From 5bdf931212a2968a03c256af6cf6f436d330ebb7 Mon Sep 17 00:00:00 2001 From: pig666 Date: Tue, 10 Nov 2020 09:54:45 +0800 Subject: [PATCH] =?UTF-8?q?:sparkles:=20Introducing=20new=20features.=20#1?= =?UTF-8?q?631=20=E3=80=90=E8=AE=A8=E8=AE=BA=E5=B8=96=E3=80=91=E9=87=8D?= =?UTF-8?q?=E6=9E=84=E7=9B=AE=E5=89=8D=E6=95=B4=E4=BD=93=E6=9E=B6=E6=9E=84?= =?UTF-8?q?=E6=A0=B8=E5=BF=83=EF=BC=8C=E4=B8=8D=E8=B0=83=E7=94=A8=E8=AE=A4?= =?UTF-8?q?=E8=AF=81=E4=B8=AD=E5=BF=83=20=EF=BC=8C=E8=B5=84=E6=BA=90?= =?UTF-8?q?=E6=9C=8D=E5=8A=A1=E5=99=A8=E8=87=AA=E8=A1=8C=E6=A0=A1=E9=AA=8C?= =?UTF-8?q?=20token=20=20=20<=3D>=2023d705cfbb8bff5e1d6246a37f6e9a418c860a?= =?UTF-8?q?b0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit :sparkles: Introducing new features. #1631 【讨论帖】重构目前整体架构核心，不调用认证中心 ，资源服务器自行校验 token <=> 23d705cfbb8bff5e1d6246a37f6e9a418c860ab0 --- pigx-auth/pom.xml | 5 ---- .../PigxLocalResourceServerTokenServices.java | 24 ++++++++++++++++++- .../service/PigxUserDetailsServiceImpl.java | 10 +++----- .../main/resources/META-INF/spring.factories | 1 + .../handle/GlobalBizExceptionHandler.java | 9 +++---- 5 files changed, 30 insertions(+), 19 deletions(-) rename {pigx-auth/src/main/java/com/pig4cloud/pigx/auth => pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security}/service/PigxUserDetailsServiceImpl.java (93%) diff --git a/pigx-auth/pom.xml b/pigx-auth/pom.xml index c6e3159d1..3aded1f96 100644 --- a/pigx-auth/pom.xml +++ b/pigx-auth/pom.xml @@ -43,11 +43,6 @@ com.alibaba.cloud spring-cloud-starter-alibaba-nacos-config - - - com.pig4cloud - pigx-upms-api - com.pig4cloud diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxLocalResourceServerTokenServices.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxLocalResourceServerTokenServices.java index 218e6301a..fd6e6a599 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxLocalResourceServerTokenServices.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxLocalResourceServerTokenServices.java @@ -1,11 +1,17 @@ package com.pig4cloud.pigx.common.security.component; +import com.pig4cloud.pigx.common.security.service.PigxUser; import lombok.RequiredArgsConstructor; import org.springframework.context.annotation.Primary; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.oauth2.common.OAuth2AccessToken; import org.springframework.security.oauth2.common.exceptions.InvalidTokenException; import org.springframework.security.oauth2.provider.OAuth2Authentication; +import org.springframework.security.oauth2.provider.OAuth2Request; import org.springframework.security.oauth2.provider.token.ResourceServerTokenServices; import org.springframework.security.oauth2.provider.token.TokenStore; import org.springframework.stereotype.Service; @@ -21,10 +27,26 @@ public class PigxLocalResourceServerTokenServices implements ResourceServerToken private final TokenStore tokenStore; + private final UserDetailsService userDetailsService; + @Override public OAuth2Authentication loadAuthentication(String accessToken) throws AuthenticationException, InvalidTokenException { - return tokenStore.readAuthentication(accessToken); + OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(accessToken); + OAuth2Request oAuth2Request = oAuth2Authentication.getOAuth2Request(); + + if (!(oAuth2Authentication.getPrincipal() instanceof PigxUser)) { + return oAuth2Authentication; + } + + // 根据 username 查询 spring cache 最新的值 并返回 + PigxUser pigxUser = (PigxUser) oAuth2Authentication.getPrincipal(); + UserDetails userDetails = userDetailsService.loadUserByUsername(pigxUser.getUsername()); + Authentication userAuthentication = new UsernamePasswordAuthenticationToken(userDetails, "N/A", + userDetails.getAuthorities()); + OAuth2Authentication authentication = new OAuth2Authentication(oAuth2Request, userAuthentication); + authentication.setAuthenticated(true); + return authentication; } @Override diff --git a/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/service/PigxUserDetailsServiceImpl.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/service/PigxUserDetailsServiceImpl.java similarity index 93% rename from pigx-auth/src/main/java/com/pig4cloud/pigx/auth/service/PigxUserDetailsServiceImpl.java rename to pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/service/PigxUserDetailsServiceImpl.java index 6d674fd50..2696be5ce 100644 --- a/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/service/PigxUserDetailsServiceImpl.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/service/PigxUserDetailsServiceImpl.java @@ -15,7 +15,7 @@ * Author: lengleng (wangiegie@gmail.com) */ -package com.pig4cloud.pigx.auth.service; +package com.pig4cloud.pigx.common.security.service; import cn.hutool.core.util.ArrayUtil; import cn.hutool.core.util.StrUtil; @@ -26,9 +26,7 @@ import com.pig4cloud.pigx.common.core.constant.CacheConstants; import com.pig4cloud.pigx.common.core.constant.CommonConstants; import com.pig4cloud.pigx.common.core.constant.SecurityConstants; import com.pig4cloud.pigx.common.core.util.R; -import com.pig4cloud.pigx.common.security.service.PigxUser; -import com.pig4cloud.pigx.common.security.service.PigxUserDetailsService; -import lombok.AllArgsConstructor; +import lombok.RequiredArgsConstructor; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; import org.springframework.cache.Cache; @@ -37,7 +35,6 @@ import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.AuthorityUtils; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UsernameNotFoundException; -import org.springframework.stereotype.Service; import java.util.Arrays; import java.util.Collection; @@ -50,8 +47,7 @@ import java.util.Set; * @author lengleng */ @Slf4j -@Service -@AllArgsConstructor +@RequiredArgsConstructor public class PigxUserDetailsServiceImpl implements PigxUserDetailsService { private final RemoteUserService remoteUserService; diff --git a/pigx-common/pigx-common-security/src/main/resources/META-INF/spring.factories b/pigx-common/pigx-common-security/src/main/resources/META-INF/spring.factories index 5d80ab746..b4b40cec0 100644 --- a/pigx-common/pigx-common-security/src/main/resources/META-INF/spring.factories +++ b/pigx-common/pigx-common-security/src/main/resources/META-INF/spring.factories @@ -1,6 +1,7 @@ org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ com.pig4cloud.pigx.common.security.component.PigxTokenEnhancer,\ com.pig4cloud.pigx.common.security.component.PigxSecurityInnerAspect,\ + com.pig4cloud.pigx.common.security.service.PigxUserDetailsServiceImpl,\ com.pig4cloud.pigx.common.security.serializer.PigxTokenStoreAutoConfiguration,\ com.pig4cloud.pigx.common.security.listener.AuthenticationFailureEventListener,\ com.pig4cloud.pigx.common.security.listener.AuthenticationSuccessEventListener diff --git a/pigx-common/pigx-common-sentinel/src/main/java/com/pig4cloud/pigx/common/sentinel/handle/GlobalBizExceptionHandler.java b/pigx-common/pigx-common-sentinel/src/main/java/com/pig4cloud/pigx/common/sentinel/handle/GlobalBizExceptionHandler.java index d9b7f84e7..58afae181 100644 --- a/pigx-common/pigx-common-sentinel/src/main/java/com/pig4cloud/pigx/common/sentinel/handle/GlobalBizExceptionHandler.java +++ b/pigx-common/pigx-common-sentinel/src/main/java/com/pig4cloud/pigx/common/sentinel/handle/GlobalBizExceptionHandler.java @@ -23,7 +23,6 @@ import lombok.extern.slf4j.Slf4j; import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression; import org.springframework.http.HttpStatus; import org.springframework.security.access.AccessDeniedException; -import org.springframework.security.core.SpringSecurityMessageSource; import org.springframework.validation.FieldError; import org.springframework.web.bind.MethodArgumentNotValidException; import org.springframework.web.bind.annotation.*; @@ -67,10 +66,8 @@ public class GlobalBizExceptionHandler { @ExceptionHandler(AccessDeniedException.class) @ResponseStatus(HttpStatus.FORBIDDEN) public R handleAccessDeniedException(AccessDeniedException e) { - String msg = SpringSecurityMessageSource.getAccessor().getMessage("AbstractAccessDecisionManager.accessDenied", - e.getMessage()); - log.error("拒绝授权异常信息 ex={}", msg, e); - return R.failed(e.getLocalizedMessage()); + log.error("拒绝授权异常信息 ex={}", e.getMessage()); + return R.failed("权限不足，不允许访问"); } /** @@ -93,7 +90,7 @@ public class GlobalBizExceptionHandler { @DeleteMapping("/error") @ResponseStatus(HttpStatus.NOT_FOUND) public R noHandlerFoundException() { - return R.failed(); + return R.failed(HttpStatus.NOT_FOUND.getReasonPhrase()); } }