sso单点登录实现

单点登录在现在的系统架构中广泛存在，他将多个子系统的认证体系打通，实现了一个入口多处使用，而在架构单点登录时，也会遇到一些小问题，在不同的应用环境中可以采用不同的单点登录实现方案来满足需求。

简单的说就是，用户一次登录后，访问同个体系下的项目时，不用重复登录。

登录操作：
1.登录时生成一个token，以这个token为key，用户信息为value存入redis中。
2.token写入cookie中。
访问操作，使用拦截器实现：
1.从cookie中取出token。
2.根据token从redis中获取用户信息。
3.判断是否为空，不为空则取出用户信息；为空则跳转登录界面。
登出操作：
1.从cookie中取出token。
2.根据token从redis中删除对应的记录。
3.删除cookie。

这里框架我们使用springboot框架。

一、这里用到了redis，所以需要引入redis依赖和配置
pom.xml：

<!-- redis -->
<dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>

application.yml:

spring:
  datasource:
    driver-class-name: com.mysql.jdbc.Driver
    url: jdbc:mysql://127.0.0.1:3306/sell?characterEncoding=utf8&useSSL=false
    username: xxxx
    password: xxxxx
  jpa:
    show-sql: true
  redis:
    host: 192.168.1.109
    port: 6379

二、配置一个redis和cookie的常量类，便于数据管理

package com.wechat.order.constant;

/**
 * redis常量
 */
public interface RedisConstant {

    String TOKEN_PREFIX = "token_%s";

    Integer EXPIRE = 7200; //2小时
}

package com.wechat.order.constant;

/**
 * cookie常量
 */
public interface CookieConstant {

    String TOKEN = "token";

    Integer EXPIRE = 7200;
}

三、登录实现

    @Autowired
    private SellerService sellerService;

    @Autowired
    private StringRedisTemplate redisTemplate;

    @Autowired
    private ProjectUrlConfig projectUrlConfig;


    @GetMapping("/login")
    public ModelAndView login(@RequestParam("openid") String openid,
                              HashMap<String, Object> map,
                              HttpServletResponse response){

        //1.查询用户，查询规则大家自行编写
        SellerInfo sellerInfo = sellerService.findBySellerOpenid(openid);
        //判断用户是否存在，不存在跳转错误界面
        if(sellerInfo == null){
            map.put("msg", ResultEnum.LOGIN_FAIL.getMessage());
            map.put("url", "/sell/seller/order/list");
            return new ModelAndView("common/error",map);
        }else{
            //2.生成token,作为key，openid作为value存到redis中
            String token = UUID.randomUUID().toString();//uuid作为key
            Integer expire = RedisConstant.EXPIRE;//过期时间
            redisTemplate.opsForValue().set(String.format(RedisConstant.TOKEN_PREFIX, token), openid, expire, TimeUnit.SECONDS);

            //3.把token写到cookie中
            CookieUtil.set(response, CookieConstant.TOKEN, token, expire);

            return new ModelAndView("redirect:" + projectUrlConfig.getSell() + "/sell/seller/order/list");
        }
    }

CookieUtil：

package com.wechat.order.utils;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.HashMap;
import java.util.Map;

/**
 * cookie工具类
 */
public class CookieUtil {

    /**
     * 设置
     * @param response
     * @param name
     * @param value
     * @param maxAge
     */
    public static void set(HttpServletResponse response,
                           String name,
                           String value,
                           int maxAge) {
        Cookie cookie = new Cookie(name, value);
        cookie.setPath("/");
        cookie.setMaxAge(maxAge);
        response.addCookie(cookie);
    }

    /**
     * 获取cookie
     * @param request
     * @param name
     * @return
     */
    public static Cookie get(HttpServletRequest request,
                           String name) {
        Map<String, Cookie> cookieMap = readCookieMap(request);
        if (cookieMap.containsKey(name)) {
            return cookieMap.get(name);
        }else {
            return null;
        }
    }

    /**
     * 将cookie封装成Map
     * @param request
     * @return
     */
    private static Map<String, Cookie> readCookieMap(HttpServletRequest request) {
        Map<String, Cookie> cookieMap = new HashMap<>();
        Cookie[] cookies = request.getCookies();
        if (cookies != null) {
            for (Cookie cookie: cookies) {
                cookieMap.put(cookie.getName(), cookie);
            }
        }
        return cookieMap;
    }
}

四、登出实现

    @GetMapping("/logout")
    public ModelAndView logout(HttpServletRequest request,
                       HttpServletResponse response,
                       Map<String, Object> map){

        //1.查询cookie中token
        Cookie cookie = CookieUtil.get(request, CookieConstant.TOKEN);
        if(cookie != null){
            //2.通过token查询redis，删除token为key的记录
            redisTemplate.opsForValue().getOperations().delete(String.format(RedisConstant.TOKEN_PREFIX,cookie.getValue()));
            //3.删除cookie
            CookieUtil.set(response, CookieConstant.TOKEN, null, 0);
        }
        map.put("msg", ResultEnum.LOGOUT_SUCCESS.getMessage());
        map.put("url", "/sell/seller/order/list");
        return new ModelAndView("common/success", map);
    }

五、访问拦截器

访问身份验证aop：

package com.wechat.order.aspect;

import com.wechat.order.constant.CookieConstant;
import com.wechat.order.constant.RedisConstant;
import com.wechat.order.exception.SellerAuthorizeException;
import com.wechat.order.utils.CookieUtil;
import lombok.extern.slf4j.Slf4j;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.aspectj.lang.annotation.Pointcut;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;

/**
 * 访问身份验证aop
 */
@Aspect
@Component
@Slf4j
public class SellerAuthorizeAspect {

    @Autowired
    private StringRedisTemplate redisTemplate;

    @Pointcut("execution(public * com.wechat.order.controller.Seller*.*(..))" +
    "&& !execution(public * com.wechat.order.controller.SellerUserController.*(..))")
    public void verify() {}

    @Before("verify()")
    public void doVerify() {
        ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
        HttpServletRequest request = attributes.getRequest();

        //查询cookie
        Cookie cookie = CookieUtil.get(request, CookieConstant.TOKEN);
        if (cookie == null) {
            log.warn("【登录校验】Cookie中查不到token");
            throw new SellerAuthorizeException();
        }

        //去redis里查询，为了测试暂时把抛出错误注释
        String tokenValue = redisTemplate.opsForValue().get(String.format(RedisConstant.TOKEN_PREFIX, cookie.getValue()));
        if (StringUtils.isEmpty(tokenValue)) {
            log.warn("【登录校验】Redis中查不到token");
            throw new SellerAuthorizeException();
        }
    }
}

SellerAuthorizeException：

package com.wechat.order.exception;

/**
 * 身份验证异常
 */
public class SellerAuthorizeException extends RuntimeException {
}

拦截异常处理（可自行编写，此处返回微信二维码登录界面）：

package com.wechat.order.handler;

import com.wechat.order.config.ProjectUrlConfig;
import com.wechat.order.exception.SellerAuthorizeException;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.servlet.ModelAndView;

/**
 * 拦截异常处理
 */
@ControllerAdvice
public class SellExceptionHandler {

    @Autowired
    private ProjectUrlConfig projectUrlConfig;

    //拦截登录异常
    @ExceptionHandler(value = SellerAuthorizeException.class)
    public ModelAndView handlerAuthorizeException() {
        return new ModelAndView("redirect:"
        .concat(projectUrlConfig.getWechatOpenAuthorize())
        .concat("/sell/wechat/qrAuthorize")
        .concat("?returnUrl=")
        .concat(projectUrlConfig.getSell())
        .concat("/sell/seller/login"));
    }
}