Spring Security结合
JWT实现单点登录的代码流程如下：
1. 创建一个
Spring Boot项目并添加以下依赖：
```
<dependency>
<groupId>org.
springframework.boot</groupId>
<artifactId>
spring-boot-starter-
security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2. 在
Spring Security配置类中添加以下代码：
```
@Configuration
@EnableWeb
Security
public class
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private
JwtAuthenticationEntryPoint unauthorizedHandler;
@Autowired
private CustomUserDetailsService customUserDetailsService;
@Value("${
jwt.secret}")
private String secret;
@Value("${
jwt.expiration}")
private int expiration;
@Bean
public
JwtAuthenticationFilter authenticationTokenFilter() {
return new
JwtAuthenticationFilter();
}
@Override
public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
authenticationManagerBuilder
.userDetailsService(customUserDetailsService)
.passwordEncoder(passwordEncoder());
}
@Bean(BeanIds.AUTHENTICATION_MANAGER)
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(Http
Security http) throws Exception {
http
.cors()
.and()
.csrf()
.disable()
.exceptionHandling()
.authenticationEntryPoint(unauthorizedHandler)
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/api/auth/**")
.permitAll()
.anyRequest()
.authenticated();
// 添加
JWT过滤器
http.addFilterBefore(authenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
}
@Bean
public
JwtTokenProvider
jwtTokenProvider() {
return new
JwtTokenProvider(secret, expiration);
}
}
```
3. 创建一个
JwtTokenProvider类，
实现JWT的生成、解析和验证：
```
@Service
public class
JwtTokenProvider {
private final String secret;
private final long expiration;
@Autowired
public
JwtTokenProvider(@Value("${
jwt.secret}") String secret, @Value("${
jwt.expiration}") long expiration) {
this.secret = secret;
this.expiration = expiration;
}
public String generateToken(Authentication authentication) {
UserPrincipal userPrincipal = (UserPrincipal) authentication.getPrincipal();
Date now = new Date();
Date expiryDate = new Date(now.getTime() + expiration);
return
Jwts.builder()
.setSubject(Long.toString(userPrincipal.getId()))
.setIssuedAt(new Date())
.setExpiration(expiryDate)
.signWith(SignatureAlgorithm.HS512, secret)
.compact();
}
public Long getUserIdFromToken(String token) {
Claims claims =
Jwts.parser()
.setSigningKey(secret)
.parseClaimsJws(token)
.getBody();
return Long.parseLong(claims.getSubject());
}
public boolean validateToken(String token) {
try {
Jwts.parser().setSigningKey(secret).parseClaimsJws(token);
return true;
} catch (SignatureException ex) {
System.out.println("Invalid
JWT signature");
} catch (Malformed
JwtException ex) {
System.out.println("Invalid
JWT token");
} catch (Expired
JwtException ex) {
System.out.println("Expired
JWT token");
} catch (Unsupported
JwtException ex) {
System.out.println("Unsupported
JWT token");
} catch (IllegalArgumentException ex) {
System.out.println("
JWT claims string is empty.");
}
return false;
}
}
```
4. 创建一个
JwtAuthenticationFilter类，拦截请求并验证
JWT：
```
public class
JwtAuthenticationFilter extends OncePerRequestFilter {
@Autowired
private
JwtTokenProvider
jwtTokenProvider;
@Autowired
private CustomUserDetailsService customUserDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
try {
String
jwt = get
JwtFromRequest(request);
if (StringUtils.hasText(
jwt) &&
jwtTokenProvider.validateToken(
jwt)) {
Long userId =
jwtTokenProvider.getUserIdFromToken(
jwt);
UserDetails userDetails = customUserDetailsService.loadUserById(userId);
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
} catch (Exception ex) {
logger.error("Could not set user authentication in
security context", ex);
}
filterChain.doFilter(request, response);
}
private String get
JwtFromRequest(HttpServletRequest request) {
String bearerToken = request.getHeader("Authorization");
if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
return bearerToken.substring(7, bearerToken.length());
}
return null;
}
}
```
5. 创建一个
JwtAuthenticationEntryPoint类，处理未授权的请求：
```
@Component
public class
JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
}
}
```
6. 创建一个UserPrincipal类，
实现Spring Security的UserDetails接口：
```
public class UserPrincipal implements UserDetails {
private Long id;
private String username;
private String email;
private String password;
private Collection<? extends GrantedAuthority> authorities;
public UserPrincipal(Long id, String username, String email, String password, Collection<? extends GrantedAuthority> authorities) {
this.id = id;
this.username = username;
this.email = email;
this.password = password;
this.authorities = authorities;
}
public Long getId() {
return id;
}
public String getEmail() {
return email;
}
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return authorities;
}
@Override
public String getPassword() {
return password;
}
@Override
public String getUsername() {
return username;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
```
7. 创建一个CustomUserDetailsService类，
实现Spring Security的UserDetailsService接口：
```
@Service
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
@Transactional
public UserDetails loadUserByUsername(String usernameOrEmail) throws UsernameNotFoundException {
User user = userRepository.findByUsernameOrEmail(usernameOrEmail, usernameOrEmail)
.orElseThrow(() ->
new UsernameNotFoundException("User not found with username or email : " + usernameOrEmail)
);
return UserPrincipal.create(user);
}
@Transactional
public UserDetails loadUserById(Long id) {
User user = userRepository.findById(id)
.orElseThrow(() ->
new ResourceNotFoundException("User", "id", id)
);
return UserPrincipal.create(user);
}
}
```
以上就是
Spring Security结合
JWT实现单点登录的代码流程，可以根据具体的需求进行相应的修改和调整。
1559
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
