一、背景
随着咱们的微服务越来越多，如果每个微服务都要本人去实现一套鉴权操作，那么这么操作比拟冗余，因而咱们能够把鉴权操作对立放到网关去做，如果微服务本人有额定的鉴权解决，能够在本人的微服务中解决。
二、需要
1、在网关层实现url层面的鉴权操作。
- 所有的
OPTION申请都放行。 - 所有不存在申请，间接都回绝拜访。
user-provider服务的findAllUsers须要user.userInfo权限才能够拜访。
2、将解析后的jwt token当做申请头传递到上游服务中。
3、整合Spring Security Oauth2 Resource Server
三、前置条件
1、搭建一个可用的认证服务器，能够参考之前的文章.
2、晓得Spring Security Oauth2 Resource Server资源服务器如何应用，能够参考之前的文章.
四、我的项目构造
五、网关层代码的编写
1、引入jar包
<dependency> <groupId>com.alibaba.cloud</groupId> <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId></dependency><dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-gateway</artifactId></dependency><dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-oauth2-resource-server</artifactId></dependency><dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId></dependency><dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-loadbalancer</artifactId></dependency>2、自定义受权管理器
自定义受权管理器，判断用户是否有权限拜访
此处咱们简略判断
1、放行所有的 OPTION 申请。
2、判断某个申请(url)用户是否有权限拜访。
3、所有不存在的申请(url)间接无权限拜访。
package com.huan.study.gateway.config;import com.google.common.collect.Maps;import lombok.extern.slf4j.Slf4j;import org.springframework.http.HttpMethod;import org.springframework.http.server.reactive.ServerHttpRequest;import org.springframework.security.authentication.AbstractAuthenticationToken;import org.springframework.security.authorization.AuthorizationDecision;import org.springframework.security.authorization.ReactiveAuthorizationManager;import org.springframework.security.core.Authentication;import org.springframework.security.core.GrantedAuthority;import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;import org.springframework.security.web.server.authorization.AuthorizationContext;import org.springframework.stereotype.Component;import org.springframework.util.AntPathMatcher;import org.springframework.util.PathMatcher;import org.springframework.util.StringUtils;import org.springframework.web.server.ServerWebExchange;import reactor.core.publisher.Mono;import javax.annotation.PostConstruct;import java.util.Map;import java.util.Objects;/** * 自定义受权管理器，判断用户是否有权限拜访 * * @author huan.fu 2021/8/24 - 上午9:57 */@Component@Slf4jpublic class CustomReactiveAuthorizationManager implements ReactiveAuthorizationManager<AuthorizationContext> { /** * 此处保留的是资源对应的权限，能够从数据库中获取 */ private static final Map<String, String> AUTH_MAP = Maps.newConcurrentMap(); @PostConstruct public void initAuthMap() { AUTH_MAP.put("/user/findAllUsers", "user.userInfo"); AUTH_MAP.put("/user/addUser", "ROLE_ADMIN"); } @Override public Mono<AuthorizationDecision> check(Mono<Authentication> authentication, AuthorizationContext authorizationContext) { ServerWebExchange exchange = authorizationContext.getExchange(); ServerHttpRequest request = exchange.getRequest(); String path = request.getURI().getPath(); // 带通配符的能够应用这个进行匹配 PathMatcher pathMatcher = new AntPathMatcher(); String authorities = AUTH_MAP.get(path); log.info("拜访门路:[{}],所须要的权限是:[{}]", path, authorities); // option 申请，全副放行 if (request.getMethod() == HttpMethod.OPTIONS) { return Mono.just(new AuthorizationDecision(true)); } // 不在权限范畴内的url，全副回绝 if (!StringUtils.hasText(authorities)) { return Mono.just(new AuthorizationDecision(false)); } return authentication .filter(Authentication::isAuthenticated) .filter(a -> a instanceof JwtAuthenticationToken) .cast(JwtAuthenticationToken.class) .doOnNext(token -> { System.out.println(token.getToken().getHeaders()); System.out.println(token.getTokenAttributes()); }) .flatMapIterable(AbstractAuthenticationToken::getAuthorities) .map(GrantedAuthority::getAuthority) .any(authority -> Objects.equals(authority, authorities)) .map(AuthorizationDecision::new) .defaultIfEmpty(new AuthorizationDecision(false)); }}3、token认证失败、或超时的解决
package com.huan.study.gateway.config;import org.springframework.core.io.buffer.DataBuffer;import org.springframework.core.io.buffer.DataBufferUtils;import org.springframework.http.HttpStatus;import org.springframework.security.core.AuthenticationException;import org.springframework.security.web.server.ServerAuthenticationEntryPoint;import org.springframework.web.server.ServerWebExchange;import reactor.core.publisher.Mono;import java.nio.charset.StandardCharsets;/** * 认证失败异样解决 * * @author huan.fu 2021/8/25 - 下午1:10 */public class CustomServerAuthenticationEntryPoint implements ServerAuthenticationEntryPoint { @Override public Mono<Void> commence(ServerWebExchange exchange, AuthenticationException ex) { return Mono.defer(() -> Mono.just(exchange.getResponse())) .flatMap(response -> { response.setStatusCode(HttpStatus.UNAUTHORIZED); String body = "{\"code\":401,\"msg\":\"token不非法或过期\"}"; DataBuffer buffer = response.bufferFactory().wrap(body.getBytes(StandardCharsets.UTF_8)); return response.writeWith(Mono.just(buffer)) .doOnError(error -> DataBufferUtils.release(buffer)); }); }}4、用户没有权限的解决
package com.huan.study.gateway.config;import lombok.extern.slf4j.Slf4j;import org.springframework.context.annotation.Bean;import org.springframework.core.io.buffer.DataBuffer;import org.springframework.core.io.buffer.DataBufferUtils;import org.springframework.http.HttpStatus;import org.springframework.http.server.reactive.ServerHttpRequest;import org.springframework.http.server.reactive.ServerHttpResponse;import org.springframework.security.access.AccessDeniedException;import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler;import org.springframework.web.server.ServerWebExchange;import reactor.core.publisher.Mono;import java.nio.charset.StandardCharsets;/** * 无权限拜访异样 * * @author huan.fu 2021/8/25 - 下午12:18 */@Slf4jpublic class CustomServerAccessDeniedHandler implements ServerAccessDeniedHandler { @Override public Mono<Void> handle(ServerWebExchange exchange, AccessDeniedException denied) { ServerHttpRequest request = exchange.getRequest(); return exchange.getPrincipal() .doOnNext(principal -> log.info("用户:[{}]没有拜访:[{}]的权限.", principal.getName(), request.getURI())) .flatMap(principal -> { ServerHttpResponse response = exchange.getResponse(); response.setStatusCode(HttpStatus.FORBIDDEN); String body = "{\"code\":403,\"msg\":\"您无权限拜访\"}"; DataBuffer buffer = response.bufferFactory().wrap(body.getBytes(StandardCharsets.UTF_8)); return response.writeWith(Mono.just(buffer)) .doOnError(error -> DataBufferUtils.release(buffer)); }); }}5、将token信息传递到上游服务器中
package com.huan.study.gateway.config;import com.fasterxml.jackson.core.JsonProcessingException;import com.fasterxml.jackson.databind.ObjectMapper;import com.fasterxml.jackson.datatype.jdk8.Jdk8Module;import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;import org.springframework.http.server.reactive.ServerHttpRequest;import org.springframework.security.core.context.ReactiveSecurityContextHolder;import org.springframework.security.core.context.SecurityContext;import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;import org.springframework.web.server.ServerWebExchange;import org.springframework.web.server.WebFilter;import org.springframework.web.server.WebFilterChain;import reactor.core.publisher.Mono;/** * 将token信息传递到上游服务中 * * @author huan.fu 2021/8/25 - 下午2:49 */public class TokenTransferFilter implements WebFilter { private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper(); static { OBJECT_MAPPER.registerModule(new Jdk8Module()); OBJECT_MAPPER.registerModule(new JavaTimeModule()); } @Override public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) { return ReactiveSecurityContextHolder.getContext() .map(SecurityContext::getAuthentication) .cast(JwtAuthenticationToken.class) .flatMap(authentication -> { ServerHttpRequest request = exchange.getRequest(); request = request.mutate() .header("tokenInfo", toJson(authentication.getPrincipal())) .build(); ServerWebExchange newExchange = exchange.mutate().request(request).build(); return chain.filter(newExchange); }); } public String toJson(Object obj) { try { return OBJECT_MAPPER.writeValueAsString(obj); } catch (JsonProcessingException e) { return null; } }}6、网关层面的配置
package com.huan.study.gateway.config;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.core.convert.converter.Converter;import org.springframework.core.io.FileSystemResource;import org.springframework.core.io.Resource;import org.springframework.security.authentication.AbstractAuthenticationToken;import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;import org.springframework.security.config.web.server.SecurityWebFiltersOrder;import org.springframework.security.config.web.server.ServerHttpSecurity;import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;import org.springframework.security.oauth2.jwt.Jwt;import org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder;import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;import org.springframework.security.oauth2.server.resource.authentication.ReactiveJwtAuthenticationConverterAdapter;import org.springframework.security.oauth2.server.resource.web.server.ServerBearerTokenAuthenticationConverter;import org.springframework.security.web.server.SecurityWebFilterChain;import reactor.core.publisher.Mono;import java.io.IOException;import java.nio.file.Files;import java.security.KeyFactory;import java.security.NoSuchAlgorithmException;import java.security.interfaces.RSAPublicKey;import java.security.spec.InvalidKeySpecException;import java.security.spec.X509EncodedKeySpec;import java.util.Base64;/** * 资源服务器配置 * * @author huan.fu 2021/8/24 - 上午10:08 */@Configuration@EnableWebFluxSecuritypublic class ResourceServerConfig { @Autowired private CustomReactiveAuthorizationManager customReactiveAuthorizationManager; @Bean public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) throws NoSuchAlgorithmException, IOException, InvalidKeySpecException { http.oauth2ResourceServer() .jwt() .jwtAuthenticationConverter(jwtAuthenticationConverter()) .jwtDecoder(jwtDecoder()) .and() // 认证胜利后没有权限操作 .accessDeniedHandler(new CustomServerAccessDeniedHandler()) // 还没有认证时产生认证异样，比方token过期，token不非法 .authenticationEntryPoint(new CustomServerAuthenticationEntryPoint()) // 将一个字符串token转换成一个认证对象 .bearerTokenConverter(new ServerBearerTokenAuthenticationConverter()) .and() .authorizeExchange() // 所有以 /auth/** 结尾的申请全副放行 .pathMatchers("/auth/**", "/favicon.ico").permitAll() // 所有的申请都交由此处进行权限判断解决 .anyExchange() .access(customReactiveAuthorizationManager) .and() .exceptionHandling() .accessDeniedHandler(new CustomServerAccessDeniedHandler()) .authenticationEntryPoint(new CustomServerAuthenticationEntryPoint()) .and() .csrf() .disable() .addFilterAfter(new TokenTransferFilter(), SecurityWebFiltersOrder.AUTHENTICATION); return http.build(); } /** * 从jwt令牌中获取认证对象 */ public Converter<Jwt, ? extends Mono<? extends AbstractAuthenticationToken>> jwtAuthenticationConverter() { // 从jwt 中获取该令牌能够拜访的权限 JwtGrantedAuthoritiesConverter authoritiesConverter = new JwtGrantedAuthoritiesConverter(); // 勾销权限的前缀，默认会加上SCOPE_ authoritiesConverter.setAuthorityPrefix(""); // 从那个字段中获取权限 authoritiesConverter.setAuthoritiesClaimName("scope"); JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter(); // 获取 principal name jwtAuthenticationConverter.setPrincipalClaimName("sub"); jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(authoritiesConverter); return new ReactiveJwtAuthenticationConverterAdapter(jwtAuthenticationConverter); } /** * 解码jwt */ public ReactiveJwtDecoder jwtDecoder() throws IOException, NoSuchAlgorithmException, InvalidKeySpecException { Resource resource = new FileSystemResource("/Users/huan/code/study/idea/spring-cloud-alibaba-parent/gateway-oauth2/new-authoriza-server-public-key.pem"); String publicKeyStr = String.join("", Files.readAllLines(resource.getFile().toPath())); byte[] publicKeyBytes = Base64.getDecoder().decode(publicKeyStr); X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKeyBytes); KeyFactory keyFactory = KeyFactory.getInstance("RSA"); RSAPublicKey rsaPublicKey = (RSAPublicKey) keyFactory.generatePublic(keySpec); return NimbusReactiveJwtDecoder.withPublicKey(rsaPublicKey) .signatureAlgorithm(SignatureAlgorithm.RS256) .build(); }}7、网关yaml配置文件
spring: application: name: gateway-auth cloud: nacos: discovery: server-addr: localhost:8847 gateway: routes: - id: user-provider uri: lb://user-provider predicates: - Path=/user/** filters: - RewritePath=/user(?<segment>/?.*), $\{segment} compatibility-verifier: # 勾销SpringCloud SpringCloudAlibaba SpringBoot 等的版本查看 enabled: falseserver: port: 9203debug: true六、演示
1、客户端 gateway 在认证服务器领有的权限为 user.userInfo
2、user-provider服务提供了一个api findAllUsers，它会返回 零碎中存在的用户(假的数据) 和 解码后的token信息。
3、在网关层面，findAllUsers 须要的权限为 user.userInfo，正好 gateway这个客户端有这个权限，所以能够拜访。
演示GIF
七、代码门路
https://gitee.com/huan1993/spring-cloud-alibaba-parent/tree/master/gateway-oauth2