yudao
/
spring-cloud
mirror of https://gitee.com/zhijiantianya/yudao-cloud.git
3
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

gateway 完成使用 TokenAuthenticationFilter 实现身份验证的功能

pull/4/head
YunaiV 2022-06-04 19:14:35 +08:00
parent e5fed46ae1
commit bfb15aea09
8 changed files with 146 additions and 80 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/filter/TokenAuthenticationFilter.java
View File

@ -4,6 +4,7 @@ import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.iocoder.yudao.framework.common.exception.ServiceException;
import cn.iocoder.yudao.framework.common.pojo.CommonResult;
import cn.iocoder.yudao.framework.common.util.json.JsonUtils;
import cn.iocoder.yudao.framework.common.util.servlet.ServletUtils;
import cn.iocoder.yudao.framework.security.config.SecurityProperties;
import cn.iocoder.yudao.framework.security.core.LoginUser;
@ -41,28 +42,34 @@ public class TokenAuthenticationFilter extends OncePerRequestFilter {
@SuppressWarnings("NullableProblems")
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws ServletException, IOException {
// 情况一，基于 header[login-user] 获得用户，例如说来自 Gateway 或者其它服务透传
LoginUser loginUser = buildLoginUserByHeader(request);
// 情况二，基于 Token 获得用户
// 注意，这里主要满足直接使用 Nginx 直接转发到 Spring Cloud 服务的场景。
if (loginUser == null) {
String token = SecurityFrameworkUtils.obtainAuthorization(request, securityProperties.getTokenHeader());
if (StrUtil.isNotEmpty(token)) {
Integer userType = WebFrameworkUtils.getLoginUserType(request);
try {
// 1.1 基于 token 构建登录用户
LoginUser loginUser = buildLoginUserByToken(token, userType);
loginUser = buildLoginUserByToken(token, userType);
// 1.2 模拟 Login 功能，方便日常开发调试
if (loginUser == null) {
loginUser = mockLoginUser(request, token, userType);
}
// 2. 设置当前用户
if (loginUser != null) {
SecurityFrameworkUtils.setLoginUser(loginUser, request);
}
} catch (Throwable ex) {
CommonResult<?> result = globalExceptionHandler.allExceptionHandler(request, ex);
ServletUtils.writeJSON(response, result);
return;
}
}
}
// 设置当前用户
if (loginUser != null) {
SecurityFrameworkUtils.setLoginUser(loginUser, request);
}
// 继续过滤链
chain.doFilter(request, response);
}
@ -113,4 +120,9 @@ public class TokenAuthenticationFilter extends OncePerRequestFilter {
.setTenantId(WebFrameworkUtils.getTenantId(request));
}
private LoginUser buildLoginUserByHeader(HttpServletRequest request) {
String loginUserStr = request.getHeader(SecurityFrameworkUtils.LOGIN_USER_HEADER);
return StrUtil.isNotEmpty(loginUserStr) ? JsonUtils.parseObject(loginUserStr, LoginUser.class) : null;
}
}

2
yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/util/SecurityFrameworkUtils.java
View File

@ -22,6 +22,8 @@ public class SecurityFrameworkUtils {
public static final String AUTHORIZATION_BEARER = "Bearer";
public static final String LOGIN_USER_HEADER = "login-user";
private SecurityFrameworkUtils() {}
/**

31
yudao-gateway/pom.xml
View File

@ -35,10 +35,10 @@
<artifactId>spring-cloud-starter-loadbalancer</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-openfeign</artifactId>
</dependency>
<!-- <dependency>-->
<!-- <groupId>org.springframework.cloud</groupId>-->
<!-- <artifactId>spring-cloud-starter-openfeign</artifactId>-->
<!-- </dependency>-->
<!-- Registry 注册中心相关 -->
<dependency>
@ -48,4 +48,27 @@
</dependencies>
<build>
<!-- 设置构建的 jar 包名 -->
<finalName>${project.artifactId}</finalName>
<plugins>
<!-- 打包 -->
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>2.6.7</version> <!-- 如果 spring.boot.version 版本修改，则这里也要跟着修改 -->
<configuration>
<fork>true</fork>
</configuration>
<executions>
<execution>
<goals>
<goal>repackage</goal> <!-- 将引入的 jar 打入其中 -->
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>

5
yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/GatewayServerApplication.java
View File

@ -1,14 +1,9 @@
package cn.iocoder.yudao.gateway;
import cn.iocoder.yudao.module.system.api.oauth2.OAuth2TokenApi;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.openfeign.EnableFeignClients;
@SpringBootApplication
@EnableFeignClients(clients = {
OAuth2TokenApi.class
}) // TODO 芋艿：需要改下
public class GatewayServerApplication {
public static void main(String[] args) {

16
yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/config/TmpConfiguration.java
View File

@ -1,16 +0,0 @@
package cn.iocoder.yudao.gateway.config;
import org.springframework.cloud.client.loadbalancer.reactive.ReactorLoadBalancerExchangeFilterFunction;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.reactive.function.client.WebClient;
@Configuration
public class TmpConfiguration {
@Bean
public WebClient webClient(ReactorLoadBalancerExchangeFilterFunction lbFunction) {
return WebClient.builder().filter(lbFunction).build();
}
}

56
yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/TokenAuthenticationFilter.java
View File

@ -4,11 +4,11 @@ import cn.hutool.core.util.StrUtil;
import cn.iocoder.yudao.framework.common.pojo.CommonResult;
import cn.iocoder.yudao.framework.common.util.json.JsonUtils;
import cn.iocoder.yudao.gateway.util.SecurityFrameworkUtils;
import cn.iocoder.yudao.gateway.util.WebFrameworkUtils;
import cn.iocoder.yudao.module.system.api.oauth2.OAuth2TokenApi;
import cn.iocoder.yudao.module.system.api.oauth2.dto.OAuth2AccessTokenCheckRespDTO;
import cn.iocoder.yudao.module.system.api.oauth2.dto.OAuth2AccessTokenRespDTO;
import com.fasterxml.jackson.core.type.TypeReference;
import com.google.common.net.HttpHeaders;
import org.springframework.cloud.client.loadbalancer.reactive.ReactorLoadBalancerExchangeFilterFunction;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
@ -29,14 +29,21 @@ import java.util.function.Function;
*
* @author 芋道源码
*/
@Component // TODO 芋艿：要改成 configuration
@Component
public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
// @Resource
// private OAuth2TokenApi oauth2TokenApi;
private static final TypeReference<CommonResult<OAuth2AccessTokenCheckRespDTO>> CHECK_RESULT_TYPE_REFERENCE
= new TypeReference<CommonResult<OAuth2AccessTokenCheckRespDTO>>() {};
@Resource
private WebClient webClient;
private final WebClient webClient;
public TokenAuthenticationFilter(ReactorLoadBalancerExchangeFilterFunction lbFunction) {
// Q：为什么不使用 OAuth2TokenApi 进行调用？
// A1：Spring Cloud OpenFeign 官方未内置 Reactive 的支持 https://docs.spring.io/spring-cloud-openfeign/docs/current/reference/html/#reactive-support
// A2：校验 Token 的 API 需要使用到 header[tenant-id] 传递租户编号，暂时不想编写 RequestInterceptor 实现
// 因此，这里采用 WebClient，通过 lbFunction 实现负载均衡
this.webClient = WebClient.builder().filter(lbFunction).build();
}
@Override
public Mono<Void> filter(final ServerWebExchange exchange, GatewayFilterChain chain) {
@ -46,46 +53,23 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
return chain.filter(exchange);
}
// exchange = exchange.mutate().request(r -> r.headers(new Consumer<HttpHeaders>() {
// @Override
// public void accept(HttpHeaders headers) {
// headers.set("user-id", "1");
// }
// })).build();
// return Mono.fromCallable(new Callable<CommonResult<OAuth2AccessTokenCheckRespDTO>>() {
// @Override
// public CommonResult<OAuth2AccessTokenCheckRespDTO> call() throws Exception {
//// return oauth2TokenApi.checkAccessToken("1234");
// return CommonResult.success(new OAuth2AccessTokenCheckRespDTO().setUserId(1L));
// }
// }).subscribeOn(Schedulers.boundedElastic()).flatMap(new Function<CommonResult<OAuth2AccessTokenCheckRespDTO>, Mono<Void>>() {
// @Override
// public Mono<Void> apply(CommonResult<OAuth2AccessTokenCheckRespDTO> oAuth2AccessTokenCheckRespDTOCommonResult) {
// return chain.filter(exchange);
// }
// });
// 情况二，如果有 Token 令牌，则解析对应 userId、userType、tenantId 等字段，并通过 通过 Header 转发给服务
// TODO 芋艿：tenant-id
String tenantId = exchange.getRequest().getHeaders().getFirst("tenant-id");
return webClient.get()
.uri(OAuth2TokenApi.URL_CHECK, uriBuilder -> uriBuilder.queryParam("accessToken", token).build())
.header("tenant-id", tenantId)
.headers(httpHeaders -> WebFrameworkUtils.setTenantIdHeader(exchange, httpHeaders)) // 设置租户的 Header
.retrieve().bodyToMono(String.class) // 发起请求，设置 body 为 String 结果
// 处理请求的结果
.flatMap((Function<String, Mono<Void>>) body -> chain.filter(buildNewServerWebExchange(exchange, body)));
.flatMap((Function<String, Mono<Void>>) body -> chain.filter(buildNewServerWebExchange(exchange, body))); // 处理请求的结果
}
private ServerWebExchange buildNewServerWebExchange(ServerWebExchange exchange, String body) {
// 校验 Token 令牌失败，则直接返回
CommonResult<?> result = JsonUtils.parseObject(body, CommonResult.class);
CommonResult<OAuth2AccessTokenCheckRespDTO> result = JsonUtils.parseObject(body, CHECK_RESULT_TYPE_REFERENCE);
if (result == null || result.isError()) {
return exchange;
}
// 创建新的 exchange 对象
return exchange.mutate().request(builder -> builder.header("login-user", result.getData().toString())).build();
// 将访问令牌封装成 LoginUser，并设置到 login-user 的请求头，使用 json 存储值
return exchange.mutate().request(builder -> SecurityFrameworkUtils.setLoginUserHeader(builder, result.getData())).build();
}
@Override

29
yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/util/SecurityFrameworkUtils.java
View File

@ -1,8 +1,14 @@
package cn.iocoder.yudao.gateway.util;
import cn.hutool.core.map.MapUtil;
import cn.iocoder.yudao.framework.common.util.json.JsonUtils;
import cn.iocoder.yudao.module.system.api.oauth2.dto.OAuth2AccessTokenCheckRespDTO;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.util.StringUtils;
import org.springframework.web.server.ServerWebExchange;
import java.util.Map;
/**
* 安全服务工具类
*
@ -12,9 +18,11 @@ import org.springframework.web.server.ServerWebExchange;
*/
public class SecurityFrameworkUtils {
public static final String AUTHORIZATION_HEADER = "Authorization";
private static final String AUTHORIZATION_HEADER = "Authorization";
public static final String AUTHORIZATION_BEARER = "Bearer";
private static final String AUTHORIZATION_BEARER = "Bearer";
private static final String LOGIN_USER_HEADER = "login-user";
private SecurityFrameworkUtils() {}
@ -36,4 +44,21 @@ public class SecurityFrameworkUtils {
return authorization.substring(index + 7).trim();
}
/**
* 将访问令牌封装成 LoginUser，并设置到 login-user 的请求头，使用 json 存储值
*
* @param builder 请求
* @param token 访问令牌
*/
public static void setLoginUserHeader(ServerHttpRequest.Builder builder, OAuth2AccessTokenCheckRespDTO token) {
// 构建 LoginUser 对象。由于 Gateway 没有 loginUser 类，所以使用 Map
Map<String, Object> loginUser = MapUtil.newHashMap(4);
loginUser.put("id", token.getUserId());
loginUser.put("userType", token.getUserType());
loginUser.put("tenantId", token.getTenantId());
loginUser.put("scopes", token.getScopes());
// 设置到 Header 中
builder.header(LOGIN_USER_HEADER, JsonUtils.toJsonString(loginUser));
}
}

41
yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/util/WebFrameworkUtils.java Normal file
View File

@ -0,0 +1,41 @@
package cn.iocoder.yudao.gateway.util;
import cn.hutool.core.map.MapUtil;
import cn.hutool.core.util.StrUtil;
import cn.iocoder.yudao.module.system.api.oauth2.dto.OAuth2AccessTokenCheckRespDTO;
import org.springframework.http.HttpHeaders;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.web.server.ServerWebExchange;
import java.util.HashMap;
import java.util.Map;
/**
* Web 工具类
*
* copy from yudao-spring-boot-starter-web 的 WebFrameworkUtils 类
*
* @author 芋道源码
*/
public class WebFrameworkUtils {
@SuppressWarnings("UastIncorrectHttpHeaderInspection")
private static final String HEADER_TENANT_ID = "tenant-id";
private WebFrameworkUtils() {}
/**
* 将 Gateway 请求中的 header，设置到 HttpHeaders 中
*
* @param exchange Gateway 请求
* @param httpHeaders WebClient 的请求
*/
public static void setTenantIdHeader(ServerWebExchange exchange, HttpHeaders httpHeaders) {
String tenantId = exchange.getRequest().getHeaders().getFirst(HEADER_TENANT_ID);
if (StrUtil.isNotEmpty(tenantId)) {
return;
}
httpHeaders.set(HEADER_TENANT_ID, tenantId);
}
}