STS临时授权访问OSS

刺骨的言语ヽ痛彻心扉 2022-01-05 10:21 194阅读 0赞

STS临时授权访问OSS需要配合RAM子账号一起使用

具体使用流程参考：[STS临时授权访问OSS][STS_OSS]

这里我列出我的代码，以备以后复制使用。

### 文章目录 ###

*  后端代码
 *   *  依赖
     *  Controller
 *  前端代码
 *  上传测试
 *  遇到的问题

# 后端代码 #

## 依赖 ##

<dependency>
        <groupId>com.aliyun</groupId>
        <artifactId>aliyun-java-sdk-core</artifactId>
        <version>3.2.2</version>
    </dependency>
    
    <dependency>
        <groupId>com.aliyun</groupId>
        <artifactId>aliyun-java-sdk-sts</artifactId>
        <version>3.0.0</version>
    </dependency>

## Controller ##

package com.jdcloud.provider.web.sts;
    
    import com.aliyuncs.DefaultAcsClient;
    import com.aliyuncs.exceptions.ClientException;
    import com.aliyuncs.http.MethodType;
    import com.aliyuncs.http.ProtocolType;
    import com.aliyuncs.profile.DefaultProfile;
    import com.aliyuncs.profile.IClientProfile;
    import com.aliyuncs.sts.model.v20150401.AssumeRoleRequest;
    import com.aliyuncs.sts.model.v20150401.AssumeRoleResponse;
    import com.jdcloud.provider.model.vo.OssTokenVO;
    import com.jdcloud.util.wrapper.WrapMapper;
    import com.jdcloud.util.wrapper.Wrapper;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import java.util.Objects;
    
    /** * 阿里云OSS STS * * @author leigq */
    @Slf4j
    @RestController
    @RequestMapping("/aliyun/sts")
    public class AliyunStsController { 
    
        /** * 获取 OSS 签名授权 * * @return * @author leigq * @date 2018-12-17 15:08:55 **/
        @GetMapping("/oss/tokens")
        public Wrapper getOssToken() { 
            // 创建阿里云 OSS 临时token
            AssumeRoleResponse ossToken = createOssToken();
            if (Objects.isNull(ossToken)) { 
                return WrapMapper.error("获取 OSS 签名授权失败！");
            }
            // 阿里 OSS 配置
            AssumeRoleResponse.Credentials credentials = ossToken.getCredentials();
            // 构建 OSS token 返回给前端
            OssTokenVO ossTokenVO = OssTokenVO.builder()
                    // region每个地方不一样，下面是深圳的：shenzhen
                    .region("oss-cn-shenzhen")
                    .accessKeyId(credentials.getAccessKeyId())
                    .accessKeySecret(credentials.getAccessKeySecret())
                    .securityToken(credentials.getSecurityToken())
                    .expiration(credentials.getExpiration())
                    // OSS bucket名称
                    .bucket("leigq-bucket")
                    .build();
            return WrapMapper.ok(ossTokenVO);
        }
    
        /** * 创建阿里云 OSS 临时token * @author leigq * @return */
        private AssumeRoleResponse createOssToken() { 
            /* * 子账号的 accessKeyId、accessKeySecret、roleArn，注意：子账号需赋予 AliyunSTSAssumeRoleAccess(调用STS服务AssumeRole接口的权限)权限 * */
            String accessKeyId = "LTAIEYh****o1Ukv";
            String accessKeySecret = "7JjHqPaGKGfXH****KEFqB3oys8Gv4";
            String roleArn = "acs:ram::1915198****60148:role/tst-test";
    
            //roleSessionName时临时Token的会话名称，自己指定用于标识你的用户，或者用于区分Token颁发给谁
            //要注意roleSessionName的长度和规则，不要有空格，只能有'-'和'_'字母和数字等字符
            String roleSessionName = "session-name";
            try { 
                // 创建一个 Aliyun Acs Client, 用于发起 OpenAPI 请求
                DefaultProfile.addEndpoint("", "", "Sts", "sts.aliyuncs.com");
                IClientProfile profile = DefaultProfile.getProfile("", accessKeyId, accessKeySecret);
                DefaultAcsClient client = new DefaultAcsClient(profile);
                // 创建一个 AssumeRoleRequest 并设置请求参数
                final AssumeRoleRequest request = new AssumeRoleRequest();
                //POST请求
                request.setMethod(MethodType.POST);
                //https协议
                request.setProtocol(ProtocolType.HTTPS);
                //持续时间, 只能设置 15min - 1hr 之间
                request.setDurationSeconds(900L);
                //角色id
                request.setRoleArn(roleArn);
                //应用程序标识(自己定义)
                request.setRoleSessionName(roleSessionName);
                // 发起请求，并得到response
                AssumeRoleResponse acsResponse = client.getAcsResponse(request);
                return acsResponse;
            } catch (ClientException e) { 
                log.error("创建阿里云 OSS 临时token异常", e);
            }
            return null;
        }
    }

上面用到的`OssTokenVO`实体：

package com.jdcloud.provider.model.vo;
    
    import lombok.Builder;
    import lombok.Data;
    
    /** * 阿里OSS Token VO * * @author leigq */
    @Data
    @Builder
    public class OssTokenVO { 
    
        private String region;
    
        private String accessKeyId;
    
        private String accessKeySecret;
    
        private String securityToken;
    
        private String bucket;
    
        private String expiration;
    
    }

用浏览器请求此接口，结果如下：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODQ1Mzk0_size_16_color_FFFFFF_t_70]  
tips：每次请求数据都会发生变化。

# 前端代码 #

前端先请求上面的接口，获取到region、accessKeyId、accessKeySecret、stsToken，就可以上传图片了。

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <meta http-equiv="X-UA-Compatible" content="ie=edge">
        <title>Document</title>
    </head>
    
    <body>
        <input type="file" name="picFieldName" id="picFieldId" onchange="uploadPic(this)" />
        
        <script src="http://gosspublic.alicdn.com/aliyun-oss-sdk-5.3.0.min.js"></script>
        <script> var client = new OSS.Wrapper({ region: 'oss-cn-shenzhen', accessKeyId: 'STS.NKR9sKxWY****bVpecXJq2Ujc', accessKeySecret: 'H2hC2kT7tyEt5B5****HHV7MJdovTweDx1ugoK5BYZXc', stsToken: 'CAIS8gF1q6Ft5B2yfSjIr4jncsn/lYh47oqdW0TnlGU2VMVd3ZDBgTz2IHpOfnNsCeAWsvUxnm1V5vsflqVoRoReREvCKM1565kPX7o+nVqE6aKP9rUhpMCPOwr6UmzWvqL7Z+H+U6muGJOEYEzFkSle2KbzcS7YMXWuLZyOj+wMDL1VJH7aCwBLH9BLPABvhdYHPH/KT5aXPwXtn3DbATgD2GM+qxsmtvvnm5bCsUKF1QGhkbREnemrfMj4NfsLFYxkTtK40NZx****yyNK43BIjvws1vYepWeX7o3MXQMMvkXbbvC79cZ0aRRlfbj54HDgGy0G/hqAARZcV0zbN+Tm9xpy6qrS7Bw/tw1Sn/zG+/hImKRSTdxz7GjLc/CvnefWQQ47bu1cK9Z38pm8kfo+etFY06j89hz+yNiDd+xjEPkgm3rIA/lvAn4oHSN0z0PGjFzxDTCcupEDd7/MJcReo7aQFuRVbO0We/jGobAqNNXGSY5/l9QD', bucket: 'bitrade-sz-oss' }); function uploadPic(obj) { // 获取文件流 var file = obj.files[0]; // 路径 var storeAs = "studio_course/" + file.name; console.log(file.name + ' => ' + storeAs); client.put(storeAs, file).then(function (result) { console.log(result); }).catch(function (err) { console.log(err); }); } </script>
    </body>
    </html>

# 上传测试 #

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODQ1Mzk0_size_16_color_FFFFFF_t_70 1]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODQ1Mzk0_size_16_color_FFFFFF_t_70 2]  
正常上传！

# 遇到的问题 #

*  [OSS阿里云上传文件 前端 js 下载 url 跨域问题][OSS_ _ js _ url]

[STS_OSS]: https://www.cnblogs.com/ggband/p/10218851.html
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODQ1Mzk0_size_16_color_FFFFFF_t_70]: /images/20211229/0a638d7173ca42f9aaf4a5923b4f5e15.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODQ1Mzk0_size_16_color_FFFFFF_t_70 1]: /images/20211229/9814b66a554e4f1289873a957b3c17da.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODQ1Mzk0_size_16_color_FFFFFF_t_70 2]: /images/20211229/735dd997585e45d0b45d29099022db05.png
[OSS_ _ js _ url]: https://blog.csdn.net/lucky541788/article/details/87268995