springcloud gateway集成oauth2.0
直接进入主题
spring cloud gateway 简介
This project provides a library for building an API Gateway on top of Spring MVC. Spring Cloud Gateway aims to provide a simple, yet effective way to route to APIs and provide cross cutting concerns to them such as: security, monitoring/metrics, and resiliency
springcloud gateway 官方文档 https://spring.io/projects/spring-cloud-gateway#overview
oauth的认证权限可以参考https://blog.csdn.net/a15835774652/article/details/107065563 传送门
常见的网关认证模式
1.网关充当资源服务器 同时转发相关的认证请求到认证服务器 用户请求不同的资源 在网关层验证，判断权限等操作;
2.网关只负责转发操作 进行验证在每个资源服务上
这里采用第二种网关认证方式
源码位置： https://github.com/passliang/tiger
项目整体结构如下
auth-server 作为认证中心
gateway 作为网关 负责转发相关操作 仅仅作为网关
一.首先搭建注册中心
tiger 父工程 pom 如下
4.0.0 org.springframework.boot spring-boot-starter-parent 2.3.4.RELEASE com.style tiger 1.0.0-SNAPSHOT pom tiger oauth2.0 auth-server gateway registry user 1.8 Hoxton.SR8 org.springframework.cloud spring-cloud-dependencies Hoxton.SR8 pom import
注册中心 pom文件
4.0.0 com.style tiger 1.0.0-SNAPSHOT registry 1.0.0-SNAPSHOT registry registry org.springframework.cloud spring-cloud-starter-netflix-eureka-server org.springframework.boot spring-boot-starter-actuator org.projectlombok lombok org.springframework.boot spring-boot-starter-test test org.junit.vintage junit-vintage-engine junit junit test org.springframework.boot spring-boot-maven-plugin
2.yaml 配置
server:
port: 20020
spring:
application:
name: regisry
eureka:
client:
### 取消Eureka服务器自我注册
registerWithEureka: false
### 注册中心的服务器，没有必要再去检索服务
fetchRegistry: false
instance:
hostname: localhost
server:
waitTimeInMsWhenSyncEmpty: 0
#关闭自我保护
enableSelfPreservation: false
#剔除时间间隔,单位:毫秒
evictionIntervalTimerInMs: 4000
3.启动配置文件
@SpringBootApplication
@EnableEurekaServer
public class RegistryApplication {
public static void main(String[] args) {
SpringApplication.run(RegistryApplication.class, args);
}
}
二.网关
使用springcloud的gateway
1.pom文件如下
4.0.0 com.style tiger 1.0.0-SNAPSHOT gateway 1.0.0 gateway gateway org.springframework.cloud spring-cloud-starter-netflix-eureka-client org.springframework.cloud spring-cloud-starter-zookeeper-discovery org.springframework.cloud spring-cloud-starter-consul-discovery org.springframework.cloud spring-cloud-starter-gateway org.springframework.cloud spring-cloud-starter-security org.springframework.boot spring-boot-actuator org.springframework.boot spring-boot-starter-test test org.junit.vintage junit-vintage-engine junit junit test org.springframework.boot spring-boot-maven-plugin
2.yaml配置文件
bootstrap.yaml
server:
port: 20060
spring:
application:
name: gateway
cloud:
zookeeper:
# zookeeper 服务发现与注册失效（默认）
enabled: false
consul:
# consul 服务发现与注册失效（默认）
enabled: false
profiles:
#切换不同 环境 使用zookeeper 或者consul
active: eureka
eureka:
client:
# Eureka 服务发现与注册失效（默认）
enabled: false
--- # Profile For Eureka
spring:
profiles: eureka
eureka:
server: # 官方不存在的配置（自定义配置）
host: 127.0.0.1
port: 20020
client:
service-url:
#注册中心地址
#多注册中心
# defaultZone: http://localhost:20021/eureka,http://localhost:20022/eureka,http://localhost:20023/eureka
defaultZone: http://localhost:20020/eureka
# 5 秒轮训一次
registryFetchIntervalSeconds: 5
enabled: true
instance:
# eureka client发送心跳给server端后，续约到期时间(默认90秒)
leaseExpirationDurationInSeconds: 10
#发送心跳续约间 5秒 发一次 心跳
leaseRenewalIntervalInSeconds: 5
metadata-map:
instanceId: ${spring.application.name}:${server.port}
--- #zookeeper
spring:
profiles: zookeeper
cloud:
zookeeper:
connectString: localhost:2181
enabled: true
--- #consul
spring:
profiles: consul
cloud:
consul:
host: 127.0.0.1
port: 8500
discovery:
#是否需要注册
register: true
#注册的实例ID (唯一标志)
instance-id: ${spring.application.name}:${server.port}
#服务的名称
service-name: ${spring.application.name}
#服务的请求端口
port: ${server.port}
#指定开启ip地址注册
prefer-ip-address: true
#当前服务的请求ip
ip-address: 127.0.0.1
enabled: true
application.yaml
spring:
application:
name: gateway
autoconfigure:
exclude: org.springframework.cloud.consul.serviceregistry.ConsulAutoServiceRegistrationAutoConfiguration
cloud:
gateway:
routes:
- id : oauth
uri: lb://AUTH-SERVER
predicates:
- Path=/oauth/*
- id: user
uri: lb://USER
predicates:
- Path=/user/**
filters:
- StripPrefix=1
#默认暴露所有的节点给 adminServer 生产上谨慎使用 可增加认证
management:
endpoints:
web:
exposure:
#暴露hystrix监控端点 hystrix.stream
include: '*'
endpoint:
health:
show-details: always
3.启动类
@EnableDiscoveryClient
@SpringBootApplication
public class GatewayApplication {
public static void main(String[] args) {
SpringApplication.run(GatewayApplication.class, args);
}
}
4. 安全的配置 （这个配置是必须加的 过滤到csrf）
gateway是用的webflux 和javax包下filter会冲突 注解这里使用 EnableWebFluxSecurity
WebSecurityConfig
@EnableWebFluxSecurity
@Configuration
public class WebSecurityConfig {
@Bean
public SecurityWebFilterChain webFluxFilterChain(ServerHttpSecurity http) {
http
.csrf().disable()
.authorizeExchange()
.pathMatchers("/**").permitAll()
//option 请求默认放行
.pathMatchers(HttpMethod.OPTIONS).permitAll()
.and()
.formLogin()
;
return http.build();
}
}
三.认证中心
pom依赖如下
4.0.0 com.style tiger 1.0.0-SNAPSHOT auth-server 0.0.1-SNAPSHOT auth-server auth-server org.springframework.cloud spring-cloud-starter-netflix-eureka-client org.springframework.cloud spring-cloud-starter-zookeeper-discovery org.springframework.cloud spring-cloud-starter-consul-discovery org.springframework.cloud spring-cloud-starter-security org.springframework.cloud spring-cloud-starter-oauth2 org.springframework.boot spring-boot-starter-web org.springframework.boot spring-boot-actuator org.projectlombok lombok org.springframework.boot spring-boot-starter-test test org.junit.vintage junit-vintage-engine junit junit test org.springframework.boot spring-boot-maven-plugin
2.yaml配置
bootstrap.yaml
server:
port: 20110
spring:
application:
name: auth-server
cloud:
zookeeper:
# zookeeper 服务发现与注册失效（默认）
enabled: false
consul:
# consul 服务发现与注册失效（默认）
enabled: false
profiles:
#切换不同 环境 使用zookeeper 或者consul
active: eureka
eureka:
client:
# Eureka 服务发现与注册失效（默认）
enabled: false
--- # Profile For Eureka
spring:
profiles: eureka
eureka:
server: # 官方不存在的配置（自定义配置）
host: 127.0.0.1
port: 20020
client:
service-url:
#注册中心地址
defaultZone: http://localhost:20020/eureka
#多注册中心
# defaultZone: http://localhost:20021/eureka,http://localhost:20022/eureka,http://localhost:20023/eureka
# 5 秒轮训一次
registryFetchIntervalSeconds: 5
enabled: true
instance:
# eureka client发送心跳给server端后，续约到期时间(默认90秒)
leaseExpirationDurationInSeconds: 10
#发送心跳续约间 5秒 发一次 心跳
leaseRenewalIntervalInSeconds: 5
metadata-map:
instanceId: ${spring.application.name}:${server.port}
--- #zookeeper
spring:
profiles: zookeeper
cloud:
zookeeper:
connectString: localhost:2181
enabled: true
--- #consul
spring:
profiles: consul
cloud:
consul:
host: 127.0.0.1
port: 8500
discovery:
#是否需要注册
register: true
#注册的实例ID (唯一标志)
instance-id: ${spring.application.name}:${server.port}
#服务的名称
service-name: ${spring.application.name}
#服务的请求端口
port: ${server.port}
#指定开启ip地址注册
prefer-ip-address: true
#当前服务的请求ip
ip-address: 127.0.0.1
enabled: true
application.yml
spring:
application:
name: auth-server
autoconfigure:
exclude: org.springframework.cloud.consul.serviceregistry.ConsulAutoServiceRegistrationAutoConfiguration
#默认暴露所有的节点给 adminServer 生产上谨慎使用 可增加认证
management:
endpoints:
web:
exposure:
#暴露hystrix监控端点 hystrix.stream
include: '*'
endpoint:
health:
show-details: always
3.启动类配置
@SpringBootApplication
@EnableDiscoveryClient
public class AuthServerApplication {
public static void main(String[] args) {
SpringApplication.run(AuthServerApplication.class, args);
}
}
目录结构如上
AuthorizationServerConfig
客户端信息存于内存中
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private ClientDetailsService clientDetailsService;
@Autowired
private TokenStore tokenStore;
@Autowired
private JwtAccessTokenConverter jwtAccessTokenConverter;
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
endpoints
//允许token请求调用的请求类型
.allowedTokenEndpointRequestMethods(HttpMethod.POST, HttpMethod.GET)
//认证管理器
.authenticationManager(authenticationManager)
//token
.tokenServices(tokenServices())
//认证码
.authorizationCodeServices(authorizationCodeServices())
;
}
@Bean
public AuthorizationServerTokenServices tokenServices() {
DefaultTokenServices tokenServices = new DefaultTokenServices();
//认证管理器
tokenServices.setAuthenticationManager(authenticationManager);
//客户端信息
tokenServices.setClientDetailsService(clientDetailsService);
//jwt token存储
tokenServices.setTokenStore(tokenStore);
//token增强
TokenEnhancerChain tokenEnhancer = new TokenEnhancerChain();
tokenEnhancer.setTokenEnhancers(Collections.singletonList(jwtAccessTokenConverter));
tokenServices.setTokenEnhancer(tokenEnhancer);
//支持刷新token
tokenServices.setSupportRefreshToken(true);
//token 有效期 2小时
tokenServices.setAccessTokenValiditySeconds(2 * 60 * 60);
// 刷新token有效期 7天
tokenServices.setRefreshTokenValiditySeconds(7 * 24 * 60 * 60);
return tokenServices;
}
/**
* 授权码 这里使用内存存储
*
* @return AuthorizationCodeServices
*/
@Bean
public AuthorizationCodeServices authorizationCodeServices() {
return new InMemoryAuthorizationCodeServices();
}
/**
* 自定义 加密器
*
* @return PasswordEncoder
*/
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
/**
* 客户端的信息
*
* @param clients clients
* @throws Exception
*/
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
//配置内存中的 client
clients.inMemory()
.withClient("admin")
.secret(new BCryptPasswordEncoder().encode("MyStyle"))
//客户端允许的授权模式
.authorities("authorization_code", "password", "client_credentials", "implicit", "refresh_token")
//允许的授权范围
.scopes("all","read","write")
//验证回调地址
.redirectUris("https://www.baidu.com")
.and()
.withClient("user")
.secret(new BCryptPasswordEncoder().encode("MyStyle"))
//客户端允许的授权模式
.authorities("authorization_code", "password", "client_credentials", "implicit", "refresh_token")
//允许的授权范围
.scopes("read")
//验证回调地址
.redirectUris("https://www.baidu.com")
.and()
.build();
}
@Override
public void configure(AuthorizationServerSecurityConfigurer security) {
security
//oauth/token_key是公开
.tokenKeyAccess("permitAll()")
//oauth/check_token公开
.checkTokenAccess("permitAll()")
//表单认证（申请令牌）
.allowFormAuthenticationForClients()
;
}
}
SecurityConfig
定义了两个用户都存于内存中
package com.style.auth.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
/**
* @author leon
* @date 2020-09-21 13:45:17
*/
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/oauth/**").permitAll()
.anyRequest().authenticated();
;
}
@Bean
@Override
public AuthenticationManager authenticationManager() throws Exception {
return super.authenticationManager();
}
@Bean
@Override
public UserDetailsService userDetailsService() {
//内存模式下创建的用户
//权限列表
UserDetails admin = User.withUsername("admin")
.password(new BCryptPasswordEncoder().encode("123456"))
//角色
.roles("ADMIN", "DEVELOPER")
//权限
.authorities("get","update")
.build();
//开发者
UserDetails developer = User.withUsername("developer")
.password(new BCryptPasswordEncoder().encode("123456"))
//角色
.roles("DEVELOPER")
//权限
.authorities("get")
.build();
InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
userDetailsManager.createUser(admin);
userDetailsManager.createUser(developer);
return userDetailsManager;
}
}
token配置
TokenConfig
@Configuration
public class TokenConfig {
private static final String SIGN_KEY = "MyStyle";
/**
* jwt token 存储
*
* @return TokenStore
*/
@Bean
public TokenStore tokenStore() {
return new JwtTokenStore(jwtAccessTokenConverter());
}
/**
* jwt tokenConvert
*
* @return JwtAccessTokenConverter
*/
@Bean
public JwtAccessTokenConverter jwtAccessTokenConverter() {
JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
jwtAccessTokenConverter.setSigningKey(SIGN_KEY);
return jwtAccessTokenConverter;
}
}
四.用户中心
用户中心作为资源服务器 校验token以及权限
1.pom文件
4.0.0 com.style tiger 1.0.0-SNAPSHOT user 1.0.0-SNAPSHOT user user org.springframework.cloud spring-cloud-starter-netflix-eureka-client org.springframework.cloud spring-cloud-starter-zookeeper-discovery org.springframework.cloud spring-cloud-starter-consul-discovery org.springframework.cloud spring-cloud-starter-security org.springframework.cloud spring-cloud-starter-oauth2 org.springframework.boot spring-boot-actuator org.springframework.boot spring-boot-starter-web org.projectlombok lombok org.springframework.boot spring-boot-starter-test test org.junit.vintage junit-vintage-engine junit junit test org.springframework.boot spring-boot-maven-plugin
2.yaml配置文件
bootstrap.yaml
server:
port: 20080
spring:
application:
name: user
cloud:
zookeeper:
# zookeeper 服务发现与注册失效（默认）
enabled: false
consul:
# consul 服务发现与注册失效（默认）
enabled: false
profiles:
#切换不同 环境 使用zookeeper 或者consul
active: eureka
eureka:
client:
# Eureka 服务发现与注册失效（默认）
enabled: false
--- # Profile For Eureka
spring:
profiles: eureka
eureka:
server: # 官方不存在的配置（自定义配置）
host: 127.0.0.1
port: 20020
client:
service-url:
#注册中心地址
#多注册中心
# defaultZone: http://localhost:20021/eureka,http://localhost:20022/eureka,http://localhost:20023/eureka
defaultZone: http://localhost:20020/eureka
# 5 秒轮训一次
registryFetchIntervalSeconds: 5
enabled: true
instance:
# eureka client发送心跳给server端后，续约到期时间(默认90秒)
leaseExpirationDurationInSeconds: 10
#发送心跳续约间 5秒 发一次 心跳
leaseRenewalIntervalInSeconds: 5
metadata-map:
instanceId: ${spring.application.name}:${server.port}
--- #zookeeper
spring:
profiles: zookeeper
cloud:
zookeeper:
connectString: localhost:2181
enabled: true
--- #consul
spring:
profiles: consul
cloud:
consul:
host: 127.0.0.1
port: 8500
discovery:
#是否需要注册
register: true
#注册的实例ID (唯一标志)
instance-id: ${spring.application.name}:${server.port}
#服务的名称
service-name: ${spring.application.name}
#服务的请求端口
port: ${server.port}
#指定开启ip地址注册
prefer-ip-address: true
#当前服务的请求ip
ip-address: 127.0.0.1
enabled: true
application.yaml
spring:
application:
name: user
autoconfigure:
exclude: org.springframework.cloud.consul.serviceregistry.ConsulAutoServiceRegistrationAutoConfiguration
#默认暴露所有的节点给 adminServer 生产上谨慎使用 可增加认证
management:
endpoints:
web:
exposure:
#暴露hystrix监控端点 hystrix.stream
include: '*'
endpoint:
health:
show-details: always
整体结构
3.启动文件
@SpringBootApplication
@EnableDiscoveryClient
public class UserApplication {
public static void main(String[] args) {
SpringApplication.run(UserApplication.class, args);
}
}
4. 资源服务配置
ResourceServerConfig
@EnableResourceServer
@Configuration
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
public static final String RESOURCE_ID = "resource";
@Autowired
private TokenStore tokenStore;
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources
.resourceId(RESOURCE_ID)
.tokenStore(tokenStore)
.stateless(true)
;
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/update").access("hasAuthority('update')")
.antMatchers("/get").access("hasAuthority('get')")
.antMatchers("/info").permitAll()
.anyRequest().authenticated();
}
}
WebSecurityConfig
@EnableGlobalMethodSecurity(prePostEnabled = true,securedEnabled = true)
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.anyRequest().authenticated();
}
}
TokenConfig
@Configuration
public class TokenConfig {
private static final String VERIFY_KEY = "MyStyle";
@Bean
public TokenStore tokenStore() {
return new JwtTokenStore(jwtAccessTokenConverter());
}
@Bean
public JwtAccessTokenConverter jwtAccessTokenConverter() {
JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
jwtAccessTokenConverter.setVerifierKey(VERIFY_KEY);
jwtAccessTokenConverter.setSigningKey(VERIFY_KEY);
return jwtAccessTokenConverter;
}
}
AuthController
验证的测试接口
@RestController
public class AuthController {
@GetMapping("/get")
public String get() {
return "获取接口";
}
@PostMapping("/update")
public String update() {
return "更新接口";
}
@GetMapping("/info")
public String info() {
return "详情 自由查看 不受限制";
}
}
update 接口需要有update 权限 get 接口需要有 get权限
项目到此搭建完成
首先启动注册中心 在启动网关 认证中心 用户中心
通过网关访问 user/get
返回未正常 该接口是需要添加token 才可以访问
通过网关获取一个token
http://localhost:20060/oauth/token?client_id=admin&client_secret=MyStyle&grant_type=password&username=developer&password=123456
获取token成功
在拿着token 去调用 /user/get
调用成功
在尝试调用下 /user/update
访问被拒绝
update 接口需要 update 权限
再次调用获取token接口 这次使用admin 用户
用新的token 去调用 /user/update
调用成功
再来测试下 /user/info
不携带token进行请求
成功
到此结束
祝大家国庆快乐！！！