认证鉴权与API权限控制在微服务架构中的设计与实现（四）

1 //...
2     .and().logout()
3              .logoutUrl("/logout")
4              .clearAuthentication(true)
5              .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler())
6              .addLogoutHandler(customLogoutHandler());

 1 public class CustomLogoutHandler implements LogoutHandler {
 2     //...
 3     @Override
 4     public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
 5         //确定注入了tokenStore
 6         Assert.notNull(tokenStore, "tokenStore must be set");
 7        //获取头部的认证信息
 8         String token = request.getHeader("Authorization");
 9         Assert.hasText(token, "token must be set");
10         //校验token是否符合JwtBearer格式
11         if (isJwtBearerToken(token)) {
12             token = token.substring(6);
13             OAuth2AccessToken existingAccessToken = tokenStore.readAccessToken(token);
14             OAuth2RefreshToken refreshToken;
15             if (existingAccessToken != null) {
16                 if (existingAccessToken.getRefreshToken() != null) {
17                     LOGGER.info("remove refreshToken!", existingAccessToken.getRefreshToken());
18                     refreshToken = existingAccessToken.getRefreshToken();
19                     tokenStore.removeRefreshToken(refreshToken);
20                 }
21                 LOGGER.info("remove existingAccessToken!", existingAccessToken);
22                 tokenStore.removeAccessToken(existingAccessToken);
23             }
24             return;
25         } else {
26             throw new BadClientCredentialsException();
27         }
28     }
29     //...
30 }

method: get
url: http://localhost:9000/logout
header:
{
    Authorization: Basic ZnJvbnRlbmQ6ZnJvbnRlbmQ=
}

method: post 
url: http://localhost:12000/oauth/token?grant_type=refresh_token&refresh_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJYLUtFRVRTLVVzZXJJZCI6ImQ2NDQ4YzI0LTNjNGMtNGI4MC04MzcyLWMyZDYxODY4ZjhjNiIsInVzZXJfbmFtZSI6ImtlZXRzIiwic2NvcGUiOlsiYWxsIl0sImF0aSI6ImJhZDcyYjE5LWQ5ZjMtNDkwMi1hZmZhLTA0MzBlN2RiNzllZCIsImV4cCI6MTUxMDk5NjU1NiwianRpIjoiYWE0MWY1MjctODE3YS00N2UyLWFhOTgtZjNlMDZmNmY0NTZlIiwiY2xpZW50X2lkIjoiZnJvbnRlbmQifQ.mICT1-lxOAqOU9M-Ud7wZBb4tTux6OQWouQJ2nn1DeE
header:
{
    Authorization: Basic ZnJvbnRlbmQ6ZnJvbnRlbmQ=
}

 1 public class UsernamePasswordAuthenticationFilter extends
 2         AbstractAuthenticationProcessingFilter {
 3     //用户名、密码
 4     public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
 5     public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
 6     private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
 7     private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
 8     private boolean postOnly = true;
 9     //post请求/login
10     public UsernamePasswordAuthenticationFilter() {
11         super(new AntPathRequestMatcher("/login", "POST"));
12     }
13     //实现抽象类AbstractAuthenticationProcessingFilter的抽象方法，尝试验证
14     public Authentication attemptAuthentication(HttpServletRequest request,
15             HttpServletResponse response) throws AuthenticationException {
16         if (postOnly && !request.getMethod().equals("POST")) {
17             throw new AuthenticationServiceException(
18                     "Authentication method not supported: " + request.getMethod());
19         }
20         String username = obtainUsername(request);
21         String password = obtainPassword(request);
22         
23         //···
24         username = username.trim();
25         UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
26                 username, password);
27         //···
28         return this.getAuthenticationManager().authenticate(authRequest);
29     }
30 }

 1 public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
 2         implements ApplicationEventPublisherAware, MessageSourceAware {
 3     //...
 4     
 5     //调用requiresAuthentication，判断请求是否需要authentication，如果需要则调用attemptAuthentication
 6     //有三种结果可能返回：
 7     //1.Authentication对象
 8     //2. AuthenticationException
 9     //3. Authentication对象为空
10     public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
11             throws IOException, ServletException {
12         HttpServletRequest request = (HttpServletRequest) req;
13         HttpServletResponse response = (HttpServletResponse) res;
14         //不需要校验，继续传递
15         if (!requiresAuthentication(request, response)) {
16             chain.doFilter(request, response);
17             return;
18         }
19         Authentication authResult;
20         try {
21             authResult = attemptAuthentication(request, response);
22             if (authResult == null) {
23                 // return immediately as subclass has indicated that it hasn‘t completed authentication
24                 return;
25             }
26             sessionStrategy.onAuthentication(authResult, request, response);
27         }
28         //...
29         catch (AuthenticationException failed) {
30             // Authentication failed
31             unsuccessfulAuthentication(request, response, failed);
32             return;
33         }
34         // Authentication success
35         if (continueChainBeforeSuccessfulAuthentication) {
36             chain.doFilter(request, response);
37         }
38         successfulAuthentication(request, response, chain, authResult);
39     }
40     //实际执行的authentication，继承类必须实现该抽象方法
41     public abstract Authentication attemptAuthentication(HttpServletRequest request,
42             HttpServletResponse response) throws AuthenticationException, IOException,
43             ServletException;
44     //成功authentication的默认行为
45     protected void successfulAuthentication(HttpServletRequest request,
46             HttpServletResponse response, FilterChain chain, Authentication authResult)
47             throws IOException, ServletException {
48         //...
49     }
50     //失败authentication的默认行为
51     protected void unsuccessfulAuthentication(HttpServletRequest request,
52             HttpServletResponse response, AuthenticationException failed)
53             throws IOException, ServletException {
54     //...            
55     }
56     ...
57     //设置AuthenticationManager
58     public void setAuthenticationManager(AuthenticationManager authenticationManager) {
59         this.authenticationManager = authenticationManager;
60     }
61     ...
62 }

 1 @Override
 2    public void configure(HttpSecurity http) throws Exception {
 3     
 4     ...
 5     //添加CustomSecurityFilter，过滤器的顺序放在FilterSecurityInterceptor
 6        http.antMatcher("/oauth/check_token").addFilterAt(customSecurityFilter(), FilterSecurityInterceptor.class);
 7    }
 8    //提供实例化的自定义过滤器
 9    @Bean
10    public CustomSecurityFilter customSecurityFilter() {
11        return new CustomSecurityFilter();
12    }

 1 //通过一个实现的filter，对HTTP资源进行安全处理
 2 public class FilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {
 3     //被filter chain真实调用的方法，通过invoke代理
 4     public void doFilter(ServletRequest request, ServletResponse response,
 5             FilterChain chain) throws IOException, ServletException {
 6         FilterInvocation fi = new FilterInvocation(request, response, chain);
 7         invoke(fi);
 8     }
 9     //代理的方法
10     public void invoke(FilterInvocation fi) throws IOException, ServletException     {
11         //...省略
12     }
13 }

 1 public class CustomSecurityFilter extends AbstractSecurityInterceptor implements Filter {
 2    
 3     @Autowired
 4     SecureResourceFilterInvocationDefinitionSource invocationSource;
 5     @Autowired
 6     private AuthenticationManager authenticationManager;
 7     @Autowired
 8     private SecurityAccessDecisionManager decisionManager;
 9     //设置父类中的属性
10     @PostConstruct
11     public void init() {
12         super.setAccessDecisionManager(decisionManager);
13         super.setAuthenticationManager(authenticationManager);
14     }
15     //主要的过滤方法，与原来的一致
16     @Override
17     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
18         //logger.info("doFilter in Security ");
19         //构造一个FilterInvocation，封装request, response, chain
20         FilterInvocation fi = new FilterInvocation(servletRequest, servletResponse, filterChain);
21         //beforeInvocation会调用SecureResourceDataSource中的逻辑，类似于aop中的before 
22         InterceptorStatusToken token = super.beforeInvocation(fi);
23         try {
24             //执行下一个拦截器
25             fi.getChain().doFilter(fi.getRequest(), fi.getResponse());            
26         } finally {
27             //完成后续工作，类似于aop中的after 
28             super.afterInvocation(token, null);
29         }
30     }
31     
32     //...
33     
34     //资源源数据定义，设置为自定义的SecureResourceFilterInvocationDefinitionSource
35     @Override
36     public SecurityMetadataSource obtainSecurityMetadataSource() {
37         return invocationSource;
38     }
39 }

 1 protected InterceptorStatusToken beforeInvocation(Object object) {  
 2     //根据SecurityMetadataSource获取配置的权限属性  
 3     Collection attributes = this.obtainSecurityMetadataSource().getAttributes(object);  
 4     //...  
 5     //判断是否需要对认证实体重新认证，默认为否  
 6     Authentication authenticated = authenticateIfRequired();  
 7   
 8     // Attempt authorization  
 9     try {  
10         //决策管理器开始决定是否授权，如果授权失败，直接抛出AccessDeniedException  
11         this.accessDecisionManager.decide(authenticated, object, attributes);  
12     }  
13     catch (AccessDeniedException accessDeniedException) {  
14         publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,  
15                 accessDeniedException));  
16   
17         throw accessDeniedException;  
18     }  
19 }

 1 public class SecureResourceFilterInvocationDefinitionSource implements FilterInvocationSecurityMetadataSource, InitializingBean {
 2     private PathMatcher matcher;
 3     //map保存配置的URL对应的权限集
 4     private static Map> map = new HashMap();
 5     //根据传入的对象URL进行循环
 6     @Override
 7     public Collection getAttributes(Object o) throws IllegalArgumentException {
 8         logger.info("getAttributes");
 9         //应该做instanceof
10         FilterInvocation filterInvocation = (FilterInvocation) o;
11         //String method = filterInvocation.getHttpRequest().getMethod();
12         String requestURI = filterInvocation.getRequestUrl();
13         //循环资源路径，当访问的Url和资源路径url匹配时，返回该Url所需要的权限
14         for (Iterator>> iterator = map.entrySet().iterator(); iter.hasNext(); ) {
15             Map.Entry> entry = iterator.next();
16             String url = entry.getKey();
17             if (matcher.match(url, requestURI)) {
18                 return map.get(requestURI);
19             }
20         }
21         return null;
22     }
23     
24     //... 
25     
26     //设置权限集，即上述的map
27     @Override
28     public void afterPropertiesSet() throws Exception {
29         logger.info("afterPropertiesSet");
30         //用来匹配访问资源路径
31         this.matcher = new AntPathMatcher();
32         //可以有多个权限
33         Collection atts = new ArrayList();
34         ConfigAttribute c1 = new SecurityConfig("ROLE_ADMIN");
35         atts.add(c1);
36         map.put("/oauth/check_token", atts);
37     }
38 }

 1 public class SecurityAccessDecisionManager implements AccessDecisionManager {
 2     //...
 3     
 4     @Override
 5     public void decide(Authentication authentication, Object o, Collection collection) throws AccessDeniedException, InsufficientAuthenticationException {
 6         logger.info("decide url and permission");
 7         //集合为空
 8         if (collection == null) {
 9             return;
10         }
11         Iterator ite = collection.iterator();
12         //判断用户所拥有的权限，是否符合对应的Url权限，如果实现了UserDetailsService，则用户权限是loadUserByUsername返回用户所对应的权限
13         while (ite.hasNext()) {
14             ConfigAttribute ca = ite.next();
15             String needRole = ca.getAttribute();
16             for (GrantedAuthority ga : authentication.getAuthorities()) {
17                 logger.info("GrantedAuthority: {}", ga);
18                 if (needRole.equals(ga.getAuthority())) {
19                     return;
20                 }
21             }
22         }
23         logger.error("AccessDecisionManager: no right!");
24         throw new AccessDeniedException("no right!");
25     }
26     
27     //...
28 }