Sprint Boot使用OAuth和JWT实现身份认证【一】

依赖第三方库：

compile 'io.jsonwebtoken:jjwt:0.9.0'
 

1.先写个例子用JWT实现获取token和解析token

      package com.yf.gyy.OAuthController;
      import java.util.Date;
      import java.util.HashMap;
      import java.util.Map;
      import org.springframework.web.bind.annotation.RequestBody;
      import org.springframework.web.bind.annotation.RequestMapping;
      import org.springframework.web.bind.annotation.RestController;
      import io.jsonwebtoken.Claims;
      import io.jsonwebtoken.Jwts;
      import io.jsonwebtoken.SignatureAlgorithm;
      import io.swagger.annotations.Api;
      import io.swagger.annotations.ApiOperation;
      @RestController
      @Api(value="OAuth2测试")
      public class OAuthController {
     	@ApiOperation(value="测试获取token",httpMethod="POST")
     	@RequestMapping("/api/testOAuth/GetToken")
     	public String CreateToken()
      	{
      		Map<String, Object> claims=new HashMap<String, Object>();
      		claims.put("zzzili", "zz");
     		String token = Jwts.builder()
      	            .setClaims(claims)
      	            .setExpiration(new Date(System.currentTimeMillis() + 6000 * 1000))
      	            .signWith(SignatureAlgorithm.HS512,"thisiskey") //采用什么算法是可以自己选择的，不一定非要采用HS512
      	            .compact();
     		return token;
      	}
     	@ApiOperation(value="测试token解析",httpMethod="POST")
     	@RequestMapping("/api/testOAuth/TestOAuth2")
     	public Claims TestOAuth2( @RequestBody String token)
      	{
      		System.out.println(token);
     		Claims  claims = Jwts.parser()
                      .setSigningKey("thisiskey")
                      .parseClaimsJws(token)
                      .getBody();
     		return claims;
      	}
      }
  
 

  
 
 

2.对spring boot项目添加OAuth过滤器

我们暂且实现，自己定义获取token的方法和自定义过滤器

需要4个java类

>>http请求过滤器类，继承自 OncePerRequestFilter

>>过滤器注册类，继承自 WebSecurityConfigurerAdapter

>>用户对象类，继承自 UserDetails

>>用户对象加密解密类

2.1添加一个rest方法，用以获取token：

     	@ApiOperation(value="测试获取token",httpMethod="POST")
     	@RequestMapping("/api/testOAuth2/GetToken")
     	public String CreateToken()
      	{
      		List<String> roles = new ArrayList<String>();
          	roles.add("USER");
          	roles.add("ADMIN");
          	Map<String, Object> u=new HashMap<String, Object>();
          	u.put("password", "zzz");
          	u.put("username", "zzz");
          	u.put("created", "zzz");
         	String token = Jwts.builder()
      	            .setClaims(u)
      	            .setExpiration(new Date(System.currentTimeMillis() + 6000 * 1000))
      	            .signWith(SignatureAlgorithm.HS512,"123456") //采用什么算法是可以自己选择的，不一定非要采用HS512
      	            .compact();
     		return token;
      	}
  
 

  
 
 

2.2自定义http请求过滤器

      package com.yf.gyy;
      import java.io.IOException;
      import java.util.ArrayList;
      import java.util.Calendar;
      import java.util.Date;
      import java.util.List;
      import javax.servlet.FilterChain;
      import javax.servlet.ServletException;
      import javax.servlet.http.HttpServletRequest;
      import javax.servlet.http.HttpServletResponse;
      import org.springframework.beans.factory.annotation.Autowired;
      import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
      import org.springframework.security.core.context.SecurityContextHolder;
      import org.springframework.security.core.userdetails.UserDetails;
      import org.springframework.security.core.userdetails.UsernameNotFoundException;
      import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
      import org.springframework.stereotype.Component;
      import org.springframework.web.filter.OncePerRequestFilter;
      import io.jsonwebtoken.Claims;
      import io.jsonwebtoken.Jwts;
      @Component
      public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
         @Autowired
         private JwtTokenUtil jwtTokenUtil;
         @Override
         protected void doFilterInternal(
       HttpServletRequest request,
       HttpServletResponse response,
       FilterChain chain) throws ServletException, IOException {
         	String tokenHeader = "Authorization";
         	String tokenHead = "Bearer ";
             String authHeader = request.getHeader(tokenHeader);
             if (authHeader != null && authHeader.startsWith(tokenHead)) {
                 final String authToken = authHeader.substring(tokenHead.length());
                 Claims  claims = Jwts.parser()
                          .setSigningKey("123456")
                          .parseClaimsJws(authToken)
                          .getBody();
                 String username = claims.get("username").toString();
                 if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
                 	UserDetails userDetails = loadUserByUsername(username);
                     if (jwtTokenUtil.validateToken(authToken, userDetails)) {
                         UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
                                  userDetails, null, userDetails.getAuthorities());
                          authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(
                                  request));
                         //logger.info("authenticated user " + username + ", setting security context");
                          SecurityContextHolder.getContext().setAuthentication(authentication);
                      }
                  }
              }
              chain.doFilter(request, response);
          }
         private UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
          	List<String> roles = new ArrayList<String>();
          	roles.add("USER");
          	roles.add("ADMIN");
         	Calendar c = Calendar.getInstance();
              c.setTime(new Date());
              c.add(Calendar.DAY_OF_MONTH, 10);// 今天+10天
              Date nowT= c.getTime();
         	JwtUser user = new JwtUser("zzz",
         			"zzz",
         			"zzz",
         			"email",
          			roles,
          			nowT);
         	return user;
          }
      }
  
 

  
 
 

      package com.yf.gyy;
      import java.io.Serializable;
      import java.util.Date;
      import java.util.Map;
      import org.springframework.security.core.userdetails.UserDetails;
      import org.springframework.stereotype.Component;
      import io.jsonwebtoken.Claims;
      import io.jsonwebtoken.Jwts;
      import io.jsonwebtoken.SignatureAlgorithm;
      /**
       * @author
       * JwtTokenUtil
       */
      //@Component("jwtTokenUtil")
      @Component
      public class JwtTokenUtil implements Serializable {
         private static final long serialVersionUID = -3301605591108950415L;
         static final String CLAIM_KEY_USERNAME = "username";
         static final String CLAIM_KEY_PASSWORD = "password";
         static final String CLAIM_KEY_CREATED = "created";
         //private static final String AUDIENCE_UNKNOWN = "unknown";
         //private static final String AUDIENCE_WEB = "web";
         //private static final String AUDIENCE_MOBILE = "mobile";
         //private static final String AUDIENCE_TABLET = "tablet";
         //通过@value注解获取密钥
         //@Value("123456")
         private String secret="123456";
         //通过@value注解获取失效时间
         //@Value("${jwt.expiration}")
         private Long expiration=300L;
         //@Resource(name = "tokenConfig")
         //private Map<String, String> tokenConfig;
         /**
       * @param token
       * return username by Token
       */
         public String getUsernameFromToken(String token) {
              String username;
             try {
                 final Claims claims = getClaimsFromToken(token);
                  username = (String) claims.get(CLAIM_KEY_USERNAME);
                 //username = claims.getSubject();
              } catch (Exception e) {
                  username = null;
              }
             return username;
          }
         /**
       * @param token
       * return CreatedDate by Token 获取token创建时间
       */
         public Date getCreatedDateFromToken(String token) {
              Date created;
             try {
                 final Claims claims = getClaimsFromToken(token);
                  created = new Date((Long) claims.get(CLAIM_KEY_CREATED));
              } catch (Exception e) {
                  created = null;
              }
             return created;
          }
         /**
       * @param token
       * return ExpirationDate by Token 获取token过期时间
       */
         public Date getExpirationDateFromToken(String token) {
              Date expiration;
             try {
                 final Claims claims = getClaimsFromToken(token);
                  expiration = claims.getExpiration();
              } catch (Exception e) {
                  expiration = null;
              }
             return expiration;
          }
         /**
       * @param token
       * return Password by Token 获取token的密码
       */
         public String getPasswordFromToken(String token) {
              String password;
             try {
                 final Claims claims = getClaimsFromToken(token);
                  password = (String) claims.get(CLAIM_KEY_PASSWORD);
              } catch (Exception e) {
                  password = null;
              }
             return password;
          }
         public Claims getClaimsFromToken(String token) {
              Claims claims;
             try {
                  claims = Jwts.parser()
                         //设置签名的密钥
                          .setSigningKey(secret)
                         //把token转换成断言
                          .parseClaimsJws(token)
                          .getBody();
                 //Date expirationTime = Jwts.parser().setSigningKey(secret).parseClaimsJwt(token).getBody().getExpiration();
              } catch (Exception e) {
                  claims = null;
              }
             return claims;
          }
         //生成到期日期
         private Date generateExpirationDate() {
             return new Date(System.currentTimeMillis() + expiration * 1000);
          }
         //判断token是否过期
         private Boolean isTokenExpired(String token) {
             final Date expiration = getExpirationDateFromToken(token);
             return expiration.before(new Date());
          }
         //判断token创建时间是否在密码重置之前
         private Boolean isCreatedBeforeLastPasswordReset(Date created, Date lastPasswordReset) {
             return (lastPasswordReset != null && created.before(lastPasswordReset));
          }
         /*private String generateAudience(Device device) {
       String audience = AUDIENCE_UNKNOWN;
       if (device.isNormal()) {
       audience = AUDIENCE_WEB;
       } else if (device.isTablet()) {
       audience = AUDIENCE_TABLET;
       } else if (device.isMobile()) {
       audience = AUDIENCE_MOBILE;
       }
       return audience;
       }
       //忽略token的过期时间
       private Boolean ignoreTokenExpiration(String token) {
       String audience = getPasswordFromToken(token);
       return (AUDIENCE_TABLET.equals(audience) || AUDIENCE_MOBILE.equals(audience));
       }*/
         //生成token
         public String generateToken(Map<String, Object> claims) {
             return Jwts.builder()
                      .setClaims(claims)
                      .setExpiration(generateExpirationDate())
                      .signWith(SignatureAlgorithm.HS512, secret)
                      .compact();
          }
         //判断token是否可以刷新
         public Boolean canTokenBeRefreshed(String token, Date lastPasswordReset) {
             final Date created = getCreatedDateFromToken(token);
             return !isCreatedBeforeLastPasswordReset(created, lastPasswordReset)
                      && (!isTokenExpired(token)) ;
                     /*|| ignoreTokenExpiration(token))*/
          }
         //刷新token
         public String refreshToken(String token) {
              String refreshedToken;
             try {
                 final Claims claims = getClaimsFromToken(token);
                  claims.put(CLAIM_KEY_CREATED, new Date());
                  refreshedToken = generateToken(claims);
              } catch (Exception e) {
                  refreshedToken = null;
              }
             return refreshedToken;
          }
         //判读token是否有效
         public Boolean validateToken(String token, UserDetails userDomain) {
            // JwtUser user = (JwtUser) userPO;
             final String username = getUsernameFromToken(token);
             //final Date created = getCreatedDateFromToken(token);
             //final Date expiration = getExpirationDateFromToken(token);
             if(username==null){
                 return false;
              }else{
             return (
                      username.equals(userDomain.getUsername())
                              && !isTokenExpired(token));
                             //&& !isCreatedBeforeLastPasswordReset(created, user.getLastPasswordResetDate()));
          }
          }
         //public String getTokenKey() {
         // return tokenConfig.get("tokenKey");
         //}
      }
  
 

  
 
 

      package com.yf.gyy;
      import java.util.Collection;
      import java.util.Date;
      import java.util.List;
      import java.util.stream.Collectors;
      import org.springframework.security.core.GrantedAuthority;
      import org.springframework.security.core.authority.SimpleGrantedAuthority;
      import org.springframework.security.core.userdetails.UserDetails;
      import com.fasterxml.jackson.annotation.JsonIgnore;
      public class JwtUser implements UserDetails {
         /**
       *
       */
     	private static final long serialVersionUID = 1L;
     	private final String id;
         private final String username;
         private final String password;
         private final String email;
         private final Collection<? extends GrantedAuthority> authorities;
         private final Date lastPasswordResetDate;
         public JwtUser(
       String id,
       String username,
       String password,
       String email,
       List<String> authorities,
       Date lastPasswordResetDate) {
             this.id = id;
             this.username = username;
             this.password = password;
             this.email = email;
             this.authorities = mapToGrantedAuthorities(authorities);
             this.lastPasswordResetDate = lastPasswordResetDate;
          }
         private  List<GrantedAuthority> mapToGrantedAuthorities(List<String> authorities) {
             return authorities.stream()
                      .map(SimpleGrantedAuthority::new)
                      .collect(Collectors.toList());
          }
         //返回分配给用户的角色列表
         @Override
         public Collection<? extends GrantedAuthority> getAuthorities() {
             return authorities;
          }
         @JsonIgnore
         public String getId() {
             return id;
          }
         @JsonIgnore
         @Override
         public String getPassword() {
             return password;
          }
         @Override
         public String getUsername() {
             return username;
          }
         // 账户是否未过期
         @JsonIgnore
         @Override
         public boolean isAccountNonExpired() {
             return true;
          }
         // 账户是否未锁定
         @JsonIgnore
         @Override
         public boolean isAccountNonLocked() {
             return true;
          }
         // 密码是否未过期
         @JsonIgnore
         @Override
         public boolean isCredentialsNonExpired() {
             return true;
          }
         // 账户是否激活
         @JsonIgnore
         @Override
         public boolean isEnabled() {
             return true;
          }
         // 这个是自定义的，返回上次密码重置日期
         @JsonIgnore
         public Date getLastPasswordResetDate() {
             return lastPasswordResetDate;
          }
     	public String getEmail() {
     		return email;
      	}
      }
  
 

  
 
 

2.3将过滤器装在到webconfig中

      package com.yf.gyy;
      import org.springframework.beans.factory.annotation.Autowired;
      import org.springframework.context.annotation.Bean;
      import org.springframework.context.annotation.Configuration;
      import org.springframework.http.HttpMethod;
      import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
      import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
      import org.springframework.security.config.annotation.web.builders.HttpSecurity;
      import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
      import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
      import org.springframework.security.config.http.SessionCreationPolicy;
      import org.springframework.security.core.userdetails.UserDetailsService;
      import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
      import org.springframework.security.crypto.password.PasswordEncoder;
      import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
      @Configuration
      @EnableWebSecurity
      @EnableGlobalMethodSecurity(prePostEnabled = true)
      public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
         @Override
         protected void configure(HttpSecurity httpSecurity) throws Exception {
          	httpSecurity
          	.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class)
          	.csrf().disable()
          	.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
               .requestMatchers().anyRequest();
          }
         @Bean
         public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
             return new JwtAuthenticationTokenFilter();
          }
      }
  
 

  
 
 

3.在rest接口中使用标注添加访问权限：

      package com.yf.gyy.OAuthController;
      import org.springframework.security.access.prepost.PreAuthorize;
      import org.springframework.web.bind.annotation.RequestMapping;
      import org.springframework.web.bind.annotation.RestController;
      import io.swagger.annotations.Api;
      import io.swagger.annotations.ApiOperation;
      @RestController
      @Api(value="OAuth2测试")
      //@PreAuthorize("hasRole('ROLE_USER')") //判断角色
      @PreAuthorize("principal.username!=null") //用户名不为空
      public class OAuthController {
     	@ApiOperation(value="测试访问授权",httpMethod="POST")
     	@RequestMapping("/api/testOAuth/TestAccessToken")
     	public String TestAccessToken()
      	{
     		return "test oauth";
      	}
      }
  
 

  
 
 

文章来源: zzzili.blog.csdn.net，作者：清雨小竹，版权归原作者所有，如需转载，请联系作者。

原文链接：zzzili.blog.csdn.net/article/details/79383919