发布时间：2025-06-24 18:54:28  作者：北方职教升学中心  阅读量：723

网关收到请求，直接转发给授权服务

3、白名单直接放行 * 2、校验token * 3、 * TODO：后期可以使用非对称加密 */ @Bean public JwtAccessTokenConverter jwtAccessTokenConverter(){ JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); // 设置秘钥 converter.setSigningKey(SIGN_KEY); return converter; } @Bean PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); }}

MyAuthorizationConfig类

@Configuration@EnableAuthorizationServerpublic class MyAuthorizationConfig extends AuthorizationServerConfigurerAdapter {   @Autowired   private TokenStore tokenStore;    /**     * 客户端存储策略，这里使用内存方式，后续可以存储在数据库     */    @Autowired    private ClientDetailsService clientDetailsService;    /**     * Security的认证管理器，密码模式需要用到     */    @Autowired    private AuthenticationManager authenticationManager;    @Autowired    private JwtAccessTokenConverter jwtAccessTokenConverter;    /**     * 配置令牌访问的安全约束     */    @Override    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {        security                //开启/oauth/token_key验证端口权限访问                .tokenKeyAccess("permitAll()")                //开启/oauth/check_token验证端口认证权限访问                .checkTokenAccess("permitAll()")                //表示支持 client_id 和 client_secret 做登录认证                .allowFormAuthenticationForClients();    }    //配置客户端    @Override    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {        //内存模式        clients.inMemory()                //客户端id                .withClient("test")                //客户端秘钥                .secret(new BCryptPasswordEncoder().encode("123456"))                //资源id，唯一，比如订单服务作为一个资源,可以设置多个                .resourceIds("order")                //授权模式，总共四种，1. authorization_code（授权码模式）、password（密码模式）、这个方法是为了在处理请求过程中创建一个新的请求对象，以便进行一些修改或增强。客户端发出请求给网关获取令牌
2、客户端携带令牌请求资源，请求直接到了网关层
5、 检查token是否存在        String token = getToken(exchange);        if (StringUtils.isBlank(token)) {            return invalidTokenMono(exchange);        }        //3 判断是否是有效的token        OAuth2AccessToken oAuth2AccessToken;        try {            //解析token，使用tokenStore            oAuth2AccessToken = tokenStore.readAccessToken(token);            Map<String, Object> additionalInformation = oAuth2AccessToken.getAdditionalInformation();            System.out.println(additionalInformation);            //取出用户身份信息            String user_name = additionalInformation.get("user_name").toString();            //获取用户权限            List<String> authorities = (List<String>) additionalInformation.get("authorities");            //将用户名和权限进行Base64加密            JSONObject jsonObject=new JSONObject();            jsonObject.put("user_name", user_name);            jsonObject.put("authorities",authorities);            String base = Base64.encode(jsonObject.toJSONString());           // ServerHttpRequest 中的 mutate 方法是用于创建一个修改后的请求对象的方法，而不改变原始请求对象。权限信息            String principal = jsonObject.getString("user_name");            JSONArray tempJsonArray = jsonObject.getJSONArray("authorities");            //权限            String[] authorities =  tempJsonArray.toArray(new String[0]);            //放入LoginVal            LoginVal loginVal = new LoginVal();                      loginVal.setUsername(principal);            loginVal.setAuthorities(authorities);                        //放入request的attribute中            request.setAttribute("login_message",loginVal);        }        filterChain.doFilter(request,response);    }}

ServiceController类

@RestControllerpublic class ServiceController {    @RequestMapping("/test")    public LoginVal test(HttpServletRequest httpServletRequest){       return  (LoginVal)httpServletRequest.getAttribute("login_message");    }}

3. Gateway网关

导入依赖

<dependencies>        <dependency>            <groupId>org.springframework.cloud</groupId>            <artifactId>spring-cloud-starter-gateway</artifactId>        </dependency>        <dependency>            <groupId>org.springframework.cloud</groupId>            <artifactId>spring-cloud-starter-security</artifactId>            <version>2.2.5.RELEASE</version>        </dependency>        <dependency>            <groupId>org.springframework.cloud</groupId>            <artifactId>spring-cloud-starter-oauth2</artifactId>            <version>2.2.5.RELEASE</version>        </dependency>        <dependency>            <groupId>org.springframework.security</groupId>            <artifactId>spring-security-oauth2-resource-server</artifactId>        </dependency>        <dependency>            <groupId>com.alibaba.cloud</groupId>            <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>        </dependency>        <dependency>            <groupId>org.projectlombok</groupId>            <artifactId>lombok</artifactId>        </dependency>        <dependency>            <groupId>cn.hutool</groupId>            <artifactId>hutool-all</artifactId>        </dependency>        <dependency>            <groupId>com.alibaba</groupId>            <artifactId>fastjson</artifactId>            <version>1.2.78</version>        </dependency>        <dependency>            <groupId>org.springframework.cloud</groupId>            <artifactId>spring-cloud-starter-loadbalancer</artifactId>        </dependency>    </dependencies>

application.yaml

server:  port: 7000spring:  main:    allow-bean-definition-overriding: true  application:    name: oauth2-cloud-gateway  cloud:    nacos:      ## 注册中心配置      discovery:        # nacos的服务地址，nacos-server中IP地址:端口号        server-addr: 127.0.0.1:8848    gateway:      ## 路由      routes:        ## id只要唯一即可，名称任意        - id: oauth2-cloud-auth-server          uri: lb://oauth2-cloud-auth-server          predicates:            ## Path Route Predicate Factory断言            - Path=/oauth/**        - id: oauth2-cloud-order          uri: lb://oauth2-cloud-service          predicates:            ## Path Route Predicate Factory断言            - Path=/test/**oauth2:  cloud:    sys:      parameter:        ignoreUrls:          - /oauth/token          - /oauth/authorize

 AccessTokenConfig类

/** * 令牌的配置 */@Configurationpublic class AccessTokenConfig {    private final static String SIGN_KEY="jwt";    /**     * 令牌的存储策略     */    @Bean    public TokenStore tokenStore() {        //使用JwtTokenStore生成JWT令牌        return new JwtTokenStore(jwtAccessTokenConverter());    }    /**     * JwtAccessTokenConverter     * TokenEnhancer的子类，在JWT编码的令牌值和OAuth身份验证信息之间进行转换。
目录
1. OAuth2.0授权服务
2. 资源服务
3. Gateway网关
4. 测试
 
在SpringSecurity+OAuth2.0 搭建认证中心和资源服务中心-CSDN博客 ​​​​​​
基础上整合网关和JWT实现分布式统一认证授权。implicit（简化模式）                //refresh_token并不是授权模式，                .authorizedGrantTypes("authorization_code","password","client_credentials","implicit","refresh_token")                //允许的授权范围，客户端的权限，这里的all只是一种标识，可以自定义，为了后续的资源服务进行权限控制                .scopes("all")                //false 则跳转到授权页面                .autoApprove(false)                //授权码模式的回调地址                .redirectUris("http://www.baidu.com"); //可以and继续添加客户端    }    @Bean    public AuthorizationServerTokenServices tokenServices() {        DefaultTokenServices services = new DefaultTokenServices();        //客户端端配置策略        services.setClientDetailsService(clientDetailsService);        //支持令牌的刷新        services.setSupportRefreshToken(true);        //令牌服务        services.setTokenStore(tokenStore);        //access_token的过期时间        services.setAccessTokenValiditySeconds(60 * 60 * 2);        //refresh_token的过期时间        services.setRefreshTokenValiditySeconds(60 * 60 * 24 * 3);        //设置令牌增强，使用jwt        services.setTokenEnhancer(jwtAccessTokenConverter);        return services;    }    /**     * 授权码模式的service，使用授权码模式authorization_code必须注入     */    @Bean    public AuthorizationCodeServices authorizationCodeServices() {        //授权码存在内存中        return new InMemoryAuthorizationCodeServices();    }    /**     * 配置令牌访问的端点     */    @Override    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {        endpoints                //授权码模式所需要的authorizationCodeServices                .authorizationCodeServices(authorizationCodeServices())                //密码模式所需要的authenticationManager                .authenticationManager(authenticationManager)                //令牌管理服务，无论哪种模式都需要                .tokenServices(tokenServices())                //只允许POST提交访问令牌，uri：/oauth/token                .allowedTokenEndpointRequestMethods(HttpMethod.POST);    }}

SecurityConfig类

/** * spring security的安全配置 */@Configuration@EnableWebSecuritypublic class SecurityConfig extends WebSecurityConfigurerAdapter {    /**     * 加密算法     */    @Autowired    JwtTokenUserDetailsService userDetailsService;    @Override    protected void configure(HttpSecurity http) throws Exception {        //todo 允许表单登录        http.authorizeRequests()                .anyRequest().authenticated()                .and()                .formLogin()                .loginProcessingUrl("/login")                .permitAll()                .and()                .csrf()                .disable();    }    @Override    protected void configure(AuthenticationManagerBuilder auth) throws Exception {       //从数据库中查询用户信息        auth.userDetailsService(userDetailsService);    }    /**     * AuthenticationManager对象在OAuth2认证服务中要使用，提前放入IOC容器中     * Oauth的密码模式需要     */    @Override    @Bean    public AuthenticationManager authenticationManagerBean() throws Exception {        return super.authenticationManagerBean();    }}

2. 资源服务

导入依赖

<dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-web</artifactId>        </dependency>        <dependency>        <groupId>cn.hutool</groupId>        <artifactId>hutool-all</artifactId>       </dependency>        <dependency>            <groupId>com.alibaba</groupId>            <artifactId>fastjson</artifactId>            <version>1.2.78</version>        </dependency>        <dependency>            <groupId>org.projectlombok</groupId>            <artifactId>lombok</artifactId>            <version>1.18.30</version>        </dependency>        <dependency>            <groupId>com.alibaba.cloud</groupId>            <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>        </dependency>

application.yaml

server:  port: 8081spring:  application:    name: oauth2-cloud-service  cloud:    nacos:      ## 注册中心配置      discovery:        # nacos的服务地址，nacos-server中IP地址:端口号        server-addr: 127.0.0.1:8848

 AuthenticationFilter类

@Componentpublic class AuthenticationFilter extends OncePerRequestFilter {    /**     * 具体方法主要分为两步     * 1. 解密网关传递的信息     * 2. 将解密之后的信息封装放入到request中     */    @Override    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {        //获取请求头中的用户信息        String token = request.getHeader("token");        if (token!=null){            //解密            String json = Base64.decodeStr(token);            JSONObject jsonObject = JSON.parseObject(json);            //获取用户身份信息、client_credentials（客户端模式）、            ServerHttpRequest tokenRequest = exchange.getRequest().mutate().header("token",base).build();            ServerWebExchange build = exchange.mutate().request(tokenRequest).build();            return chain.filter(build);        } catch (InvalidTokenException e) {            //解析token异常，直接返回token无效            return invalidTokenMono(exchange);        }    }    @Override    public int getOrder() {        return 0;    }    /**     * 对url进行校验匹配     */    private boolean checkUrls(List<String> urls,String path){        AntPathMatcher pathMatcher = new AntPathMatcher();        for (String url : urls) {            if (pathMatcher.match(url,path))                return true;        }        return false;    }    /**     * 从请求头中获取Token     */    private String getToken(ServerWebExchange exchange) {        String tokenStr = exchange.getRequest().getHeaders().getFirst("Authorization");        if (StringUtils.isBlank(tokenStr)) {            return null;        }        String token = tokenStr.split(" ")[1];        if (StringUtils.isBlank(token)) {            return null;        }        return token;    }    /**     * 无效的token     */    private Mono<Void> invalidTokenMono(ServerWebExchange exchange) {        return buildReturnMono(ResultMsg.builder()                .code(1004)                .msg("无效的token")                .build(), exchange);    }    private Mono<Void> buildReturnMono(ResultMsg resultMsg, ServerWebExchange exchange) {        ServerHttpResponse response = exchange.getResponse();        byte[] bits = JSON.toJSONString(resultMsg).getBytes(StandardCharsets.UTF_8);        DataBuffer buffer = response.bufferFactory().wrap(bits);        response.setStatusCode(HttpStatus.UNAUTHORIZED);        response.getHeaders().add("Content-Type", "application/json;charset:utf-8");        return response.writeWith(Mono.just(buffer));    }}

SysParameterConfig

@ConfigurationProperties(prefix = "oauth2.cloud.sys.parameter")@Data@Componentpublic class SysParameterConfig {    /**     * 白名单     */    private List<String> ignoreUrls;}

4. 测试

代码链接：Gateway+Springsecurity+OAuth2.0+JWT实现分布式统一认证授权资源-CSDN文库