serializable; 1 R4 `. Q" `5 p ]# e* A import

0 c7 e6 U6 t' U" L

java.util.List; /** : ^0 _3 A# p+ m$ P5 @7 L * @Author ChengJianSheng . _. ~; C& n% m; v3 w6 H& T * @Date 2022/2/21 9 t$ m% w! }: u. W6 j */@Datapublicclass MenuVO implements

3 F2 `' z0 J9 Z

Serializable { private Integer id; , s9 |4 Q3 m/ s /** ! `/ H7 t$ k' e3 K * 菜单名称 */privateString name; \; g, f% Q a /** * 父级菜单ID */

private Integer parentId; 0 z6 z4 ^# C- w/ M8 ]$ j# Z /** * 路由地址 */privateString routePath; /** * 组件 */

# K6 |& g: C/ z' r# N

privateString component; /** + c7 o. }) N) q* @3 F * 图标 7 z. ]# x) H. }+ k */privateString icon; , x$ F# e: k/ U; d* u( A( U( w; p 2 O Q8 f" j9 V9 ~* D* O) F /** * 排序号 */private

Integer sort; /** * 子菜单 + j3 u9 Z: K3 i; Y z0 A# M */private List children; }SysMenuMapperpackage com.soa.supervision.uaa.mapper; , |7 r* h3 E5 E

7 L" x0 d! ~ J6 n

import com.soa.supervision.uaa.entity.SysMenu; import com.baomidou.mybatisplus.core.mapper.BaseMapper;

1 ~, w9 g, L( }& ^# N7 l

import org.apache.ibatis.annotations.Param; 8 k4 y; g: V! \( q0 b* Q3 K0 a import java.util.List; ' s! ~0 O* m: o) c ' Z& d! ?' [+ N+ ^ /** *

d8 m; k7 {, F$ ^; d6 }$ m * 菜单表 Mapper 接口 " c, q- y$ u, E9 |: o/ C+ [3 y1 A6 k *

8 ? Z9 T) {8 g7 @. f * / d2 Q, V0 ?" }! d *

@author ChengJianSheng * @since 2022-02-21 0 I, Y- p1 W! s+ f3 \+ a */publicinterfaceSysMenuMapperextendsBaseMapper

- O/ r) Z6 H8 E' Z% [

{ List selectMenuByRole(@Param("systemCode") String systemCode, @Param("roleIds") List roleIds); 6 Z1 r' o5 Z5 X0 x+ | }

3 m/ N. ]( x1 C: V- K3 A- i/ ~3 x

SysMenuMapper.xml

3 l+ u3 `2 w4 C

"http://mybatis.org/dtd/mybatis-3-mapper.dtd">

1 V4 C6 C' h1 H- J# Q) T

> ; b8 f; H; o; V; T3 R3 W3 \ SELECT t1.* 9 C1 K" s! j- F. i( z# w% p( g, m FROM 3 |- l9 ]9 Q* [5 t sys_menu t1 0 Q4 Z8 M8 E) a3 a# S6 A* w" a LEFT JOIN sys_role_menu t2 ON t1.id = t2.menu_id WHERE ; `3 O2 s2 M ~/ e. ~. ? t1.system_code = #{systemCode} * x6 T6 x: M) W% r2 T/ y AND t1.hidden = 0 AND t2.role_id IN

: O E+ @( a! I3 P4 {

#{roleId} ORDER BY ; c0 g9 M& \9 f5 p, F t1.sort ASC

; z" D2 G" ~4 U. V2 C2 m8 `

application.ymlserver:port:8094servlet:context-path:/soas-uaaspring:application:name:

soas-uaadatasource:url:jdbc:mysql://192.168.28.22:3306/demo?serverTimezone=Asia/Shanghai&useUnicode=true&characterEncoding=utf8&useSSL=false

' `: Y! o+ ^! v1 j7 W2 Z

driver-class-name:com.mysql.cj.jdbc.Driverusername:rootpassword:1234567redis:host:192.168.28.01port:6379

+ z8 r: p W: W4 ?5 @

password:123456logging:levelrg:springframework:security:debugmybatis-plus:configuration:log-implrg.apache.ibatis.logging.stdout.StdOutImpl

I5 }0 s. X/ r/ Z2 u9 S

3 网关在这里，网关相当于OAuth2中的资源服务器这么个角色网关代理了所有的业务微服务，如果说那些业务服务是资源的，那么网关就是资源的集合，访问网关就是访问资源，访问资源就要先认证再授权才能访问同时，网关又相当于一个公共方法，因此在这里做鉴权是比较合适的。

首先是依赖

="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"

; K7 R- Z1 B7 }" z* S

>4.0.0com.tgftgf-service-parent 2 P* z7 j3 O" U+ j( Y" F) o% b

$ Y6 d$ y* n( V/ X7 [) H . S a% V6 J, L$ Y y1 f! r, D7 t5 {$ {4 x

这个思路很新颖，打开了新世界的大门，谢谢分享