spring security oauth2 使用redis存token时报错

谁践踏了优雅 2022-02-27 12:48 479阅读 0赞

问题：  
我将我的spring boot项目版本升到2.0.0.M7后，集成了spring security oauth2（默认版本），redis（默认版本），并且用redis来存储token。项目正常启动后，请求token时报错。

nested exception is java.lang.NoSuchMethodError: org.springframework.data.redis.connection.RedisConnection.set(\[B\[B)V  
1  
看到报错信息，我的第一反应是版本冲突，但是我的依赖的都是spring-boot-starter-parent中的默认版本。   
然后在百度中找了一下，没找到。然后google中找，有用的只找到了这个   
https://github.com/spring-projects/spring-security-oauth/issues/1230\#event-1352041281   
果然是版本问题，spring-data-redis 2.0版本中set(String,String)被弃用了。然后我按照网页中的决解方法“spring-date-redis”改为2.0.1.RELEASE和”jedis“为2.9.0（显式声明），结果还是报一样的错。

解决方案  
因为我不想降版本，所以我用了一个极端的方式解决的。spring-data-redis 2.0版本中set(String,String)被弃用了，要使用RedisConnection.stringCommands().set(…)，所有我自定义一个RedisTokenStore，代码和RedisTokenStore一样，只是把所有conn.set(…)都换成conn..stringCommands().set(…)，测试后方法可行。代码如下：

@Component  
public class MyRedisTokenStore implements TokenStore\{

private static final String ACCESS = "access:";  
    private static final String AUTH\_TO\_ACCESS = "auth\_to\_access:";  
    private static final String AUTH = "auth:";  
    private static final String REFRESH\_AUTH = "refresh\_auth:";  
    private static final String ACCESS\_TO\_REFRESH = "access\_to\_refresh:";  
    private static final String REFRESH = "refresh:";  
    private static final String REFRESH\_TO\_ACCESS = "refresh\_to\_access:";  
    private static final String CLIENT\_ID\_TO\_ACCESS = "client\_id\_to\_access:";  
    private static final String UNAME\_TO\_ACCESS = "uname\_to\_access:";

private final RedisConnectionFactory connectionFactory;  
    private AuthenticationKeyGenerator authenticationKeyGenerator = new DefaultAuthenticationKeyGenerator();  
    private RedisTokenStoreSerializationStrategy serializationStrategy = new JdkSerializationStrategy();

private String prefix = "";

public MyRedisTokenStore(RedisConnectionFactory connectionFactory) \{  
        this.connectionFactory = connectionFactory;  
    \}

public void setAuthenticationKeyGenerator(AuthenticationKeyGenerator authenticationKeyGenerator) \{  
        this.authenticationKeyGenerator = authenticationKeyGenerator;  
    \}

public void setSerializationStrategy(RedisTokenStoreSerializationStrategy serializationStrategy) \{  
        this.serializationStrategy = serializationStrategy;  
    \}

public void setPrefix(String prefix) \{  
        this.prefix = prefix;  
    \}

private RedisConnection getConnection() \{  
        return connectionFactory.getConnection();  
    \}

private byte\[\] serialize(Object object) \{  
        return serializationStrategy.serialize(object);  
    \}

private byte\[\] serializeKey(String object) \{  
        return serialize(prefix + object);  
    \}

private OAuth2AccessToken deserializeAccessToken(byte\[\] bytes) \{  
        return serializationStrategy.deserialize(bytes, OAuth2AccessToken.class);  
    \}

private OAuth2Authentication deserializeAuthentication(byte\[\] bytes) \{  
        return serializationStrategy.deserialize(bytes, OAuth2Authentication.class);  
    \}

private OAuth2RefreshToken deserializeRefreshToken(byte\[\] bytes) \{  
        return serializationStrategy.deserialize(bytes, OAuth2RefreshToken.class);  
    \}

private byte\[\] serialize(String string) \{  
        return serializationStrategy.serialize(string);  
    \}

private String deserializeString(byte\[\] bytes) \{  
        return serializationStrategy.deserializeString(bytes);  
    \}

@Override  
    public OAuth2AccessToken getAccessToken(OAuth2Authentication authentication) \{  
        String key = authenticationKeyGenerator.extractKey(authentication);  
        byte\[\] serializedKey = serializeKey(AUTH\_TO\_ACCESS + key);  
        byte\[\] bytes = null;  
        RedisConnection conn = getConnection();  
        try \{  
            bytes = conn.get(serializedKey);  
        \} finally \{  
            conn.close();  
        \}  
        OAuth2AccessToken accessToken = deserializeAccessToken(bytes);  
        if (accessToken != null  
                && !key.equals(authenticationKeyGenerator.extractKey(readAuthentication(accessToken.getValue())))) \{  
            // Keep the stores consistent (maybe the same user is  
            // represented by this authentication but the details have  
            // changed)  
            storeAccessToken(accessToken, authentication);  
        \}  
        return accessToken;  
    \}

@Override  
    public OAuth2Authentication readAuthentication(OAuth2AccessToken token) \{  
        return readAuthentication(token.getValue());  
    \}

@Override  
    public OAuth2Authentication readAuthentication(String token) \{  
        byte\[\] bytes = null;  
        RedisConnection conn = getConnection();  
        try \{  
            bytes = conn.get(serializeKey(AUTH + token));  
        \} finally \{  
            conn.close();  
        \}  
        OAuth2Authentication auth = deserializeAuthentication(bytes);  
        return auth;  
    \}

@Override  
    public OAuth2Authentication readAuthenticationForRefreshToken(OAuth2RefreshToken token) \{  
        return readAuthenticationForRefreshToken(token.getValue());  
    \}

public OAuth2Authentication readAuthenticationForRefreshToken(String token) \{  
        RedisConnection conn = getConnection();  
        try \{  
            byte\[\] bytes = conn.get(serializeKey(REFRESH\_AUTH + token));  
            OAuth2Authentication auth = deserializeAuthentication(bytes);  
            return auth;  
        \} finally \{  
            conn.close();  
        \}  
    \}

@Override  
    public void storeAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) \{  
        byte\[\] serializedAccessToken = serialize(token);  
        byte\[\] serializedAuth = serialize(authentication);  
        byte\[\] accessKey = serializeKey(ACCESS + token.getValue());  
        byte\[\] authKey = serializeKey(AUTH + token.getValue());  
        byte\[\] authToAccessKey = serializeKey(AUTH\_TO\_ACCESS + authenticationKeyGenerator.extractKey(authentication));  
        byte\[\] approvalKey = serializeKey(UNAME\_TO\_ACCESS + getApprovalKey(authentication));  
        byte\[\] clientId = serializeKey(CLIENT\_ID\_TO\_ACCESS + authentication.getOAuth2Request().getClientId());

RedisConnection conn = getConnection();  
        try \{  
            conn.openPipeline();  
            conn.stringCommands().set(accessKey, serializedAccessToken);  
            conn.stringCommands().set(authKey, serializedAuth);  
            conn.stringCommands().set(authToAccessKey, serializedAccessToken);  
            if (!authentication.isClientOnly()) \{  
                conn.rPush(approvalKey, serializedAccessToken);  
            \}  
            conn.rPush(clientId, serializedAccessToken);  
            if (token.getExpiration() != null) \{  
                int seconds = token.getExpiresIn();  
                conn.expire(accessKey, seconds);  
                conn.expire(authKey, seconds);  
                conn.expire(authToAccessKey, seconds);  
                conn.expire(clientId, seconds);  
                conn.expire(approvalKey, seconds);  
            \}  
            OAuth2RefreshToken refreshToken = token.getRefreshToken();  
            if (refreshToken != null && refreshToken.getValue() != null) \{  
                byte\[\] refresh = serialize(token.getRefreshToken().getValue());  
                byte\[\] auth = serialize(token.getValue());  
                byte\[\] refreshToAccessKey = serializeKey(REFRESH\_TO\_ACCESS + token.getRefreshToken().getValue());  
                conn.stringCommands().set(refreshToAccessKey, auth);  
                byte\[\] accessToRefreshKey = serializeKey(ACCESS\_TO\_REFRESH + token.getValue());  
                conn.stringCommands().set(accessToRefreshKey, refresh);  
                if (refreshToken instanceof ExpiringOAuth2RefreshToken) \{  
                    ExpiringOAuth2RefreshToken expiringRefreshToken = (ExpiringOAuth2RefreshToken) refreshToken;  
                    Date expiration = expiringRefreshToken.getExpiration();  
                    if (expiration != null) \{  
                        int seconds = Long.valueOf((expiration.getTime() - System.currentTimeMillis()) / 1000L)  
                                .intValue();  
                        conn.expire(refreshToAccessKey, seconds);  
                        conn.expire(accessToRefreshKey, seconds);  
                    \}  
                \}  
            \}  
            conn.closePipeline();  
        \} finally \{  
            conn.close();  
        \}  
    \}

private static String getApprovalKey(OAuth2Authentication authentication) \{  
        String userName = authentication.getUserAuthentication() == null ? ""  
                : authentication.getUserAuthentication().getName();  
        return getApprovalKey(authentication.getOAuth2Request().getClientId(), userName);  
    \}

private static String getApprovalKey(String clientId, String userName) \{  
        return clientId + (userName == null ? "" : ":" + userName);  
    \}

@Override  
    public void removeAccessToken(OAuth2AccessToken accessToken) \{  
        removeAccessToken(accessToken.getValue());  
    \}

@Override  
    public OAuth2AccessToken readAccessToken(String tokenValue) \{  
        byte\[\] key = serializeKey(ACCESS + tokenValue);  
        byte\[\] bytes = null;  
        RedisConnection conn = getConnection();  
        try \{  
            bytes = conn.get(key);  
        \} finally \{  
            conn.close();  
        \}  
        OAuth2AccessToken accessToken = deserializeAccessToken(bytes);  
        return accessToken;  
    \}

public void removeAccessToken(String tokenValue) \{  
        byte\[\] accessKey = serializeKey(ACCESS + tokenValue);  
        byte\[\] authKey = serializeKey(AUTH + tokenValue);  
        byte\[\] accessToRefreshKey = serializeKey(ACCESS\_TO\_REFRESH + tokenValue);  
        RedisConnection conn = getConnection();  
        try \{  
            conn.openPipeline();  
            conn.get(accessKey);  
            conn.get(authKey);  
            conn.del(accessKey);  
            conn.del(accessToRefreshKey);  
            // Don't remove the refresh token - it's up to the caller to do that  
            conn.del(authKey);  
            List<Object> results = conn.closePipeline();  
            byte\[\] access = (byte\[\]) results.get(0);  
            byte\[\] auth = (byte\[\]) results.get(1);

OAuth2Authentication authentication = deserializeAuthentication(auth);  
            if (authentication != null) \{  
                String key = authenticationKeyGenerator.extractKey(authentication);  
                byte\[\] authToAccessKey = serializeKey(AUTH\_TO\_ACCESS + key);  
                byte\[\] unameKey = serializeKey(UNAME\_TO\_ACCESS + getApprovalKey(authentication));  
                byte\[\] clientId = serializeKey(CLIENT\_ID\_TO\_ACCESS + authentication.getOAuth2Request().getClientId());  
                conn.openPipeline();  
                conn.del(authToAccessKey);  
                conn.lRem(unameKey, 1, access);  
                conn.lRem(clientId, 1, access);  
                conn.del(serialize(ACCESS + key));  
                conn.closePipeline();  
            \}  
        \} finally \{  
            conn.close();  
        \}  
    \}

@Override  
    public void storeRefreshToken(OAuth2RefreshToken refreshToken, OAuth2Authentication authentication) \{  
        byte\[\] refreshKey = serializeKey(REFRESH + refreshToken.getValue());  
        byte\[\] refreshAuthKey = serializeKey(REFRESH\_AUTH + refreshToken.getValue());  
        byte\[\] serializedRefreshToken = serialize(refreshToken);  
        RedisConnection conn = getConnection();  
        try \{  
            conn.openPipeline();  
            conn.stringCommands().set(refreshKey, serializedRefreshToken);  
            conn.stringCommands().set(refreshAuthKey, serialize(authentication));  
            if (refreshToken instanceof ExpiringOAuth2RefreshToken) \{  
                ExpiringOAuth2RefreshToken expiringRefreshToken = (ExpiringOAuth2RefreshToken) refreshToken;  
                Date expiration = expiringRefreshToken.getExpiration();  
                if (expiration != null) \{  
                    int seconds = Long.valueOf((expiration.getTime() - System.currentTimeMillis()) / 1000L)  
                            .intValue();  
                    conn.expire(refreshKey, seconds);  
                    conn.expire(refreshAuthKey, seconds);  
                \}  
            \}  
            conn.closePipeline();  
        \} finally \{  
            conn.close();  
        \}  
    \}

@Override  
    public OAuth2RefreshToken readRefreshToken(String tokenValue) \{  
        byte\[\] key = serializeKey(REFRESH + tokenValue);  
        byte\[\] bytes = null;  
        RedisConnection conn = getConnection();  
        try \{  
            bytes = conn.get(key);  
        \} finally \{  
            conn.close();  
        \}  
        OAuth2RefreshToken refreshToken = deserializeRefreshToken(bytes);  
        return refreshToken;  
    \}

@Override  
    public void removeRefreshToken(OAuth2RefreshToken refreshToken) \{  
        removeRefreshToken(refreshToken.getValue());  
    \}

public void removeRefreshToken(String tokenValue) \{  
        byte\[\] refreshKey = serializeKey(REFRESH + tokenValue);  
        byte\[\] refreshAuthKey = serializeKey(REFRESH\_AUTH + tokenValue);  
        byte\[\] refresh2AccessKey = serializeKey(REFRESH\_TO\_ACCESS + tokenValue);  
        byte\[\] access2RefreshKey = serializeKey(ACCESS\_TO\_REFRESH + tokenValue);  
        RedisConnection conn = getConnection();  
        try \{  
            conn.openPipeline();  
            conn.del(refreshKey);  
            conn.del(refreshAuthKey);  
            conn.del(refresh2AccessKey);  
            conn.del(access2RefreshKey);  
            conn.closePipeline();  
        \} finally \{  
            conn.close();  
        \}  
    \}

@Override  
    public void removeAccessTokenUsingRefreshToken(OAuth2RefreshToken refreshToken) \{  
        removeAccessTokenUsingRefreshToken(refreshToken.getValue());  
    \}

private void removeAccessTokenUsingRefreshToken(String refreshToken) \{  
        byte\[\] key = serializeKey(REFRESH\_TO\_ACCESS + refreshToken);  
        List<Object> results = null;  
        RedisConnection conn = getConnection();  
        try \{  
            conn.openPipeline();  
            conn.get(key);  
            conn.del(key);  
            results = conn.closePipeline();  
        \} finally \{  
            conn.close();  
        \}  
        if (results == null) \{  
            return;  
        \}  
        byte\[\] bytes = (byte\[\]) results.get(0);  
        String accessToken = deserializeString(bytes);  
        if (accessToken != null) \{  
            removeAccessToken(accessToken);  
        \}  
    \}

@Override  
    public Collection<OAuth2AccessToken> findTokensByClientIdAndUserName(String clientId, String userName) \{  
        byte\[\] approvalKey = serializeKey(UNAME\_TO\_ACCESS + getApprovalKey(clientId, userName));  
        List<byte\[\]> byteList = null;  
        RedisConnection conn = getConnection();  
        try \{  
            byteList = conn.lRange(approvalKey, 0, -1);  
        \} finally \{  
            conn.close();  
        \}  
        if (byteList == null || byteList.size() == 0) \{  
            return Collections.<OAuth2AccessToken> emptySet();  
        \}  
        List<OAuth2AccessToken> accessTokens = new ArrayList<OAuth2AccessToken>(byteList.size());  
        for (byte\[\] bytes : byteList) \{  
            OAuth2AccessToken accessToken = deserializeAccessToken(bytes);  
            accessTokens.add(accessToken);  
        \}  
        return Collections.<OAuth2AccessToken> unmodifiableCollection(accessTokens);  
    \}

@Override  
    public Collection<OAuth2AccessToken> findTokensByClientId(String clientId) \{  
        byte\[\] key = serializeKey(CLIENT\_ID\_TO\_ACCESS + clientId);  
        List<byte\[\]> byteList = null;  
        RedisConnection conn = getConnection();  
        try \{  
            byteList = conn.lRange(key, 0, -1);  
        \} finally \{  
            conn.close();  
        \}  
        if (byteList == null || byteList.size() == 0) \{  
            return Collections.<OAuth2AccessToken> emptySet();  
        \}  
        List<OAuth2AccessToken> accessTokens = new ArrayList<OAuth2AccessToken>(byteList.size());  
        for (byte\[\] bytes : byteList) \{  
            OAuth2AccessToken accessToken = deserializeAccessToken(bytes);  
            accessTokens.add(accessToken);  
        \}  
        return Collections.<OAuth2AccessToken> unmodifiableCollection(accessTokens);  
    \}  
\}