【MS】Spring Security Oauth接口访问权限，一个注解就可以自动保存到数据库

权限框架

• spring-security-oauth2

常规系统

都像这样写，然后在数据库写添加这个xxxxxx 权限，在配置角色时把这个xxxxxx 权限给配置对应角色，当用户登录后，访问这个接口，就会验证用户是否有这个权限

实现自动配置

1、创建自定义注解

@Target({ElementType.TYPE,ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface ResourcePermission {

    String value() default "";

}

2、在项目启动时加载所有带权限注解的接口，然后保存到数据库

@Slf4j
public class ResourcePermissionConfig implements InitializingBean {

    @Autowired
    private WebApplicationContext applicationContext;

    @Value("${spring.application.name}")
    private String applicationName;

    @Autowired
    private PermissionProducer permissionProducer;

    @Getter
    @Setter
    private List<PermissionEntityVO> permissionEntities = Lists.newArrayList();

    @Override
    public void afterPropertiesSet(){
        log.info("===============ResourcePermissionConfig==============");
        RequestMappingHandlerMapping mapping = applicationContext.getBean(RequestMappingHandlerMapping.class);
        Map<RequestMappingInfo, HandlerMethod> map = mapping.getHandlerMethods();
        map.keySet().forEach(mappingInfo -> {
            HandlerMethod handlerMethod = map.get(mappingInfo);
            ResourcePermission method = AnnotationUtils.findAnnotation(handlerMethod.getMethod(), ResourcePermission.class);
            Optional.ofNullable(method)
                    .ifPresent(resourcePermission -> mappingInfo
                            .getPatternsCondition()
                            .getPatterns()
                            .forEach(url -> {
                                String strUrl = URLConvertUtil.capture(url);
                                String permission = URLConvertUtil.convert(url);
                                permissionEntities.add(PermissionEntityVO
                                        .builder()
                                        .name(method.value())
                                        .permission(permission)
                                        .serviceId(applicationName)
                                        .url(strUrl)
                                        .build());
                            }));
            ResourcePermission controller = AnnotationUtils.findAnnotation(handlerMethod.getBeanType(), ResourcePermission.class);
            Optional.ofNullable(controller)
                    .ifPresent(resourcePermission -> mappingInfo
                            .getPatternsCondition()
                            .getPatterns()
                            .forEach(url -> {
                                String strUrl = URLConvertUtil.capture(url);
                                String permission = URLConvertUtil.convert(url);
                                if(StrUtil.isNotBlank(permission)){
                                    permissionEntities.add(PermissionEntityVO
                                            .builder()
                                            .name(method.value())
                                            .permission(permission)
                                            .serviceId(applicationName)
                                            .url(strUrl)
                                            .build());
                                }
                            }));
        });
        if(CollUtil.isNotEmpty(permissionEntities)){
            permissionProducer.send(permissionEntities);
        }
    }
}

这里为什么使用了mq 把数据发出去？因为在微服务中，像这种代码不可能每个服务需要设置权限都重新写一套吧，所以要创建一个公共模块，然后把这代码写在公共模块中，其他服务需要配置权限时，直接依赖即可

3、把配置的权限交给资源服务

@Slf4j
@AllArgsConstructor
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    private final RemoteTokenServices remoteTokenServices;
    private final RestTemplate restTemplate;
    private final ResourceAuthExceptionEntryPoint resourceAuthExceptionEntryPoint;
    private final CustomAccessDeniedHandler customAccessDeniedHandler;
    private final AuthIgnoreConfig authIgnoreConfig;
    private final ResourcePermissionConfig resourcePermissionConfig;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        String[] urls = authIgnoreConfig.getIgnoreUrls().stream().distinct().toArray(String[]::new);
        ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = http.authorizeRequests();
        registry.antMatchers(urls).permitAll();
        resourcePermissionConfig.getPermissionEntities().forEach(
                permissionEntity -> registry.antMatchers(permissionEntity.getUrl()).hasAnyRole(permissionEntity.getPermission()));
        registry.anyRequest().authenticated().and().csrf().disable();
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {

        DefaultAccessTokenConverter accessTokenConverter = new DefaultAccessTokenConverter();
        UserAuthenticationConverter userTokenConverter = new CustomUserAuthenticationConverter();
        accessTokenConverter.setUserTokenConverter(userTokenConverter);

        remoteTokenServices.setRestTemplate(restTemplate);
        remoteTokenServices.setAccessTokenConverter(accessTokenConverter);
        resources.authenticationEntryPoint(resourceAuthExceptionEntryPoint);
        resources.accessDeniedHandler(customAccessDeniedHandler);
        resources.tokenServices(remoteTokenServices);
    }
}

4、在认证服务中，监听MQ消息

@Slf4j
@Component
@RabbitListener(queues = RabbitMQConstants.PERMISSION_QUEUE)
@AllArgsConstructor
public class PermissionListener {

    private final SysPermissionService sysPermissionService;

    /**
     * 消息消费
     */
    @RabbitHandler
    public void recieved(List<PermissionEntityVO> list) {
        log.info("===========PermissionListener收到消息=============");
        if(ObjectUtil.isNotNull(list)){
            sysPermissionService.updateSysPermission(list);
        }
    }

}

MQ 收到消息后保存到数据库

5、在用户登录时，查询用户的所有权限，然后交给security-oauth2的框架管理

@Slf4j
@Service
@AllArgsConstructor
public class CustomUserDetailsServiceImpl implements CustomUserDetailsService {
    private final AuthenticationUserService customUserService;
    private final SysUserRoleMapper sysUserRoleMapper;
    private final SysPermissionMapper sysPermissionMapper;

    @Override
    @Cacheable(value = SecurityConstants.CACHE_USER_DETAILS, key = "#user_details", unless = "#result == null")
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        SysUser sysUser = customUserService.loadUserByUsername(username);
        //查询用户有哪些角色
        List<Long> roleIds = sysUserRoleMapper
                .selectList(Wrappers.<SysUserRole>query().lambda().eq(SysUserRole::getUserId,sysUser.getUserId()))
                .stream()
                .map(SysUserRole::getRoleId)
                .collect(Collectors.toList());
        if(CollUtil.isNotEmpty(roleIds)){
            //根据角色查询权限
            List<String> roleCodes = sysPermissionMapper.getPermission(roleIds)
                    .stream()
                    .map(SysPermission::getPermission)
                    .collect(Collectors.toList());
            sysUser.setRoleCode(roleCodes);
        }
        UserDetails userDetails = UserDetailsUtils.getUserDetails(sysUser);
        return userDetails;
    }
}

6、最后在接口上添加权限注解

@ResourcePermission("调用sms服务")
@RequestMapping(value = "/sms",method = RequestMethod.GET)
public R getSms(){
    return remoteSmsService.hello();
}

在管理员配置角色的时候也可以在数据库选择

验证流程

• 1、用户登录后查询所有的权限交给oauth2保存
• 2、当用户访问某个服务的资源时，会去验证这个用户是否有访问该资源的权限。因为服务启动时，就把所有加上注解的url资源交给了资源服务器，所有用户访问资源时，资源服务器，会通过check_token 去认证服务器验证token 和验证是否有访问权限
• 最后 项目地址：https://github.com/yzcheng90/ms