使用jwt实现sso单点登录

蔚落 2022-05-08 05:50 267阅读 0赞

![在这里插入图片描述][70]

> Single Sign On

## 导入pom ##

<dependencyManagement>
    		<dependencies>
    			<dependency>
    				<groupId>io.spring.platform</groupId>   //导入平台
    				<artifactId>platform-bom</artifactId>
    				<version>Brussels-SR4</version>
    				<type>pom</type>
    				<scope>import</scope>
    			</dependency>
    			<dependency>
    				<groupId>org.springframework.cloud</groupId>
    				<artifactId>spring-cloud-dependencies</artifactId>   //导入cloud相关依赖
    				<version>Dalston.SR2</version>
    				<type>pom</type>
    				<scope>import</scope>
    			</dependency>
    		</dependencies>
    	</dependencyManagement>

<modules>
    		<module>../sso-client1</module>
    		<module>../sso-client2</module>
    		<module>../sso-server</module>
    	</modules>

### sso-server ###

<parent>
    		<groupId>com.imooc.sso</groupId>
    		<artifactId>sso-demo</artifactId>
    		<version>1.0.0-SNAPSHOT</version>
    		<relativePath>../sso-demo</relativePath>
    	</parent>
    	<artifactId>sso-server</artifactId>
    	
    	<dependencies>
    		<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-security</artifactId>   //security相关
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.boot</groupId>
    			<artifactId>spring-boot-starter-web</artifactId>  //web相关
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security.oauth</groupId>
    			<artifactId>spring-security-oauth2</artifactId>  //oauth2相关
    		</dependency>
    		<dependency>
    			<groupId>org.springframework.security</groupId>
    			<artifactId>spring-security-jwt</artifactId> //jwt 相关
    		</dependency>
    	</dependencies>

## spring boot main方法 ##

@SpringBootApplication
    public class SsoServerApplication {
    	public static void main(String[] args) {
    		SpringApplication.run(SsoServerApplication.class, args);
    	}
    }

## sso-server 开启配置，类似于 提供商 ##

> extends AuthorizationServerConfigurerAdapter

@Configuration
    @EnableAuthorizationServer
    public class SsoAuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    	//能给哪个客户端发令牌 配置两个客户端
    	@Override
    	public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    		clients.inMemory()
    				.withClient("imooc1")
    				.secret("imoocsecrect1")
    				.authorizedGrantTypes("authorization_code", "refresh_token")
    				.scopes("all")
    				.and()
    				.withClient("imooc2")
    				.secret("imoocsecrect2")
    				.authorizedGrantTypes("authorization_code", "refresh_token")
    				.scopes("all");
    	}
    	
    	//配置jwt 和 jwt token 转换器
    	@Override
    	public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    		endpoints.tokenStore(jwtTokenStore()).accessTokenConverter(jwtAccessTokenConverter());
    	}
    	//配置认证服务器，都需要认证之后 才能访问
    	@Override
    	public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    		security.tokenKeyAccess("isAuthenticated()");
    	}
    	
    	@Bean
    	public TokenStore jwtTokenStore() {
    		return new JwtTokenStore(jwtAccessTokenConverter());
    	}
    	
    	@Bean
    	public JwtAccessTokenConverter jwtAccessTokenConverter(){
    		JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
            converter.setSigningKey("imooc");
            return converter;
    	}
    }

### application.properties ###

server.port = 9999
    server.context-path = /server
    security.user.password = 123456

## sso-client1 ##

> 启动类

@SpringBootApplication
    @RestController
    @EnableOAuth2Sso
    public class SsoClient1Application {
    	
    	@GetMapping("/user")
    	public Authentication user(Authentication user) {
    		return user;
    	}
    
    	public static void main(String[] args) {
    		SpringApplication.run(SsoClient1Application.class, args);
    	}
    	
    }

### application.properties ###

security.oauth2.client.clientId = imooc1
    security.oauth2.client.clientSecret = imoocsecrect1
    security.oauth2.client.user-authorization-uri = http://127.0.0.1:9999/server/oauth/authorize
    security.oauth2.client.access-token-uri = http://127.0.0.1:9999/server/oauth/token
    security.oauth2.resource.jwt.key-uri = http://127.0.0.1:9999/server/oauth/token_key
    
    server.port = 8080
    server.context-path = /client1

#### index 文件 ####

<a href="http://127.0.0.1:8060/client2/index.html">访问Client2</a>

## http 登录 改成 表单登录，用户名密码从数据库中读取 ##

> extends WebSecurityConfigurerAdapter

@Configuration
    public class SsoSecurityConfig extends WebSecurityConfigurerAdapter {
    	
    	@Autowired
    	private UserDetailsService userDetailsService;
    	
    	@Bean
    	public PasswordEncoder passwordEncoder()	{
    		return new BCryptPasswordEncoder();
    	}
    	
    	//用自己的userDetailsService
    	@Override
    	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    		auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    	}
    	
    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
    	  //改成表单登录，并且 所有的请求 都需要 认证
    		http.formLogin().and().authorizeRequests().anyRequest().authenticated();
    	}
    
    }

### UserDetailsService ###

@Component
    public class SsoUserDetailsService implements UserDetailsService {
    	@Autowired
    	private PasswordEncoder passwordEncoder;
    	@Override
    	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    		return new User(username, passwordEncoder.encode("123456"), 
    				AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_USER"));
    	}
    }

## 调整 授权页面，提交页面，实现简单粗暴的自动授权 ##

//复制对应的代码
    @RestController
    @SessionAttributes("authorizationRequest")
    public class SsoApprovalEndpoint {
    	
    	@RequestMapping("/oauth/confirm_access")
    	public ModelAndView getAccessConfirmation(Map<String, Object> model, HttpServletRequest request) throws Exception {
    		String template = createTemplate(model, request);
    		if (request.getAttribute("_csrf") != null) {
    			model.put("_csrf", request.getAttribute("_csrf"));
    		}
    		return new ModelAndView(new SsoSpelView(template), model);
    	}
    
    	protected String createTemplate(Map<String, Object> model, HttpServletRequest request) {
    		String template = TEMPLATE;
    		if (model.containsKey("scopes") || request.getAttribute("scopes") != null) {
    			template = template.replace("%scopes%", createScopes(model, request)).replace("%denial%", "");
    		}
    		else {
    			template = template.replace("%scopes%", "").replace("%denial%", DENIAL);
    		}
    		if (model.containsKey("_csrf") || request.getAttribute("_csrf") != null) {
    			template = template.replace("%csrf%", CSRF);
    		}
    		else {
    			template = template.replace("%csrf%", "");
    		}
    		return template;
    	}
    
    	private CharSequence createScopes(Map<String, Object> model, HttpServletRequest request) {
    		StringBuilder builder = new StringBuilder("<ul>");
    		@SuppressWarnings("unchecked")
    		Map<String, String> scopes = (Map<String, String>) (model.containsKey("scopes") ? model.get("scopes") : request
    				.getAttribute("scopes"));
    		for (String scope : scopes.keySet()) {
    			String approved = "true".equals(scopes.get(scope)) ? " checked" : "";
    			String denied = !"true".equals(scopes.get(scope)) ? " checked" : "";
    			String value = SCOPE.replace("%scope%", scope).replace("%key%", scope).replace("%approved%", approved)
    					.replace("%denied%", denied);
    			builder.append(value);
    		}
    		builder.append("</ul>");
    		return builder.toString();
    	}
    
    	private static String CSRF = "<input type='hidden' name='${_csrf.parameterName}' value='${_csrf.token}' />";
    
    	private static String DENIAL = "<form id='denialForm' name='denialForm' action='${path}/oauth/authorize' method='post'><input name='user_oauth_approval' value='false' type='hidden'/>%csrf%<label><input name='deny' value='Deny' type='submit'/></label></form>";
    
    	private static String TEMPLATE = "<html><body><div style='display:none;'><h1>OAuth Approval</h1>"
    			+ "<p>Do you authorize '${authorizationRequest.clientId}' to access your protected resources?</p>"
    			+ "<form id='confirmationForm' name='confirmationForm' action='${path}/oauth/authorize' method='post'><input name='user_oauth_approval' value='true' type='hidden'/>%csrf%%scopes%<label><input name='authorize' value='Authorize' type='submit'/></label></form>"
    			+ "%denial%</div><script>document.getElementById('confirmationForm').submit()</script></body></html>";
    
    	private static String SCOPE = "<li><div class='form-group'>%scope%: <input type='radio' name='%key%'"
    			+ " value='true'%approved%>Approve</input> <input type='radio' name='%key%' value='false'%denied%>Deny</input></div></li>";
    
    
    }

//复制对应的代码
    
    public class SsoSpelView implements View {
    	
    private final String template;
    	
    	private final String prefix;
    
    	private final SpelExpressionParser parser = new SpelExpressionParser();
    
    	private final StandardEvaluationContext context = new StandardEvaluationContext();
    
    	private PlaceholderResolver resolver;
    
    	public SsoSpelView(String template) {
    		this.template = template;
    		this.prefix = new RandomValueStringGenerator().generate() + "{";
    		this.context.addPropertyAccessor(new MapAccessor());
    		this.resolver = new PlaceholderResolver() {
    			public String resolvePlaceholder(String name) {
    				Expression expression = parser.parseExpression(name);
    				Object value = expression.getValue(context);
    				return value == null ? null : value.toString();
    			}
    		};
    	}
    
    	public String getContentType() {
    		return "text/html";
    	}
    
    	public void render(Map<String, ?> model, HttpServletRequest request, HttpServletResponse response)
    			throws Exception {
    		Map<String, Object> map = new HashMap<String, Object>(model);
    		String path = ServletUriComponentsBuilder.fromContextPath(request).build()
    				.getPath();
    		map.put("path", (Object) path==null ? "" : path);
    		context.setRootObject(map);
    		String maskedTemplate = template.replace("${", prefix);
    		PropertyPlaceholderHelper helper = new PropertyPlaceholderHelper(prefix, "}");
    		String result = helper.replacePlaceholders(maskedTemplate, resolver);
    		result = result.replace(prefix, "${");
    		response.setContentType(getContentType());
    		response.getWriter().append(result);
    	}
    
    }

[70]: /images/20220508/46ba857fb04a4ae7ab3d9b8d18f9de1e.png