背景

整个项目设置了统一的返回数据格式，需要修改资源服务器获取认证中心的用户信息后的解析。因为资源服务器和zuul网关是整合为一个服务的，向下游的服务转发时需要携带用户id。所以也需要修改线程保存的用户信息。

spring cloud 认证大致思路

当用户携带token访问zuul网关时经过zuul过滤器，因为需要认证而转发到认证服务器，认证服务使用rabbion组件访问认证中心获取用户信息（调用类为RemoteTokenServices），使用类 AccessTokenConverter（默认实现类 DefaultAccessTokenConverter）解析token，具体解析封装在类 UserAuthenticationConverter（默认实现为 DefaultUserAuthenticationConverter），然后经过认证将用户信息（user_name）放入 SecurityContextHolder.setContext(SecurityContext context) 的 authentication() 实例中，以供程序获取当前用户信息。

修改思路

重写 RemoteTokenServices 、 AccessTokenConverter 和 UserAuthenticationConverter的实现类。将用户id放入SecurityContext中。

MyRemoteTokenServices.java

  1. package com.boya.web.config.oauth;
  3. import java.io.IOException;
  4. import java.io.UnsupportedEncodingException;
  5. import java.util.Map;
  7. import org.apache.commons.logging.Log;
  8. import org.apache.commons.logging.LogFactory;
  9. import org.springframework.beans.factory.annotation.Value;
  10. import org.springframework.http.HttpEntity;
  11. import org.springframework.http.HttpHeaders;
  12. import org.springframework.http.HttpMethod;
  13. import org.springframework.http.MediaType;
  14. import org.springframework.http.client.ClientHttpResponse;
  15. import org.springframework.security.core.AuthenticationException;
  16. import org.springframework.security.oauth2.common.OAuth2AccessToken;
  17. import org.springframework.security.oauth2.common.exceptions.InvalidTokenException;
  18. import org.springframework.security.oauth2.provider.OAuth2Authentication;
  19. import org.springframework.security.oauth2.provider.token.AccessTokenConverter;
  20. import org.springframework.security.oauth2.provider.token.ResourceServerTokenServices;
  21. import org.springframework.util.LinkedMultiValueMap;
  22. import org.springframework.util.MultiValueMap;
  23. import org.springframework.web.client.DefaultResponseErrorHandler;
  24. import org.springframework.web.client.RestOperations;
  25. import org.springframework.web.client.RestTemplate;
  27. import com.alibaba.fastjson.JSON;
  28. import com.alibaba.fastjson.JSONObject;
  29. import com.boya.config.response.HttpResponseBase;
  31. //@Primary
  32. //@Service
  33. public class MyRemoteTokenServices implements ResourceServerTokenServices {
  35.     protected final Log logger = LogFactory.getLog(getClass());
  37.     private RestOperations restTemplate;
  39.     @Value("${security.oauth2.resource.token-info-uri}")
  40.     private String checkTokenEndpointUrl;
  42.     @Value("${security.oauth2.client.client-id}")
  43.     private String clientId;
  45.     @Value("${security.oauth2.client.client-secret}")
  46.     private String clientSecret;
  48.     private String tokenName = "token";
  50.     //使用自定义的AccessTokenConverter
  51.     private AccessTokenConverter tokenConverter = new MyAccessTokenConverter();
  53.     public MyRemoteTokenServices() {
  54.         restTemplate = new RestTemplate();
  55.         ((RestTemplate) restTemplate).setErrorHandler(new DefaultResponseErrorHandler() {
  56.             @Override
  57.             // Ignore 400
  58.             public void handleError(ClientHttpResponse response) throws IOException {
  59.                 if (response.getRawStatusCode() != 400) {
  60.                     super.handleError(response);
  61.                 }
  62.             }
  63.         });
  64.     }
  66.     public void setRestTemplate(RestOperations restTemplate) {
  67.         this.restTemplate = restTemplate;
  68.     }
  70.     public void setCheckTokenEndpointUrl(String checkTokenEndpointUrl) {
  71.         this.checkTokenEndpointUrl = checkTokenEndpointUrl;
  72.     }
  74.     public void setClientId(String clientId) {
  75.         this.clientId = clientId;
  76.     }
  78.     public void setClientSecret(String clientSecret) {
  79.         this.clientSecret = clientSecret;
  80.     }
  82.     public void setAccessTokenConverter(AccessTokenConverter accessTokenConverter) {
  83.         this.tokenConverter = accessTokenConverter;
  84.     }
  86.     public void setTokenName(String tokenName) {
  87.         this.tokenName = tokenName;
  88.     }
  90.     @Override
  91.     public OAuth2Authentication loadAuthentication(String accessToken)
  92.             throws AuthenticationException, InvalidTokenException {
  94.         MultiValueMap<String, String> formData = new LinkedMultiValueMap<String, String>();
  95.         formData.add(tokenName, accessToken);
  96.         HttpHeaders headers = new HttpHeaders();
  97.         headers.set("Authorization", getAuthorizationHeader(clientId, clientSecret));
  98.         Map<String, Object> map = postForMap(checkTokenEndpointUrl, formData, headers);
  100.         if (logger.isDebugEnabled()) {
  101.             logger.debug("check_token returned result: " + JSON.toJSONString(map));
  102.         }
  104.         HttpResponseBase httpResponse = JSON.parseObject(JSON.toJSONString(map), HttpResponseBase.class);
  105.         JSONObject rsJson = (JSONObject) httpResponse.getResults();
  107.         if ("invalid_token".equalsIgnoreCase(httpResponse.getCode())
  108.                 || (rsJson != null && rsJson.containsKey("error"))) {
  109.             if (logger.isDebugEnabled()) {
  110.                 logger.debug("check_token returned error: " + map.get("error"));
  111.             }
  112.             throw new InvalidTokenException(accessToken);
  113.         }
  115.         if (!Boolean.TRUE.equals(rsJson.get("active"))) {
  116.             logger.debug("check_token returned active attribute: " + map.get("active"));
  117.             throw new InvalidTokenException(accessToken);
  118.         }
  120.         return tokenConverter.extractAuthentication(rsJson);
  121.     }
  123.     @Override
  124.     public OAuth2AccessToken readAccessToken(String accessToken) {
  125.         throw new UnsupportedOperationException("Not supported: read access token");
  126.     }
  128.     private String getAuthorizationHeader(String clientId, String clientSecret) {
  130.         if (clientId == null || clientSecret == null) {
  131.             logger.warn(
  132.                     "Null Client ID or Client Secret detected. Endpoint that requires authentication will reject request with 401 error.");
  133.         }
  135.         String creds = String.format("%s:%s", clientId, clientSecret);
  136.         try {
  137.             return "Basic " + new String(java.util.Base64.getEncoder().encode(creds.getBytes("UTF-8")));
  138.         } catch (UnsupportedEncodingException e) {
  139.             throw new IllegalStateException("Could not convert String");
  140.         }
  141.     }
  143.     private Map<String, Object> postForMap(String path, MultiValueMap<String, String> formData, HttpHeaders headers) {
  144.         if (headers.getContentType() == null) {
  145.             headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
  146.         }
  147.         @SuppressWarnings("rawtypes")
  148.         Map map = restTemplate.exchange(path, HttpMethod.POST,
  149.                 new HttpEntity<MultiValueMap<String, String>>(formData, headers), Map.class).getBody();
  151.         @SuppressWarnings("unchecked")
  152.         Map<String, Object> result = map;
  153.         return result;
  154.     }
  156. }

MyAccessTokenConverter.java

  1. package com.boya.web.config.oauth;
  2. import java.util.Arrays;
  3. import java.util.Collection;
  4. import java.util.Collections;
  5. import java.util.Date;
  6. import java.util.HashMap;
  7. import java.util.LinkedHashSet;
  8. import java.util.Map;
  9. import java.util.Set;
  11. import org.springframework.security.core.Authentication;
  12. import org.springframework.security.core.GrantedAuthority;
  13. import org.springframework.security.core.authority.AuthorityUtils;
  14. import org.springframework.security.oauth2.common.DefaultOAuth2AccessToken;
  15. import org.springframework.security.oauth2.common.OAuth2AccessToken;
  16. import org.springframework.security.oauth2.provider.OAuth2Authentication;
  17. import org.springframework.security.oauth2.provider.OAuth2Request;
  18. import org.springframework.security.oauth2.provider.token.AccessTokenConverter;
  19. import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
  21. /**
  22.  * Default implementation of {@link AccessTokenConverter}.
  23.  *
  24.  * @author Dave Syer
  25.  * @author Vedran Pavic
  26.  */
  27. public class MyAccessTokenConverter implements AccessTokenConverter {
  29.     //使用自定义UserAuthenticationConverter
  30.     private UserAuthenticationConverter userTokenConverter = new MyUserAuthenticationConverter();
  32.     private boolean includeGrantType;
  34.     private String scopeAttribute = SCOPE;
  36.     private String clientIdAttribute = CLIENT_ID;
  38.     /**
  39.      * Converter for the part of the data in the token representing a user.
  40.      *
  41.      * @param userTokenConverter the userTokenConverter to set
  42.      */
  43.     public void setUserTokenConverter(UserAuthenticationConverter userTokenConverter) {
  44.         this.userTokenConverter = userTokenConverter;
  45.     }
  47.     /**
  48.      * Flag to indicate the the grant type should be included in the converted token.
  49.      *
  50.      * @param includeGrantType the flag value (default false)
  51.      */
  52.     public void setIncludeGrantType(boolean includeGrantType) {
  53.         this.includeGrantType = includeGrantType;
  54.     }
  56.     /**
  57.      * Set scope attribute name to be used in the converted token. Defaults to
  58.      * {@link AccessTokenConverter#SCOPE}.
  59.      *
  60.      * @param scopeAttribute the scope attribute name to use
  61.      */
  62.     public void setScopeAttribute(String scopeAttribute) {
  63.         this.scopeAttribute = scopeAttribute;
  64.     }
  66.     /**
  67.      * Set client id attribute name to be used in the converted token. Defaults to
  68.      * {@link AccessTokenConverter#CLIENT_ID}.
  69.      *
  70.      * @param clientIdAttribute the client id attribute name to use
  71.      */
  72.     public void setClientIdAttribute(String clientIdAttribute) {
  73.         this.clientIdAttribute = clientIdAttribute;
  74.     }
  76.     public Map<String, ?> convertAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
  77.         Map<String, Object> response = new HashMap<String, Object>();
  78.         OAuth2Request clientToken = authentication.getOAuth2Request();
  80.         if (!authentication.isClientOnly()) {
  81.             response.putAll(userTokenConverter.convertUserAuthentication(authentication.getUserAuthentication()));
  82.         } else {
  83.             if (clientToken.getAuthorities()!=null && !clientToken.getAuthorities().isEmpty()) {
  84.                 response.put(UserAuthenticationConverter.AUTHORITIES,
  85.                         AuthorityUtils.authorityListToSet(clientToken.getAuthorities()));
  86.             }
  87.         }
  89.         if (token.getScope()!=null) {
  90.             response.put(scopeAttribute, token.getScope());
  91.         }
  92.         if (token.getAdditionalInformation().containsKey(JTI)) {
  93.             response.put(JTI, token.getAdditionalInformation().get(JTI));
  94.         }
  96.         if (token.getExpiration() != null) {
  97.             response.put(EXP, token.getExpiration().getTime() / 1000);
  98.         }
  100.         if (includeGrantType && authentication.getOAuth2Request().getGrantType()!=null) {
  101.             response.put(GRANT_TYPE, authentication.getOAuth2Request().getGrantType());
  102.         }
  104.         response.putAll(token.getAdditionalInformation());
  106.         response.put(clientIdAttribute, clientToken.getClientId());
  107.         if (clientToken.getResourceIds() != null && !clientToken.getResourceIds().isEmpty()) {
  108.             response.put(AUD, clientToken.getResourceIds());
  109.         }
  110.         return response;
  111.     }
  113.     public OAuth2AccessToken extractAccessToken(String value, Map<String, ?> map) {
  114.         DefaultOAuth2AccessToken token = new DefaultOAuth2AccessToken(value);
  115.         Map<String, Object> info = new HashMap<String, Object>(map);
  116.         info.remove(EXP);
  117.         info.remove(AUD);
  118.         info.remove(clientIdAttribute);
  119.         info.remove(scopeAttribute);
  120.         if (map.containsKey(EXP)) {
  121.             token.setExpiration(new Date((Long) map.get(EXP) * 1000L));
  122.         }
  123.         if (map.containsKey(JTI)) {
  124.             info.put(JTI, map.get(JTI));
  125.         }
  126.         token.setScope(extractScope(map));
  127.         token.setAdditionalInformation(info);
  128.         return token;
  129.     }
  131.     public OAuth2Authentication extractAuthentication(Map<String, ?> map) {
  132.         Map<String, String> parameters = new HashMap<String, String>();
  133.         Set<String> scope = extractScope(map);
  134.         Authentication user = userTokenConverter.extractAuthentication(map);
  135.         String clientId = (String) map.get(clientIdAttribute);
  136.         parameters.put(clientIdAttribute, clientId);
  137.         if (includeGrantType && map.containsKey(GRANT_TYPE)) {
  138.             parameters.put(GRANT_TYPE, (String) map.get(GRANT_TYPE));
  139.         }
  140.         Set<String> resourceIds = new LinkedHashSet<String>(map.containsKey(AUD) ? getAudience(map)
  141.                 : Collections.<String>emptySet());
  143.         Collection<? extends GrantedAuthority> authorities = null;
  144.         if (user==null && map.containsKey(AUTHORITIES)) {
  145.             @SuppressWarnings("unchecked")
  146.             String[] roles = ((Collection<String>)map.get(AUTHORITIES)).toArray(new String[0]);
  147.             authorities = AuthorityUtils.createAuthorityList(roles);
  148.         }
  149.         OAuth2Request request = new OAuth2Request(parameters, clientId, authorities, true, scope, resourceIds, null, null,
  150.                 null);
  151.         return new OAuth2Authentication(request, user);
  152.     }
  154.     private Collection<String> getAudience(Map<String, ?> map) {
  155.         Object auds = map.get(AUD);
  156.         if (auds instanceof Collection) {
  157.             @SuppressWarnings("unchecked")
  158.             Collection<String> result = (Collection<String>) auds;
  159.             return result;
  160.         }
  161.         return Collections.singleton((String)auds);
  162.     }
  164.     private Set<String> extractScope(Map<String, ?> map) {
  165.         Set<String> scope = Collections.emptySet();
  166.         if (map.containsKey(scopeAttribute)) {
  167.             Object scopeObj = map.get(scopeAttribute);
  168.             if (String.class.isInstance(scopeObj)) {
  169.                 scope = new LinkedHashSet<String>(Arrays.asList(String.class.cast(scopeObj).split(" ")));
  170.             } else if (Collection.class.isAssignableFrom(scopeObj.getClass())) {
  171.                 @SuppressWarnings("unchecked")
  172.                 Collection<String> scopeColl = (Collection<String>) scopeObj;
  173.                 scope = new LinkedHashSet<String>(scopeColl);    // Preserve ordering
  174.             }
  175.         }
  176.         return scope;
  177.     }
  179. }

MyUserAuthenticationConverter.java

  1. package com.boya.web.config.oauth;
  3. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  4. import org.springframework.security.core.Authentication;
  5. import org.springframework.security.core.GrantedAuthority;
  6. import org.springframework.security.core.authority.AuthorityUtils;
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.security.core.userdetails.UserDetailsService;
  9. import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
  10. import org.springframework.util.StringUtils;
  12. import java.util.Collection;
  13. import java.util.LinkedHashMap;
  14. import java.util.Map;
  16. /**
  17.  * Default implementation of {@link UserAuthenticationConverter}. Converts to and from an Authentication using only its
  18.  * name and authorities.
  19.  *
  20.  * @author Dave Syer
  21.  *
  22.  */
  23. public class MyUserAuthenticationConverter implements UserAuthenticationConverter {
  25.     private Collection<? extends GrantedAuthority> defaultAuthorities;
  27.     private UserDetailsService userDetailsService;
  29.     //新增获取参数
  30.     private String USERID = "userId";
  33.     /**
  34.      * Optional {@link UserDetailsService} to use when extracting an {@link Authentication} from the incoming map.
  35.      *
  36.      * @param userDetailsService the userDetailsService to set
  37.      */
  38.     public void setUserDetailsService(UserDetailsService userDetailsService) {
  39.         this.userDetailsService = userDetailsService;
  40.     }
  42.     /**
  43.      * Default value for authorities if an Authentication is being created and the input has no data for authorities.
  44.      * Note that unless this property is set, the default Authentication created by {@link #extractAuthentication(Map)}
  45.      * will be unauthenticated.
  46.      *
  47.      * @param defaultAuthorities the defaultAuthorities to set. Default null.
  48.      */
  49.     public void setDefaultAuthorities(String[] defaultAuthorities) {
  50.         this.defaultAuthorities = AuthorityUtils.commaSeparatedStringToAuthorityList(StringUtils
  51.                 .arrayToCommaDelimitedString(defaultAuthorities));
  52.     }
  54.     public Map<String, ?> convertUserAuthentication(Authentication authentication) {
  55.         Map<String, Object> response = new LinkedHashMap<String, Object>();
  56.         response.put(USERNAME, authentication.getName());
  57.         if (authentication.getAuthorities() != null && !authentication.getAuthorities().isEmpty()) {
  58.             response.put(AUTHORITIES, AuthorityUtils.authorityListToSet(authentication.getAuthorities()));
  59.         }
  60.         return response;
  61.     }
  63.     public Authentication extractAuthentication(Map<String, ?> map) {
  64.         //新增先获取userId
  65.         if (map.containsKey(USERID)) {
  66.             Object principal = map.get(USERID);
  67.             Collection<? extends GrantedAuthority> authorities = getAuthorities(map);
  68.             if (userDetailsService != null) {
  69.                 UserDetails user = userDetailsService.loadUserByUsername((String) map.get(USERID));
  70.                 authorities = user.getAuthorities();
  71.                 principal = user;
  72.             }
  73.             return new UsernamePasswordAuthenticationToken(principal, "N/A", authorities);
  74.         }
  75.         if (map.containsKey(USERNAME)) {
  76.             Object principal = map.get(USERNAME);
  77.             Collection<? extends GrantedAuthority> authorities = getAuthorities(map);
  78.             if (userDetailsService != null) {
  79.                 UserDetails user = userDetailsService.loadUserByUsername((String) map.get(USERNAME));
  80.                 authorities = user.getAuthorities();
  81.                 principal = user;
  82.             }
  83.             return new UsernamePasswordAuthenticationToken(principal, "N/A", authorities);
  84.         }
  85.         return null;
  86.     }
  88.     private Collection<? extends GrantedAuthority> getAuthorities(Map<String, ?> map) {
  89.         if (!map.containsKey(AUTHORITIES)) {
  90.             return defaultAuthorities;
  91.         }
  92.         Object authorities = map.get(AUTHORITIES);
  93.         if (authorities instanceof String) {
  94.             return AuthorityUtils.commaSeparatedStringToAuthorityList((String) authorities);
  95.         }
  96.         if (authorities instanceof Collection) {
  97.             return AuthorityUtils.commaSeparatedStringToAuthorityList(StringUtils
  98.                     .collectionToCommaDelimitedString((Collection<?>) authorities));
  99.         }
  100.         throw new IllegalArgumentException("Authorities must be either a String or a Collection");
  101.     }
  102. }

zuul网关下游服务调用时修改

ModifyParamFilter.java

  1. package com.boya.web.config;
  3. import com.alibaba.fastjson.JSON;
  4. import com.netflix.zuul.ZuulFilter;
  5. import com.netflix.zuul.context.RequestContext;
  6. import lombok.extern.slf4j.Slf4j;
  7. import org.springframework.security.core.Authentication;
  8. import org.springframework.security.core.context.SecurityContext;
  9. import org.springframework.security.core.context.SecurityContextHolder;
  10. import org.springframework.stereotype.Component;
  12. import javax.servlet.http.HttpServletRequest;
  13. import java.util.*;
  15. @Component
  16. @Slf4j
  17. public class ModifyHeaderFilter extends ZuulFilter {
  19.     //定义filter的类型，有pre、route、post、error四种
  20.     @Override
  21.     public String filterType() {
  22.         return "route";
  23.     }
  25.     //定义filter的顺序，数字越小表示顺序越高，越先执行
  26.     @Override
  27.     public int filterOrder() {
  28.         return 6;
  29.     }
  31.     //表示是否需要执行该filter，true表示执行，false表示不执行
  32.     @Override
  33.     public boolean shouldFilter() {
  34.         return true;
  35.     }
  37.     public Object run() {
  38.         System.out.println("------------------------------------------------OAuth2AccessToken---");
  39.         SecurityContext context = SecurityContextHolder.getContext();
  40.         Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  41.         String currentPrincipalName = authentication.getName();
  42.         System.out.println("当前用户-------"+currentPrincipalName);
  43.         RequestContext ctx = RequestContext.getCurrentContext();
  44.         HttpServletRequest request = ctx.getRequest();
  45.         log.info(String.format("%s >>> %s", request.getMethod(), request.getRequestURL().toString()));
  46.         Enumeration<String> headerNames = request.getHeaderNames();
  47.         Map<String, Object> headMap = new HashMap<>();
  48.         String pa = null;
  49.         while ((pa = headerNames.nextElement()) != null) {
  50.             headMap.put(pa, request.getHeader(pa));
  51.         }
  52.         log.info(String.format("header  参数   >>> %s", JSON.toJSONString(headMap)));
  53.         Map<String, String[]> requestMap = request.getParameterMap();
  54.         log.info(String.format("request 参数 >>> %s", JSON.toJSONString(requestMap)));
  56.         Map<String, List<String>> requestQueryParams = ctx.getRequestQueryParams();
  58.         if (requestQueryParams==null) {
  59.             requestQueryParams=new HashMap<>();
  60.         }
  62.         //将要新增的参数添加进去,被调用的微服务可以直接 去取,就想普通的一样,框架会直接注入进去
  63.         ArrayList<String> arrayList = new ArrayList<>();
  64.         arrayList.add(currentPrincipalName);
  65.         requestQueryParams.put("userId", arrayList);
  67.         // 这个put("requestQueryParams", qp); 是在源码中 会在转发的时候去取这个key里面的参数值.
  68.         ctx.setRequestQueryParams(requestQueryParams);
  69.         return null;
  71.     }
  72. }