单点登陆 ---密钥

一、需求描述

现在有A系统和B系统，需要在A系统进行单点登陆到B系统。

二、B系统要做事

1、提供一个可以让A系统登陆的网址

http://localhost:8083/Account/SingleSignOn/?u=xxx&token=FB92B341DBDB59D7

其中，u为加密后的用户名，token为B系统与A系统单点登录握手密钥

2、控制器中的方法代码如下

[AllowAnonymous]
        [NoTransaction]
        /// <summary>
        /// 执行单点登录
        /// </summary>
        public ActionResult SingleSignOn()
        {
            RedirectToRouteResult result = null;
            string usertokenString = Request.Params["token"];
            string userName = Request.Params["u"];
            string loginname = DESHelper.Decrypt(userName);
            string token = System.Configuration.ConfigurationSettings.AppSettings["token"];
            if (!string.IsNullOrEmpty(usertokenString))
            {
                if (usertokenString != token || string.IsNullOrEmpty(userName))
                {
                    result = RedirectToAction("NotRole", "Home");
                }
                else
                {
                    MembershipUser user = Membership.GetUser(loginname, false);
                    if (user == null)
                    {
                        //用户不存在
                        result = RedirectToAction("UserNotExist", "Home");
                    }
                    else if (user.IsLockedOut)
                    {
                        //用户被锁定
                        result = RedirectToAction("UserIsLockedOut", "Home");
                    }
                    else if (!user.IsApproved)
                    {
                        //用户未启用 
                        result = RedirectToAction("UserIsApproved", "Home");
                    }
                    else
                    {
                        LogInfoService lis = new LogInfoService();
                        LogInfo lilist = new LogInfo(ProfileHelper.GetName(), "登录", "登录");
                        lis.Save(lilist);
                        result = RedirectToAction("Index", "Member");
                    }
                }
            }
            else
                result = RedirectToAction("NotRole", "Home");

            Session["userid"] = loginname;
            System.Web.Security.FormsAuthentication.SetAuthCookie(loginname, true);
            return result;
        }

首先我们要接过传过来的token和用户名u,

其次我们要对用户名进行解密

最后我们要比较token是不是A系统认证的token，并查找用户名是否存在

如果都满足则让用户登陆

3、解密用户名，要步骤2中，要对传过来的用户名进行解密，加密解决的方法都提供了

/// <summary>
    /// DES对称加密
    /// </summary>
    public static class DESHelper
    {
        /// <summary>
        /// 根据用户名解密
        /// </summary>
        /// <param name="val"></param>
        /// <param name="userid"></param>
        /// <returns></returns>
        public static string Decrypt(string val, string userid = "")
        {

            var key = GetKey(userid);
            var iv = GetDefaultIV();
            return Decrypt(val, key, iv);
        }

        /// <summary>
        /// 根据用户名加密
        /// </summary>
        /// <param name="val"></param>
        /// <param name="userid"></param>
        /// <returns></returns>
        public static string Encrypt(string val, string userid = "")
        {

            var key = GetKey(userid);
            var iv = GetDefaultIV();
            return Encrypt(val, key, iv);
        }

        /// <summary>
        /// Des加密方法
        /// </summary>
        /// <param name="val"></param>
        /// <param name="key"></param>
        /// <param name="IV"></param>
        /// <returns></returns>
        public static string Encrypt(string val, string key, string IV, CipherMode cipherMode = CipherMode.ECB)
        {
            try
            {
                if (string.IsNullOrEmpty(key) || string.IsNullOrEmpty(key))
                {
                    throw new Exception("密钥和偏移向量不足8位");
                }

                if (key.Length > 8) key = key.Substring(0, 8);
                if (IV.Length > 8) IV = IV.Substring(0, 8);

                DESCryptoServiceProvider des = new DESCryptoServiceProvider();
                byte[] btKey = Encoding.Default.GetBytes(key);
                byte[] btIV = Encoding.Default.GetBytes(IV);
                StringBuilder builder = new StringBuilder();
                using (MemoryStream ms = new MemoryStream())
                {
                    byte[] inData = Encoding.Default.GetBytes(val);
                    using (CryptoStream cs = new CryptoStream(ms, des.CreateEncryptor(btKey, btIV), CryptoStreamMode.Write))
                    {
                        cs.Write(inData, 0, inData.Length);
                        cs.FlushFinalBlock();
                    }

                    foreach (byte num in ms.ToArray())
                    {
                        builder.AppendFormat("{0:X2}", num);
                    }
                } 
                return builder.ToString();
            }
            catch // (Exception ex)
            {
                return "";
            }
        }

        /// <summary>
        /// Des解密方法
        /// cbc模式：（key值和iv值一致）
        /// </summary>
        /// <param name="val"></param>
        /// <param name="key"></param>
        /// <param name="IV"></param>
        /// <returns></returns>
        public static string Decrypt(string val, string key, string IV, CipherMode cipherMode = CipherMode.ECB)
        {
            try
            {
                if (string.IsNullOrEmpty(key) || string.IsNullOrEmpty(key))
                {
                    throw new Exception("密钥和偏移向量不足8位");
                }

                if (key.Length > 8) key = key.Substring(0, 8);
                if (IV.Length > 8) IV = IV.Substring(0, 8);

                DESCryptoServiceProvider des = new DESCryptoServiceProvider();
                byte[] btKey = Encoding.Default.GetBytes(key);
                byte[] btIV = Encoding.Default.GetBytes(IV);
                using (MemoryStream ms = new MemoryStream())
                {
                    byte[] inData = new byte[val.Length / 2];
                    for (int i = 0; i < (val.Length / 2); i++)
                    {
                        int num2 = Convert.ToInt32(val.Substring(i * 2, 2), 0x10);
                        inData[i] = (byte)num2;
                    }

                    using (CryptoStream cs = new CryptoStream(ms, des.CreateDecryptor(btKey, btIV), CryptoStreamMode.Write))
                    {
                        cs.Write(inData, 0, inData.Length);
                        cs.FlushFinalBlock();
                    }

                    return Encoding.Default.GetString(ms.ToArray());
                }
            }
            catch // (System.Exception ex)
            {
                return "";
            }
        }

        /// <summary>
        /// Md5加密
        /// </summary>
        /// <param name="str"></param>
        /// <returns></returns>
        public static string MD5(string str)
        {
            if (string.IsNullOrEmpty(str)) return str;
            System.Security.Cryptography.MD5 md5 = System.Security.Cryptography.MD5.Create();
            string encoded = BitConverter.ToString(md5.ComputeHash(Encoding.UTF8.GetBytes(str))).Replace("-", "");
            return encoded;
        }

        private static string GetKey(string key)
        {
            string defaultKey = "C560F02F693B4A0BA62D2B3B5FB74534";
            string sTemp = defaultKey;
            if (!string.IsNullOrEmpty(key))
            {
                sTemp = string.Concat(key, defaultKey.Substring(key.Length, 32 - key.Length));
            }
            return MD5(sTemp).Substring(0, 8);
        }
        /// <summary>   
        /// 获得初始向量IV 
        /// </summary>   
        /// <returns>初试向量IV</returns>   
        private static string GetDefaultIV()
        {
            string sTemp = "87DE696F56DE49C0B96EB85139A48805";
            return MD5(sTemp).Substring(0, 8);
        }
    }

三、A系统要做的事

1、直接访问B提供的网址

http://localhost:8083/Account/SingleSignOn/?token=FB92B341DBDB59D7&u="+userName

其中用户名userName是进行加密了的

2、加密用户名的方法

public string GetUserId()
        {
           return Encrypt(HttpContext.Current.User.Identity.Name);
        }

        public string Encrypt(string val)
        {
            var key = "87DE696F";//测试期间请用此key使用
            try
            {
                DESCryptoServiceProvider des = new DESCryptoServiceProvider();
                byte[] btKey = Encoding.Default.GetBytes(key);
                byte[] btIV = Encoding.Default.GetBytes(key);
                StringBuilder builder = new StringBuilder();
                using (MemoryStream ms = new MemoryStream())
                {
                    byte[] inData = Encoding.Default.GetBytes(val);
                    using (CryptoStream cs = new CryptoStream(ms, des.CreateEncryptor(btKey, btIV), CryptoStreamMode.Write))
                    {
                        cs.Write(inData, 0, inData.Length);
                        cs.FlushFinalBlock();
                    }

                    foreach (byte num in ms.ToArray())
                    {
                        builder.AppendFormat("{0:x2}", num);
                    }
                }
                return builder.ToString();
            }
            catch // (Exception ex)
            {
                return "";
            }
        }