SpringCloud(10) ------>微服务下的Security

一、搭建认证中心

1、新建security-server认证中心

　父工程下 new modle-->maven项目-->项目名

2、向pom文件添加依赖

  <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
        </dependency>
        <!--jwt-->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.9.0</version>
        </dependency>

        <!--eureka客户端client-->
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
        </dependency>
        <!--actuator-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <!--security-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

        <!--mysql依赖-->
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
        </dependency>
        <!--mybatis plus依赖-->
        <dependency>
            <groupId>com.baomidou</groupId>
            <artifactId>mybatis-plus-boot-starter</artifactId>
            <version>3.4.1</version>
        </dependency>

3、application.yml配置

spring:
  profiles:
    active: default

#####################客户端单节点配置###################
---
spring:
  application:
    name: security-server
  profiles: default
  #mysql
  datasource: #数据源
    driver-class-name: com.mysql.cj.jdbc.Driver
    username: root
    password: root
    url: jdbc:mysql://localhost:3306/stmg?useUnicode=true&characterEncoding=utf-8&serverTimezone=Asia/Shanghai
server:
  port: 8085 #运行端口号

eureka:
  instance:
    lease-renewal-interval-in-seconds: 5
    #续约更新时间间隔
    lease-expiration-duration-in-seconds: 15
    #续约更新时间间隔
    hostname: localhost
    #指定主机地址
    instance-id: ${spring.cloud.client.ip-address}:${server.port}
  client:
    healthcheck:
      enabled: true
    register-with-eureka: true
    #注册到Eureka的注册中心
    fetch-registry: true
    #获取注册实例列表
    service-url:
      defaultZone:  http://localhost:8761/eureka
      #配置注册中心地址
    registry-fetch-interval-seconds: 10
    # 设置服务消费者从注册中心拉取服务列表的间隔

#mybatis-plus
mybatis-plus:
  mapper-locations: classpath:mapper/*.xml
  type-aliases-package: com.donleo.security.model
  configuration:
    map-underscore-to-camel-case: true

#log
logging:
  level:
    com.donleo.security.mapper: debug

jwt:
  #定义盐  密码
  secret: mySecret
  #过期时间(s)
  expiration: 1800
  #token 的类型 说明他以 bearer 开头
  tokenHead: bearer
  #token 对应的 key
  tokenHeader: Authorization
#  {Authorization: "bearer sdfdsfsdfsdfdsfsdfadfdsf"}

4、config配置

　　1）security配置

package com.donleo.security.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * @author liangd
 * @since 2021-01-15 17:36
 */
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and()
                .csrf().disable()
                .sessionManagement()// 基于token，所以不需要 securityContext
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers("/css/**", "/js/**", "/fonts/**", "/user/login", "/user/register","/user/checkAuth").permitAll() //都可以访问
                .antMatchers(HttpMethod.OPTIONS).permitAll()
                .anyRequest().authenticated() // 任何请求都需要认证
                .and()
                .userDetailsService(userDetailsService)
        ;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

　　2）跨域拦截配置

package com.donleo.security.config;


import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;

/**
 * @author liangd
 * @since 2021-01-15 17:38
 */
@Configuration
@Order(1)
public class FilterConfig {
    /**
     * SpringBoot升级2.4.0 需要将addAllowedOrigin替换成.addAllowedOriginPattern
     */
    private CorsConfiguration buildConfig(){
        CorsConfiguration corsConfiguration = new CorsConfiguration();
        corsConfiguration.addAllowedHeader("*"); // 允许任何的head头部
        corsConfiguration.addAllowedOrigin("*"); // 允许任何域名使用
        corsConfiguration.addAllowedMethod("*"); // 允许任何的请求方法
        corsConfiguration.setAllowCredentials(true);
        return corsConfiguration;
    }

    /**
     * 添加CorsFilter拦截器，对任意的请求使用
     * @return CorsFilter
     */
    @Bean
    public CorsFilter corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", buildConfig());
        return new CorsFilter(source);
    }
}

5、jwtTokenUtil工具类

package com.donleo.security.utils;


import com.donleo.security.model.User;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;

import java.util.*;
import java.util.stream.Collectors;

/**
 * JwtToken生成的工具类
 * JWT token的格式：header.payload.signature
 * header的格式（算法、token的类型）：
 * {"alg": "HS512","typ": "JWT"}
 * payload的格式（用户名、创建时间、生成时间）：
 * {"sub":"wang","created":1489079981393,"exp":1489684781}
 * signature的生成算法：
 * HMACSHA512(base64UrlEncode(header) + "." +base64UrlEncode(payload),secret)
 */
@Component
public class JwtTokenUtil {
    private static final Logger LOGGER = LoggerFactory.getLogger(JwtTokenUtil.class);
    private static final String CLAIM_KEY_USERNAME = "sub";
    private static final String CLAIM_KEY_CREATED = "created";
    private static final String CLAIM_KEY_AUTHORITY = "auth";

    @Value("${jwt.secret}")
    private String secret;
    @Value("${jwt.expiration}")
    private Long expiration;

    /**
     * 根据负责生成JWT的token
     */
    private String generateToken(Map<String, Object> claims) {
        return Jwts.builder()
                .setClaims(claims)
                .setExpiration(generateExpirationDate())
                .signWith(SignatureAlgorithm.HS512, secret)
                .compact();
    }

    /**
     * 从token中获取JWT中的负载
     */
    private Claims getClaimsFromToken(String token) {
        Claims claims = null;
        try {
            claims = Jwts.parser()
                    .setSigningKey(secret)
                    .parseClaimsJws(token)
                    .getBody();
        } catch (Exception e) {
            LOGGER.info("JWT格式验证失败:{}", token);
        }
        return claims;
    }

    /**
     * 生成token的过期时间
     */
    private Date generateExpirationDate() {
        return new Date(System.currentTimeMillis() + expiration * 1000);
    }

    /**
     * 从token中获取登录用户名(用户编号)
     */
    public String getUserCodeFromToken(String token) {
        String userCode;
        try {
            Claims claims = getClaimsFromToken(token);
            userCode = claims.getSubject();
        } catch (Exception e) {
            userCode = null;
        }
        return userCode;
    }

    /**
     * 验证token是否还有效
     *
     * @param token       客户端传入的token
     * @param userDetails 从数据库中查询出来的用户信息
     */
    public boolean validateToken(String token, UserDetails userDetails) {
        String userCode = getUserCodeFromToken(token);
        return userCode.equals(userDetails.getUsername()) && !isTokenExpired(token);
    }

    /**
     * 判断token是否已经失效
     */
    private boolean isTokenExpired(String token) {
        Date expiredDate = getExpiredDateFromToken(token);
        return expiredDate.before(new Date());
    }

    /**
     * 从token中获取过期时间
     */
    private Date getExpiredDateFromToken(String token) {
        Claims claims = getClaimsFromToken(token);
        return claims.getExpiration();
    }

    /**
     * 根据用户信息生成token(用户编号、时间以及权限)
     *
     * 如果采用远程调用来判断用户是否有权限，这里不需要将权限放进token中
     */
    public String generateToken(User user) {
        Map<String, Object> claims = new HashMap<>();
        Collection<? extends GrantedAuthority> authorities = user.getAuthorities();
        Set<Object> collect = authorities.stream().filter(p -> StringUtils.hasText(p.getAuthority()))
                .map(GrantedAuthority::getAuthority).collect(Collectors.toSet());
        claims.put(CLAIM_KEY_USERNAME, user.getCode());
        claims.put(CLAIM_KEY_CREATED, new Date());
        claims.put(CLAIM_KEY_AUTHORITY, collect);
        return generateToken(claims);
    }

    /**
     * 判断token是否可以被刷新
     */
    public boolean canRefresh(String token) {
        return !isTokenExpired(token);
    }

    /**
     * 刷新token
     */
    public String refreshToken(String token) {
        Claims claims = getClaimsFromToken(token);
        claims.put(CLAIM_KEY_CREATED, new Date());
        return generateToken(claims);
    }
}

6、model层

　1）User实体类实现UserDetails接口

package com.donleo.security.model;

import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableId;
import com.fasterxml.jackson.annotation.JsonFormat;
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import lombok.Data;
import lombok.EqualsAndHashCode;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.Collection;
import java.util.Date;
import java.util.Set;

/**
 * <p>
 * 用户表
 * </p>
 *
 * @author liangd
 * @since 2020-12-21
 */
@Data
@EqualsAndHashCode(callSuper = false)
public class User implements UserDetails {

    private static final long serialVersionUID = 1L;

    /**
     * id
     */
    @TableId(value = "id", type = IdType.AUTO)
    private Integer id;

    /**
     * 用户编号
     */
    private String code;

    /**
     * 用户名
     */
    private String username;

    /**
     * 密码
     */
    private String password;

    /**
     * 权限集合
     */
    @JsonIgnoreProperties(ignoreUnknown = true)
    private Set<? extends GrantedAuthority> authorities;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return this.authorities;
    }

    @Override
    public String getPassword() {
        return this.password;
    }

    @Override
    public String getUsername() {
        return this.username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    public void setAccountNonExpired(boolean accountNonExpired) {

    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    public void setAccountNonLocked(boolean accountNonLocked) {

    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    public void setCredentialsNonExpired(boolean credentialsNonExpired) {

    }

    @Override
    public boolean isEnabled() {
        if (this.dataEnable == null) {
            return false;
        }
        return "yes".equals(this.dataEnable);
    }

    public void setEnabled(boolean enabled) {

    }
}

　2）Permission实体类实现GrantedAuthority接口

package com.donleo.security.model;

import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableId;
import com.fasterxml.jackson.annotation.JsonFormat;
import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.EqualsAndHashCode;
import lombok.NoArgsConstructor;
import org.springframework.security.core.GrantedAuthority;

import java.util.Date;

/**
 * <p>
 * 权限表
 * </p>
 *
 * @author liangd
 * @since 2020-12-21
 */
@Data
@NoArgsConstructor
@AllArgsConstructor
@EqualsAndHashCode(callSuper = false)
public class Permission implements GrantedAuthority {

    private static final long serialVersionUID = 1L;

    /**
     * id
     */
    @TableId(value = "id", type = IdType.AUTO)
    private Integer id;

    /**
     * 权限编号
     */
    private String code;

    /**
     * 父id  0根节点
     */
    private Integer pid;

    /**
     * 权限名
     */
    private String name;

    /**
     * 权限值
     */
    private String value;

    /**
     * 类型 1菜单 2方法
     */
    private Integer type;

    /**
     * 方法路径
     */
    private String uri;

    /**
     * 创建时间
     */
    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
    private Date createTime;

    /**
     * 是否可用
     */
    private String dataEnable;

    @Override
    public String getAuthority() {
        return this.uri;
    }
}

7、service层，自定义UserDetailsService

package com.donleo.security.service.impl;

import com.donleo.security.model.Permission;
import com.donleo.security.model.User;
import com.donleo.security.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.HashSet;
import java.util.List;

/**
 * @author liangd
 * date 2020-12-08 19:10
 * code 自定义UserDetailsService
 */
@Service("userDetailsService")
public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    UserService userService;

    /**
     * 从数据库读取用户名认证
     * @param code 用户编号
     * @return UserDetails
     */
    @Override
    public UserDetails loadUserByUsername(String code) throws UsernameNotFoundException {
        User user= userService.getUserByCode(code);
        List<Permission> permissionList= userService.getPermissionsByUserCode(user.getCode());
        //获取用户拥有的权限
        HashSet<Permission> permissions = new HashSet<>(permissionList);
        user.setAuthorities(permissions);
        return user;
    }
}

8、启动类

/**
 * @author liangd
 * @since 2021-01-15 17:18
 */
@SpringBootApplication
@EnableDiscoveryClient
@MapperScan("com.donleo.security.mapper")
public class SecurityApp {
    public static void main(String[] args){
        SpringApplication.run(SecurityApp.class,args);
    }
}

二、zuul网关配置

（一）在网关拦截器处，从token中获取权限进行鉴权

1、向pom文件添加依赖

      <!--jwt-->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.9.0</version>
        </dependency>

2、application.yml添加配置

jwt:
  #定义盐  密码
  secret: mySecret
  #过期时间（s）
  expiration: 1800
  #token 的类型 说明他以 bearer 开头
  tokenHead: bearer
  #token 对应的 key
  tokenHeader: Authorization

3、jwtTokenUtil工具类

  在jwt的工具类添加获取权限路径的方法

 /**
     * 从token中获取权限uri
     */
    public Set<String> getAuthsFromToken(String token) throws  Exception{
        Claims claims = getClaimsFromToken(token);
        return getAuthsFromClaims(claims);
    }

    private Set<String> getAuthsFromClaims(Claims claims) {
        Object o = claims.get(CLAIM_KEY_AUTHORITY);
        HashSet hashSet =new HashSet((ArrayList)o);
        return hashSet;
    }

4、自定义网关Filter拦截器

package com.donleo.zuul.filter;

import com.alibaba.fastjson.JSONObject;
import com.donleo.zuul.common.CommonResult;
import com.donleo.zuul.service.UserService;
import com.donleo.zuul.utils.JwtTokenUtil;
import com.netflix.zuul.ZuulFilter;
import com.netflix.zuul.context.RequestContext;
import io.jsonwebtoken.ExpiredJwtException;
import org.apache.commons.lang.StringUtils;
import org.apache.http.HttpStatus;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.List;
import java.util.Set;
import java.util.concurrent.CountDownLatch;

/**
 * 自定义网关过滤器
 *
 * @author liangd
 * @since 2021-01-12 18:52
 */
@Component
public class LogFilter extends ZuulFilter {
    /**
     * 分割成数组
     */
    @Value("#{'${pathList}'.split(',')}")
    private List<String> pathList;

    @Autowired
    private JwtTokenUtil jwtTokenUtil;

    @Autowired
    private UserService userService;

    /**
     * 过滤器的类型。可选值有：
     * pre - 前置过滤
     * route - 路由后过滤
     * error - 异常过滤
     * post - 远程服务调用后过滤
     */
    @Override
    public String filterType() {
        return "pre";
    }

    /**
     * 同种类的过滤器的执行顺序。
     * 按照返回值的自然升序执行。
     * 值越小，级别越高
     */
    @Override
    public int filterOrder() {
        return 0;
    }

    /**
     * 哪些请求会被过滤
     */
    @Override
    public boolean shouldFilter() {
   /*     RequestContext currentContext = RequestContext.getCurrentContext();
        HttpServletRequest request = currentContext.getRequest();
        String requestURI = request.getRequestURI();
        //只有/api/w 开头的会被过滤
        return requestURI.startsWith("/api/w");*/
        //true 默认所有请求都会过滤
        return true;
    }

    @Override
    public Object run() {
        RequestContext requestContext = RequestContext.getCurrentContext();
        HttpServletResponse response = requestContext.getResponse();
        response.setContentType("text/html;charset=UTF-8");
        HttpServletRequest request = requestContext.getRequest();
        String uri = request.getRequestURI();
        //哪些路径可以直接放行
        boolean a = pathList.stream().anyMatch(path -> StringUtils.contains(uri, path));
        //第一种方式，从token读取权限
        //第二种方式，远程调用security服务,将判断逻辑在security服务中判断是否有访问该路径的权限
        if (a) {
            return null;
        }
        String authorization = request.getHeader("Authorization");
        if (authorization == null) {
            requestContext.setResponseBody(JSONObject.toJSONString(CommonResult.unauthorized("未登录")));
            requestContext.setSendZuulResponse(false);
            return null;
        }
        String token = StringUtils.substring(authorization, "bearer".length()).trim();
        /************************第一种方式，从token读取权限*******************************/
       Set<String> auths = null;
        try {
            auths = jwtTokenUtil.getAuthsFromToken(token);
        } catch (Exception e) {
            // 处理token过期
            if (e instanceof ExpiredJwtException) {
                requestContext.setResponseBody(JSONObject.toJSONString(CommonResult.unauthorized("token已过期")));
                requestContext.setSendZuulResponse(false);
                return null;
            }
            e.printStackTrace();
        }
        //验证权限
        assert auths != null;
        boolean b = auths.stream().anyMatch(auth -> StringUtils.equals(auth, uri));
        if (!b) {
            requestContext.setResponseBody(JSONObject.toJSONString(CommonResult.forbidden("没有访问权限")));
            requestContext.setSendZuulResponse(false);
            return null;
        }
        return null;
     
}

（二）用OpenFeign远程调用接口，在认证中心进行鉴权

　　当一个用户的权限过多，可以考虑通过远程调用接口的方式进行鉴权，这里采用OpenFeign调用接口的方式。

1、向pom文件新增依赖

      <!--声明式服务调用openfeign-->
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-openfeign</artifactId>
        </dependency>

2、service层

package com.donleo.zuul.service;

import com.donleo.zuul.common.CommonResult;
import com.donleo.zuul.config.FeignClientConfig;
import com.donleo.zuul.service.impl.UserServiceFallbackFactory;
import org.springframework.cloud.openfeign.FeignClient;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;

/**
 * @author liangd
 * @since 2021-01-16 11:16
 */
@FeignClient(value = "security-server",fallbackFactory = UserServiceFallbackFactory.class,configuration = FeignClientConfig.class)
public interface UserService {

    @PostMapping("/user/checkAuth")
    CommonResult checkAuth(@RequestParam("userCode") String userCode, @RequestParam("uri") String uri);
}

3、fallbackFactory服务降级处理

package com.donleo.zuul.service.impl;

import com.donleo.zuul.common.CommonResult;
import com.donleo.zuul.service.UserService;
import feign.hystrix.FallbackFactory;
import org.springframework.stereotype.Component;

/**
 * @author liangd
 * @since 2021-01-16 11:24
 */
@Component
public class UserServiceFallbackFactory implements FallbackFactory<UserService> {
    @Override
    public UserService create(Throwable throwable) {
        return (userCode, uri) -> CommonResult.failed("连接异常");
    }
}

4、自定义网关Filter拦截器

 @Override
    public Object run() {
        RequestContext requestContext = RequestContext.getCurrentContext();
        HttpServletResponse response = requestContext.getResponse();
        response.setContentType("text/html;charset=UTF-8");
        HttpServletRequest request = requestContext.getRequest();
        String uri = request.getRequestURI();
        //哪些路径可以直接放行
        boolean a = pathList.stream().anyMatch(path -> StringUtils.contains(uri, path));
        //第一种方式，从token读取权限
        //第二种方式，远程调用security服务,将判断逻辑在security服务中判断是否有访问该路径的权限
        if (a) {
            return null;
        }
        String authorization = request.getHeader("Authorization");
        if (authorization == null) {
            requestContext.setResponseBody(JSONObject.toJSONString(CommonResult.unauthorized("未登录")));
            requestContext.setSendZuulResponse(false);
            return null;
        }
        String token = StringUtils.substring(authorization, "bearer".length()).trim();
  
        /************************第二种方式，远程调用security服务**************************/
        try {
            jwtTokenUtil.isTokenExpired(token);
        } catch (Exception e) {
            if (e instanceof ExpiredJwtException) {
                requestContext.setResponseBody(JSONObject.toJSONString(CommonResult.unauthorized("token已过期")));
                requestContext.setSendZuulResponse(false);
                return null;
            }
            e.printStackTrace();
        }
        String userCode = jwtTokenUtil.getUserCodeFromToken(token);
        CommonResult commonResult = userService.checkAuth(userCode, uri);
        long code = commonResult.getCode();
        if (code == 200) {
            return null;
        } else if (code == 500) {
            requestContext.setResponseBody(JSONObject.toJSONString(CommonResult.forbidden("没有访问权限")));
            requestContext.setSendZuulResponse(false);
            return null;
        } else {
            requestContext.setResponseBody(JSONObject.toJSONString(CommonResult.failed("未知错误")));
            requestContext.setSendZuulResponse(false);
            return null;
        }
    }

 5、启动类上添加注解@EnableFeignClients