认证鉴权与API权限控制在微服务架构中的设计与实现（三）

 1 @Configuration
 2 @EnableResourceServer
 3 public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
 4     //http安全配置
 5     @Override
 6     public void configure(HttpSecurity http) throws Exception {
 7         //禁掉csrf，设置session策略
 8         http.csrf().disable()
 9                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
10                 .and()//默认允许访问
11                 .requestMatchers().antMatchers("/**")
12                 .and().authorizeRequests()
13                 .antMatchers("/**").permitAll()
14                 .anyRequest().authenticated()
15                 .and().logout() //logout注销端点配置
16                 .logoutUrl("/logout")
17                 .clearAuthentication(true)
18                 .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler())
19                 .addLogoutHandler(customLogoutHandler());
20     }
21     //添加自定义的CustomLogoutHandler
22     @Bean
23     public CustomLogoutHandler customLogoutHandler() {
24         return new CustomLogoutHandler();
25     }
26     //资源安全配置相关
27     @Override
28     public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
29         super.configure(resources);
30     }
31 }

 1 @RequestMapping(value = "/oauth/check_token")
 2    @ResponseBody
 3    public Map checkToken(CheckTokenEntity checkTokenEntity) {
 4     //CheckTokenEntity为自定义的dto
 5        Assert.notNull(checkTokenEntity, "invalid token entity!");
 6        //识别token
 7        OAuth2AccessToken token = resourceServerTokenServices.readAccessToken(checkTokenEntity.getToken());
 8     //判断token是否为空
 9        if (token == null) {
10            throw new InvalidTokenException("Token was not recognised");
11        }
12     //未过期
13        if (token.isExpired()) {
14            throw new InvalidTokenException("Token has expired");
15        }
16        //加载OAuth2Authentication
17        OAuth2Authentication authentication = resourceServerTokenServices.loadAuthentication(token.getValue());
18     //获取response，token合法性验证完毕
19        Map response = (Map) accessTokenConverter.convertAccessToken(token, authentication);
20        //check for api permission
21        if (response.containsKey("jti")) {
22            //上下文操作权限校验
23            Assert.isTrue(checkPermissions.checkPermission(checkTokenEntity));
24        }
25        
26        response.put("active", true);    // Always true if token exists and not expired
27        return response;
28    }

 1 public class JdbcTokenStore implements TokenStore {
 2     ...
 3     public OAuth2AccessToken readAccessToken(String tokenValue) {
 4         OAuth2AccessToken accessToken = null;
 5         try {
 6             //使用selectAccessTokenSql语句，调用了私有的extractTokenKey()方法
 7             accessToken = jdbcTemplate.queryForObject(selectAccessTokenSql, new RowMapper() {
 8                 public OAuth2AccessToken mapRow(ResultSet rs, int rowNum) throws SQLException {
 9                     return deserializeAccessToken(rs.getBytes(2));
10                 }
11             }, extractTokenKey(tokenValue));
12         }
13         //异常情况
14         catch (EmptyResultDataAccessException e) {
15             if (LOG.isInfoEnabled()) {
16                 LOG.info("Failed to find access token for token " + tokenValue);
17             }
18         }
19         catch (IllegalArgumentException e) {
20             LOG.warn("Failed to deserialize access token for " + tokenValue, e);
21             //不合法则移除
22             removeAccessToken(tokenValue);
23         }
24         return accessToken;
25     }
26     ...
27     //提取TokenKey方法
28     protected String extractTokenKey(String value) {
29         if (value == null) {
30             return null;
31         }
32         MessageDigest digest;
33         try {
34             //MD5
35             digest = MessageDigest.getInstance("MD5");
36         }
37         catch (NoSuchAlgorithmException e) {
38             throw new IllegalStateException("MD5 algorithm not available.  Fatal (should be in the JDK).");
39         }
40         try {
41             byte[] bytes = digest.digest(value.getBytes("UTF-8"));
42             return String.format("%032x", new BigInteger(1, bytes));
43         }
44         catch (UnsupportedEncodingException e) {
45             throw new IllegalStateException("UTF-8 encoding not available.  Fatal (should be in the JDK).");
46         }
47     }
48 }

http.authorizeRequests()
.antMatchers("/order/**").access("#oauth2.hasScope(‘select‘) and hasRole(‘ROLE_USER‘)") 

 1 @Component
 2 public class CustomCheckPermission implements CheckPermissions {
 3     @Autowired
 4     private PermissionService permissionService;
 5     @Override
 6     public boolean checkPermission(CheckTokenEntity checkTokenEntity) {
 7         String url = checkTokenEntity.getUri();
 8         Long affairId = checkTokenEntity.getAffairId();
 9         Long roleId = checkTokenEntity.getRoleId();
10         //校验
11         if (StringUtils.isEmpty(url) || affairId ) {
12             return true;
13         } else {
14             return permissionService.checkPermission(url, affairId, roleId);
15         }
16     }
17 }