单点登录(sso)

一处登录，处处使用

对单点登录的学习及使用

有关时序图：

单点登录

cookie和session的区别

区别	cookie	session
存储位置	客户端	服务器
安全性	不安全	安全
数据类型	保存大小（4k） String	Object
生命周期	setMaxAge()	一次会话

🚀使用技术：cookie+redis+JWT+拦截器+自定义注解+httpClientUtils

UserInfoServiceImpl核对后台登录信息+用户登录信息载入缓存

controller

@Controller
public class PassportController {

    @Reference
    private UserService userService;


    @RequestMapping("index")
    public String index(HttpServletRequest request) {

        String originUrl = request.getParameter("originUrl");

        request.setAttribute("originUrl",originUrl);

        return "index";
    }

    @RequestMapping("login")
    @ResponseBody
    public String login(UserInfo userInfo) {

        //调用登录方法
        UserInfo info = userService.login(userInfo);
        if (info != null) {
            return "success";
        }else {
            return  "fail";

        }
    }
}

UserServiceImpl

@Service
public class UserServiceImpl implements UserService {


    public String userKey_prefix="user:";
    public String userinfoKey_suffix=":info";
    public int userKey_timeOut=60*60*24;


    @Autowired
    private UserInfoMapper userInfoMapper;

    @Autowired
    private UserAdderssMapoper userAdderssMapoper;

    @Autowired
    private RedisUtil redisUtil;

    @Override
    public List<UserInfo> findAll() {


        return userInfoMapper.selectAll();
    }

    @Override
    public List<UserAddress> getUserAddressList(String userId) {

        UserAddress userAddress = new UserAddress();

        userAddress.setId(userId);


        return userAdderssMapoper.select(userAddress);
    }

    @Override
    public UserInfo login(UserInfo userInfo) {

        //密码
        String passwd = userInfo.getPasswd();
        String digestAsHex = DigestUtils.md5DigestAsHex(passwd.getBytes());

        userInfo.setPasswd(digestAsHex);

        //登录
        UserInfo info = userInfoMapper.selectOne(userInfo);

        if (info != null) {

            Jedis jedis = redisUtil.getJedis();
            String userKey = userKey_prefix+info.getId()+userinfoKey_suffix;
            jedis.setex(userKey,userKey_timeOut,JSON.toJSONString(info));

            jedis.close();
            return info;

        }

        return null;
    }
}

生成Token

什么是JWT

JWT（Json Web Token）是为了在网络应用环境间传递声明而执行的一种基于JSON的开放标准。

JWT的声明一般被用来在身份提供者和服务提供者间传递被认证的用户身份信息，以便于从资源服务器获取资源。比如用在用户登录上。

JWT 最重要的作用就是对 token信息的防伪作用。

JWT的原理：

一个JWT由三个部分组成：公共部分、私有部分、签名部分。最后由这三者组合进行base64编码得到 JWT。

sadad

使用步骤

在pom.xml中添加

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.0</version>
</dependency>

JWTUtils

public class JwtUtil {
    public static String encode(String key,Map<String,Object> param,String salt){
        if(salt!=null){
            key+=salt;
        }
        JwtBuilder jwtBuilder = Jwts.builder().signWith(SignatureAlgorithm.HS256,key);

        jwtBuilder = jwtBuilder.setClaims(param);

        String token = jwtBuilder.compact();
        return token;

    }


    public  static Map<String,Object> decode(String token , String key, String salt){
        Claims claims=null;
        if (salt!=null){
            key+=salt;
        }
        try {
            claims= Jwts.parser().setSigningKey(key).parseClaimsJws(token).getBody();
        } catch ( JwtException e) {
            return null;
        }
        return  claims;
    }

}

测试

@Test
    public void testJwt() {

        String key = "atguan";

        Map<String,Object> map = new HashMap<>();

        String salt = "192.168.113.1";

        map.put("userId",1001);
        map.put("nickName","admin");

        String token = JwtUtil.encode(key, map, salt);

        System.err.println(token);

        //解密
        Map<String, Object> decode = JwtUtil.decode(token, key, salt);

        System.err.println(decode);
    }

JWT实战

完善login控制器

@RequestMapping("login")
    @ResponseBody
    public String login(UserInfo userInfo,HttpServletRequest request) {

        //salt服务器ip地址
        String salt = request.getHeader("X-forwarded-for");

        //调用登录方法
        UserInfo info = userService.login(userInfo);
        if (info != null) {

            //制作token
            Map<String,Object> map = new HashMap<>();
            map.put("userId",userInfo.getId());
            map.put("nickName",userInfo.getNickName());
            String token = JwtUtil.encode(key, map, salt);

            System.err.println(token);
            return token;
        }else {
            return  "fail";

        }
    }

认证verify

controller

@RequestMapping("verify")
    @ResponseBody
    public String verify(HttpServletRequest request) {

//        String salt = request.getHeader("X-forwarded-for");
        //获取token
        String token = request.getParameter("token");
        String salt = request.getParameter("salt");

        //调用jwt
        Map<String, Object> map = JwtUtil.decode(token, key, salt);

        if (map != null && map.size() > 0) {
            String userId = (String) map.get("userId");
            UserInfo userInfo = userService.verify(userId);
            if (userInfo != null) {
                return "success";
            }else {
                return "fail";
            }
        }
        return "fail";

    }

service

@Override
    public UserInfo verify(String userId) {

        Jedis jedis = null;
        try {
            jedis = redisUtil.getJedis();
            String userKey = userKey_prefix+userId+userinfoKey_suffix;

            String userJson = jedis.get(userKey);
            if (!StringUtils.isEmpty(userJson)) {
                UserInfo userInfo = JSON.parseObject(userJson, UserInfo.class);

                return userInfo;
            }
        } catch (Exception e) {
            e.printStackTrace();
        } finally {
            if (jedis != null) {
                jedis.close();
            }
        }

        return null;
    }

自定义拦截器

在每次访问控制器时自动拦截，检查是否携带token或cookie中存在token

cookie工具类

public class CookieUtil {


    public static String getCookieValue(HttpServletRequest request, String cookieName, boolean isDecoder) {
        Cookie[] cookies = request.getCookies();
        if (cookies == null || cookieName == null){
            return null;
        }
        String retValue = null;
        try {
            for (int i = 0; i < cookies.length; i++) {
                if (cookies[i].getName().equals(cookieName)) {
                    if (isDecoder) {//如果涉及中文
                        retValue = URLDecoder.decode(cookies[i].getValue(), "UTF-8");
                    } else {
                        retValue = cookies[i].getValue();
                    }
                    break;
                }
            }
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        return retValue;
    }


    public static   void setCookie(HttpServletRequest request, HttpServletResponse response, String cookieName, String cookieValue, int cookieMaxage, boolean isEncode) {
        try {
            if (cookieValue == null) {
                cookieValue = "";
            } else if (isEncode) {
                cookieValue = URLEncoder.encode(cookieValue, "utf-8");
            }
            Cookie cookie = new Cookie(cookieName, cookieValue);
            if (cookieMaxage >= 0)
                cookie.setMaxAge(cookieMaxage);
            if (null != request)// 设置域名的cookie
                cookie.setDomain(getDomainName(request));
            cookie.setPath("/");
            response.addCookie(cookie);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }



    /**
     * 得到cookie的域名
     */
    private static final String getDomainName(HttpServletRequest request) {
        String domainName = null;

        String serverName = request.getRequestURL().toString();
        if (serverName == null || serverName.equals("")) {
            domainName = "";
        } else {
            serverName = serverName.toLowerCase();
            serverName = serverName.substring(7);
            final int end = serverName.indexOf("/");
            serverName = serverName.substring(0, end);
            final String[] domains = serverName.split("\\.");
            int len = domains.length;
            if (len > 3) {
                // www.xxx.com.cn
                domainName = domains[len - 3] + "." + domains[len - 2] + "." + domains[len - 1];
            } else if (len <= 3 && len > 1) {
                // xxx.com or xxx.cn
                domainName = domains[len - 2] + "." + domains[len - 1];
            } else {
                domainName = serverName;
            }
        }

        if (domainName != null && domainName.indexOf(":") > 0) {
            String[] ary = domainName.split("\\:");
            domainName = ary[0];
        }
        System.out.println("domainName = " + domainName);
        return domainName;
    }

    public static void deleteCookie(HttpServletRequest request, HttpServletResponse response, String cookieName) {
        setCookie(request, response, cookieName, null, 0, false);
    }


}

WebConst

public class WebConst {

    public static final int COOKIE_MAXAGE=7*24*3600;

    public static  final  String VERIFY_ADDRESS="http://passport.atguan.com/verify";

    public static  final  String LOGIN_ADDRESS="http://passport.atguan.com/index";


}

AuthInterceptor拦截器

@Component
public class AuthInterceptor extends HandlerInterceptorAdapter {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        String token = request.getParameter("newToken");

        if (token != null) {
            CookieUtil.setCookie(request,response,"token",token,WebConst.COOKIE_MAXAGE,false);
        }

        if (token == null) {
            token = CookieUtil.getCookieValue(request, "token", false);
        }
        if (token != null) {
            Map<String,Object> map = getUserMapByToken(token);
            String nickName = (String) map.get("nickName");
            request.setAttribute("nickName",nickName);
        }

        return true;
    }

    /**
     * 获取map数据
     * @param token
     * @return
     */
    private Map<String, Object> getUserMapByToken(String token) {

        //截取中间部分
        String userInfo = StringUtils.substringBetween(token, ".");
        //base64解码
        Base64UrlCodec base64UrlCodec = new Base64UrlCodec();
        byte[] decode = base64UrlCodec.decode(userInfo);
        //将decode转成string
        String mapJson = null;
        try {
            mapJson = new String(decode, "UTF-8");
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }

        //将字符串转化为map
        return JSON.parseObject(mapJson,Map.class);

    }


    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
    }
}

加入拦截器的配置

@Configuration
public class WebMvcConfiguration extends WebMvcConfigurerAdapter {


    @Autowired
    private AuthInterceptor authInterceptor;

    //拦截器
    @Override
    public void addInterceptors(InterceptorRegistry registry) {

        //配置拦截器
        registry.addInterceptor(authInterceptor).addPathPatterns("/**");

        //添加拦截器
        super.addInterceptors(registry);
    }

}

添加扫描包

@ComponentScan(basePackages = "com.atguan.gmall")

为方便使用应该自定义一个注解，当有需要时在方法上加上此注解，则会被拦截器拦截

1、RetentionPolicy.SOURCE：注解只保留在源文件，当Java文件编译成class文件的时候，注解被遗弃；
2、RetentionPolicy.CLASS：注解被保留到class文件，但jvm加载class文件时候被遗弃，这是默认的生命周期；
3、RetentionPolicy.RUNTIME：注解不仅被保存到class文件中，jvm加载class文件之后，仍然存在；

这3个生命周期分别对应于：Java源文件(.java文件) ---> .class文件 ---> 内存中的字节码。

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface LoginRequire {

    boolean autoRedirect() default true;
}

完善拦截器，在preHandle方法中加入：

//在拦截器中获取方法上的注解
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        //获取方法上的注解
        LoginRequire methodAnnotation = handlerMethod.getMethodAnnotation(LoginRequire.class);
        if (methodAnnotation != null) {
            //有注解
            //判断用户是否登录,调用verify方法
            //获得服务器的ip地址
            String salt = request.getHeader("X-forwarded-for");

            String result = HttpClientUtil.doGet(WebConst.VERIFY_ADDRESS+"?token="+token+"&salt="+salt);
            if ("success".equals(result)) {
                //认证成功
                //开始解密token
                Map map = getUserMapByToken(token);
                //取出userId
                String userId = (String) map.get("userId");
                //保存到作用域
                request.setAttribute("userId",userId);
                return true;
            }else {
                //认证失败
                if (methodAnnotation.autoRedirect()) {
                    //表示必须登录
                    //获取url
                    String requestUrl = request.getRequestURL().toString();
                    System.err.println(requestUrl);
                    //进行转码
                    String encode = URLEncoder.encode(requestUrl, "UTF-8");
                    System.err.println(encode);

                    //拼接重定向
                    response.sendRedirect(WebConst.LOGIN_ADDRESS+"?originUrl="+encode);
                    return false;
                }
            }

HttpClientUtil工具类

public class HttpClientUtil {

    public static String doGet(String url)   {

        // 创建Httpclient对象
        CloseableHttpClient httpclient = HttpClients.createDefault();
        // 创建http GET请求
        HttpGet httpGet = new HttpGet(url);
        CloseableHttpResponse response = null;
        try {
            // 执行请求
            response = httpclient.execute(httpGet);
            // 判断返回状态是否为200
            if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
                HttpEntity entity = response.getEntity();
                String result = EntityUtils.toString(entity, "UTF-8");
                EntityUtils.consume(entity);
                httpclient.close();
                return result;
            }
            httpclient.close();
        }catch (IOException e){
            e.printStackTrace();
            return null;
        }

        return  null;
    }


    public static void download(String url,String fileName)   {

        // 创建Httpclient对象
        CloseableHttpClient httpclient = HttpClients.createDefault();
        // 创建http GET请求
        HttpGet httpGet = new HttpGet(url);
        CloseableHttpResponse response = null;
        try {
            // 执行请求
            response = httpclient.execute(httpGet);
            // 判断返回状态是否为200
            if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
                HttpEntity entity = response.getEntity();

               // String result = EntityUtils.toString(entity, "UTF-8");
                byte[] bytes = EntityUtils.toByteArray(entity);
                File file =new File(fileName);
               //  InputStream in = entity.getContent();
                FileOutputStream fout = new FileOutputStream(file);
                fout.write(bytes);

                EntityUtils.consume(entity);

                httpclient.close();
                fout.flush();
                fout.close();
                return  ;
            }
            httpclient.close();
        }catch (IOException e){
            e.printStackTrace();
            return  ;
        }

        return   ;
    }
}

涉及cookie跨域问题

注意cookie工具类中getDomainName方法

     /**
   * 得到cookie的域名
     */
    private static final String getDomainName(HttpServletRequest request) {
        String domainName = null;

        String serverName = request.getRequestURL().toString();
        if (serverName == null || serverName.equals("")) {
            domainName = "";
        } else {
            serverName = serverName.toLowerCase();
            serverName = serverName.substring(7);
            final int end = serverName.indexOf("/");
            serverName = serverName.substring(0, end);
            final String[] domains = serverName.split("\\.");
            int len = domains.length;
            if (len > 3) {
                // www.xxx.com.cn
                domainName = domains[len - 3] + "." + domains[len - 2] + "." + domains[len - 1];
            } else if (len <= 3 && len > 1) {
                // xxx.com or xxx.cn
                domainName = domains[len - 2] + "." + domains[len - 1];
            } else {
                domainName = serverName;
            }
        }

        if (domainName != null && domainName.indexOf(":") > 0) {
            String[] ary = domainName.split("\\:");
            domainName = ary[0];
        }
        System.out.println("domainName = " + domainName);
        return domainName;
    }

单点登录

单点登录(sso)

有关时序图：

cookie和session的区别

🚀使用技术：cookie+redis+JWT+拦截器+自定义注解+httpClientUtils

UserInfoServiceImpl核对后台登录信息+用户登录信息载入缓存

controller

UserServiceImpl

生成Token

什么是JWT

使用步骤

JWT实战

认证verify

自定义拦截器

为方便使用应该自定义一个注解，当有需要时在方法上加上此注解，则会被拦截器拦截

涉及cookie跨域问题

评论区