单点登录一：SSO Demo

package com.dealer.filter;

import com.alibaba.fastjson.JSONObject;
import com.common.base.result.Result;
import com.dealer.config.Sso;
import com.dealer.util.SsoUtil;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.AccessControlFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.util.StringUtils;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class SIAPFilter extends AccessControlFilter {
    private static final Logger logger = LoggerFactory.getLogger(SIAPFilter.class);

    public SIAPFilter() {
    }

    /**
     * 表示是否允许访问；mappedValue就是[urls]配置中拦截器参数部分，如果允许访问返回true，否则false；
     * (感觉这里应该是对白名单（不需要登录的接口）放行的)
     * 如果isAccessAllowed返回true则onAccessDenied方法不会继续执行
     * 这里可以用来判断一些不被通过的链接（个人备注）
     * * 表示是否允许访问 ，如果允许访问返回true，否则false；
     *
     * @param servletRequest
     * @param servletResponse
     * @param object          表示写在拦截器中括号里面的字符串 mappedValue 就是 [urls] 配置中拦截器参数部分
     * @return
     * @throws Exception
     */
    @Override
    public boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object object) throws Exception {
        return false;
    }

    /**
     * 表示当访问拒绝时是否已经处理了；如果返回true表示需要继续处理；如果返回false表示该拦截器实例已经处理了，将直接返回即可。
     * onAccessDenied是否执行取决于isAccessAllowed的值，如果返回true则onAccessDenied不会执行；如果返回false，执行onAccessDenied
     * 如果onAccessDenied也返回false，则直接返回，不会进入请求的方法（只有isAccessAllowed和onAccessDenied的情况下）
     */
    @Override
    public boolean onAccessDenied(ServletRequest servletRequest, ServletResponse servletResponse) throws Exception {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        HttpSession session = request.getSession();
        String tolUrl = request.getRequestURI();
        this.logger.info("《请求的URL是：" + tolUrl + "》");
        String code = request.getParameter("code");
        this.logger.info("《请求的code是：" + code + "》");
        this.logger.error("session的ID为：" + request.getSession().getId());
        if (!StringUtils.isEmpty((String) request.getSession().getAttribute("token"))) {
            Object uid = request.getSession().getAttribute("uid");
            if (StringUtils.isEmpty(uid)) {
                response.sendRedirect(Sso.oauthService + "/authorize?client_id=" + Sso.client_id + "&redirect_uri=" + Sso.redirect_uri + "&response_type=code&third_app=1");
            }
            return true;
        } else {
            if (StringUtils.isEmpty(code)) {
                Object accessToken = session.getAttribute("accessToken");
                if (StringUtils.isEmpty(accessToken)) {
                    this.logger.info("《session accessToken authentication fail》");
                    response.sendRedirect(Sso.oauthService + "/authorize?client_id=" + Sso.client_id + "&redirect_uri=" + Sso.redirect_uri + "&response_type=code&third_app=1");
                    return false;
                } else {
                    if ("/siap4dealer".equals(tolUrl) || "/siap4dealer/".equals(tolUrl)) {
                        response.sendRedirect(response.encodeRedirectURL(Sso.vue_uri));
                        return false;
                    } else {
                        Object uid = request.getSession().getAttribute("uid");
                        this.logger.info("《uid》" + uid);
                        if (StringUtils.isEmpty(uid)) {
                            response.sendRedirect(response.encodeRedirectURL(Sso.oauthService + "/authorize?client_id=" + Sso.client_id + "&redirect_uri=" + Sso.redirect_uri + "&response_type=code&third_app=1"));
                            return false;
                        }
                        return true;
                    }
                }
            } else {
                JSONObject accessTokenObj = SsoUtil.getAccessToken(code);
                if (StringUtils.isEmpty(accessTokenObj)) {
                    this.logger.info("《sso code authentication fail》");
                    response.sendRedirect(response.encodeRedirectURL(Sso.oauthService + "/authorize?client_id=" + Sso.client_id + "&redirect_uri=" + Sso.redirect_uri + "&response_type=code&third_app=1"));
                    return false;
                } else {
                    String accessToken = (String) accessTokenObj.get("access_token");
                    session.setAttribute("accessToken", accessToken);
                    this.logger.info("《sso code authentication success》");
                    String userName = SsoUtil.getUserInfo(accessToken);
                    this.logger.info("《sso userInfo authentication success》" + userName);
                    if (userName.contains("error")) {
                        response.sendRedirect(response.encodeRedirectURL(Sso.oauthService + "/authorize?client_id=" + Sso.client_id + "&redirect_uri=" + Sso.redirect_uri + "&response_type=code&third_app=1"));
                        return false;
                    } else {
//                    List<SiapDealer> siapDealers = null;
//                    if (!StringUtils.isEmpty(userName)) {
//                        siapDealers = siapDealerService.selectByAccountCode(userName);
//                    }
//                    logger.error("siapDealers为~~~~~~~~~~~~~~~~~~~~~~~~~：" + siapDealers);
//                    if (siapDealers.size() < 0) {
//                        logger.info("该ASC用户({})没有权限访问网站", userName);
//                        response.setStatus(302);
//                        response.sendRedirect(Sso.logout);
//                    } else {
                        //执行登录
                        try {
                            //执行登录操作
                            UsernamePasswordToken token = new UsernamePasswordToken(userName, "");
                            Subject currentUser = SecurityUtils.getSubject();
                            currentUser.login(token);
                            response.sendRedirect(response.encodeRedirectURL(Sso.vue_uri));
                        } catch (IncorrectCredentialsException ice) {
                            Result.error("shiro执行登录时报错");
                        }
                    }
                    if ("/siap4dealer".equals(tolUrl) || "/siap4dealer/".equals(tolUrl)) {
                        response.sendRedirect(response.encodeRedirectURL(Sso.vue_uri));
                        return false;
                    } else {
                        Object uid = request.getSession().getAttribute("uid");
                        if (StringUtils.isEmpty(uid)) {
                            response.sendRedirect(response.encodeRedirectURL(Sso.oauthService + "/authorize?client_id=" + Sso.client_id + "&redirect_uri=" + Sso.redirect_uri + "&response_type=code&third_app=1"));
                            return false;
                        }
                            return true;
                    }
                }
            }
        }
    }
}

package com.dealer.util;


import com.alibaba.fastjson.JSONObject;
import com.dealer.config.Sso;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.nio.charset.Charset;

@Component
public class SsoUtil {

    /**
     * @return json
     * @throws
     * @Description: 请求SSO接口获取用户信息
     */
    public static String getUserInfo(String accessToken) throws IOException {
        Logger logger = LoggerFactory.getLogger(SsoUtil.class);
        InputStream is = null;
        try {
            is = new URL(Sso.tokenUrl + "/userInfo?access_token=" + accessToken).openStream();
            BufferedReader rd = new BufferedReader(new InputStreamReader(is, Charset.forName("UTF-8")));
            StringBuilder sb = new StringBuilder();
            int cp;
            while ((cp = rd.read()) != -1) {
                sb.append((char) cp);
            }
            String jsonText = sb.toString();
            return jsonText;
        } catch (Exception ex) {
            // do Nothing
            ex.printStackTrace();

        } finally {

            is.close();

        }
        return null;
    }

    /**
     * @return json
     * @throws
     * @Description: 请求SSO接口获取 access_token信息
     */
    public static JSONObject getAccessToken(String code) throws IOException {
        Logger logger = LoggerFactory.getLogger(SsoUtil.class);
        InputStream is = null;
        try {
            is = new URL(Sso.tokenUrl + "/token?grant_type=authorization_code&code="
                    + code + "&client_id=" + Sso.client_id + "&client_secret=" + Sso.client_secret).openStream();
            logger.info("------------is------------------" + is.toString());
            BufferedReader rd = new BufferedReader(new InputStreamReader(is, Charset.forName("UTF-8")));
            StringBuilder sb = new StringBuilder();
            int cp;
            while ((cp = rd.read()) != -1) {
                sb.append((char) cp);
            }
            String jsonText = sb.toString();
            JSONObject json = JSONObject.parseObject(jsonText);
            return json;
        } catch (Exception ex) {
            // do Nothing
            ex.printStackTrace();
        } finally {

            is.close();

        }
        return null;
    }
}