Sentinel访问控制规则

- 日理万妓 2021-09-08 10:52 431阅读 0赞

[**完整目录清单页面（必看）**][Link 1]

很多时候，我们需要根据调用来源来判断该次请求是否允许放行，这时候可以使用 Sentinel 的来源访问控制（黑白名单控制）的功能。来源访问控制根据资源的请求来源（`origin`）限制资源是否通过，若配置白名单则只有请求来源位于白名单内时才可通过；若配置黑名单则请求来源位于黑名单时不通过，其余的请求通过。

> 调用方信息通过 `ContextUtil.enter(resourceName, origin)` 方法中的 `origin` 参数传入。

**规则配置**

来源访问控制规则（`AuthorityRule`）非常简单，主要有以下配置项：

*  `resource`：资源名，即限流规则的作用对象。
 *  `limitApp`：对应的黑名单/白名单，不同 origin 用 `,` 分隔，如 `appA,appB`。
 *  `strategy`：限制模式，`AUTHORITY_WHITE` 为白名单模式，`AUTHORITY_BLACK` 为黑名单模式，默认为白名单模式。

**示例**

比如我们希望控制对资源 `test` 的访问设置白名单，只有来源为 `appA` 和 `appB` 的请求才可通过，则可以配置如下白名单规则：

AuthorityRule rule = new AuthorityRule();
    rule.setResource("test");
    rule.setStrategy(RuleConstant.AUTHORITY_WHITE);
    rule.setLimitApp("appA,appB");
    AuthorityRuleManager.loadRules(Collections.singletonList(rule));

详细示例请参考 [AuthorityDemo][].

/* * Copyright 1999-2018 Alibaba Group Holding Ltd. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */
    package com.alibaba.csp.sentinel.demo.authority;
    
    import java.util.Collections;
    
    import com.alibaba.csp.sentinel.Entry;
    import com.alibaba.csp.sentinel.SphU;
    import com.alibaba.csp.sentinel.context.ContextUtil;
    import com.alibaba.csp.sentinel.slots.block.BlockException;
    import com.alibaba.csp.sentinel.slots.block.RuleConstant;
    import com.alibaba.csp.sentinel.slots.block.authority.AuthorityRule;
    import com.alibaba.csp.sentinel.slots.block.authority.AuthorityRuleManager;
    
    /** * Authority rule is designed for limiting by request origins. In blacklist mode, * requests will be blocked when blacklist contains current origin, otherwise will pass. * In whitelist mode, only requests from whitelist origin can pass. * * @author Eric Zhao */
    public class AuthorityDemo { 
    
        private static final String RESOURCE_NAME = "testABC";
    
        public static void main(String[] args) { 
            System.out.println("========Testing for black list========");
            initBlackRules();
            testFor(RESOURCE_NAME, "appA");
            testFor(RESOURCE_NAME, "appB");
            testFor(RESOURCE_NAME, "appC");
            testFor(RESOURCE_NAME, "appE");
    
            System.out.println("========Testing for white list========");
            initWhiteRules();
            testFor(RESOURCE_NAME, "appA");
            testFor(RESOURCE_NAME, "appB");
            testFor(RESOURCE_NAME, "appC");
            testFor(RESOURCE_NAME, "appE");
        }
    
        private static void testFor(/*@NonNull*/ String resource, /*@NonNull*/ String origin) { 
            ContextUtil.enter(resource, origin);
            Entry entry = null;
            try { 
                entry = SphU.entry(resource);
                System.out.println(String.format("Passed for resource %s, origin is %s", resource, origin));
            } catch (BlockException ex) { 
                System.err.println(String.format("Blocked for resource %s, origin is %s", resource, origin));
            } finally { 
                if (entry != null) { 
                    entry.exit();
                }
                ContextUtil.exit();
            }
        }
    
        private static void initWhiteRules() { 
            AuthorityRule rule = new AuthorityRule();
            rule.setResource(RESOURCE_NAME);
            rule.setStrategy(RuleConstant.AUTHORITY_WHITE);
            rule.setLimitApp("appA,appE");
            AuthorityRuleManager.loadRules(Collections.singletonList(rule));
        }
    
        private static void initBlackRules() { 
            AuthorityRule rule = new AuthorityRule();
            rule.setResource(RESOURCE_NAME);
            rule.setStrategy(RuleConstant.AUTHORITY_BLACK);
            rule.setLimitApp("appA,appB");
            AuthorityRuleManager.loadRules(Collections.singletonList(rule));
        }
    }

控制台配置方式：

![\[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-ZpUzak0p-1624266589748)(image-20210611070059026.png)\]][img-ZpUzak0p-1624266589748_image-20210611070059026.png]

> 微信搜一搜【java1234】关注这个放荡不羁的程序员，关注后回复【资料】有我准备的一线大厂笔试面试资料以及简历模板。

[Link 1]: https://blog.csdn.net/caoli201314/article/details/116422933
[AuthorityDemo]: https://github.com/alibaba/Sentinel/blob/master/sentinel-demo/sentinel-demo-basic/src/main/java/com/alibaba/csp/sentinel/demo/authority/AuthorityDemo.java
[img-ZpUzak0p-1624266589748_image-20210611070059026.png]: /images/20210901/25882c2272ce4277855766f3b411d620.png