扩展资源服务器解决oauth2 性能瓶颈

电玩女神 2022-02-13 03:27 217阅读 0赞

![20190317234215_SWBWuI_E6_9C_AA_E5_91_BD_E5_90_8D_E6_96_87_E4_BB_B6.jpeg][]

*  用户携带token 请求资源服务器
 *  资源服务器拦截器 携带token 去认证服务器 调用tokenstore 对token 合法性校验
 *  资源服务器拿到token，默认只会含有用户名信息
 *  通过用户名调用userdetailsservice.loadbyusername 查询用户全部信息

详细性能瓶颈分析，请参考上篇文章[《扩展jwt解决oauth2 性能瓶颈》 ][jwt_oauth2 _]  
**本文是针对传统使用UUID token 的情况进行扩展**，提高系统的吞吐率，解决性能瓶颈的问题

### 默认check-token 解析逻辑 ###

*  RemoteTokenServices 入口

@Override
    public OAuth2Authentication loadAuthentication(String accessToken) throws AuthenticationException, InvalidTokenException {
    
        MultiValueMap<String, String> formData = new LinkedMultiValueMap<String, String>();
        formData.add(tokenName, accessToken);
        HttpHeaders headers = new HttpHeaders();
        headers.set("Authorization", getAuthorizationHeader(clientId, clientSecret));
        // 调用认证服务器的check-token 接口检查token
        Map<String, Object> map = postForMap(checkTokenEndpointUrl, formData, headers);
    
        return tokenConverter.extractAuthentication(map);
    }

*  解析认证服务器返回的信息  
    DefaultAccessTokenConverter

public OAuth2Authentication extractAuthentication(Map<String, ?> map) {
            Map<String, String> parameters = new HashMap<String, String>();
            Set<String> scope = extractScope(map);
            // 主要是 用户的信息的抽取
            Authentication user = userTokenConverter.extractAuthentication(map);
            // 一些oauth2 信息的填充
            OAuth2Request request = new OAuth2Request(parameters, clientId, authorities, true, scope, resourceIds, null, null,
                    null);
            return new OAuth2Authentication(request, user);
        }

*  组装当前用户信息  
    DefaultUserAuthenticationConverter

public Authentication extractAuthentication(Map<String, ?> map) {
        if (map.containsKey(USERNAME)) {
            Object principal = map.get(USERNAME);
            Collection<? extends GrantedAuthority> authorities = getAuthorities(map);
            if (userDetailsService != null) {
                UserDetails user = userDetailsService.loadUserByUsername((String) map.get(USERNAME));
                authorities = user.getAuthorities();
                principal = user;
            }
            return new UsernamePasswordAuthenticationToken(principal, "N/A", authorities);
        }
        return null;
    }

### 问题分析 ###

*  认证服务器check-token 返回的全部信息
 *  资源服务器在根据返回信息组装用户信息的时候，只是用了username
 *  如果设置了 userDetailsService 的实现则去调用 loadUserByUsername 再去查询一次用户信息

### 造成问题现象 ###

1.  如果设置了userDetailsService 即可在spring security 上下文获取用户的全部信息，不设置则只能得到用户名。
2.  增加了一次查询逻辑，对性能产生不必要的影响

### 解决问题 ###

*  扩展UserAuthenticationConverter 的解析过程，把认证服务器返回的信息全部组装到spring security的上下文对象中

/**
     * @author lengleng
     * @date 2019-03-07
     * <p>
     * 根据checktoken 的结果转化用户信息
     */
    public class PigxUserAuthenticationConverter implements UserAuthenticationConverter {
        private static final String N_A = "N/A";
        // map 是check-token 返回的全部信息
        @Override
        public Authentication extractAuthentication(Map<String, ?> map) {
            if (map.containsKey(USERNAME)) {
                Collection<? extends GrantedAuthority> authorities = getAuthorities(map);
    
                String username = (String) map.get(USERNAME);
                Integer id = (Integer) map.get(SecurityConstants.DETAILS_USER_ID);
                Integer deptId = (Integer) map.get(SecurityConstants.DETAILS_DEPT_ID);
                Integer tenantId = (Integer) map.get(SecurityConstants.DETAILS_TENANT_ID);
                PigxUser user = new PigxUser(id, deptId, tenantId, username, N_A, true
                        , true, true, true, authorities);
                return new UsernamePasswordAuthenticationToken(user, N_A, authorities);
            }
            return null;
        }
    }

*  给remoteTokenServices 注入这个实现

public class PigxResourceServerConfigurerAdapter extends ResourceServerConfigurerAdapter {
    
        @Override
        public void configure(ResourceServerSecurityConfigurer resources) {
            DefaultAccessTokenConverter accessTokenConverter = new DefaultAccessTokenConverter();
            UserAuthenticationConverter userTokenConverter = new PigxUserAuthenticationConverter();
            accessTokenConverter.setUserTokenConverter(userTokenConverter);
    
            remoteTokenServices.setRestTemplate(lbRestTemplate);
            remoteTokenServices.setAccessTokenConverter(accessTokenConverter);
            resources.
                    .tokenServices(remoteTokenServices);
        }
    }

*  完成扩展，再来看文章开头的流程图就变成了如下

![20190320075223_8JwM9s_E6_9C_AA_E5_91_BD_E5_90_8D_E6_96_87_E4_BB_B6.jpeg][]

### 关注我 ###

*  个人项目 [基于Spring Cloud、OAuth2.0开发基于Vue前后分离的开发平台][Spring Cloud_OAuth2.0_Vue]
 *  [QQ: 2270033969 一起来聊聊你们是咋用 spring cloud 的吧。][QQ_ 2270033969 _ spring cloud]  
    ![20190320090314_J6KIQM_rmjs.jpeg][]

[20190317234215_SWBWuI_E6_9C_AA_E5_91_BD_E5_90_8D_E6_96_87_E4_BB_B6.jpeg]: /images/20220213/10abc713afd74e0686bb88ffd1c8f3a8.png
[jwt_oauth2 _]: https://my.oschina.net/giegie/blog/3023768
[20190320075223_8JwM9s_E6_9C_AA_E5_91_BD_E5_90_8D_E6_96_87_E4_BB_B6.jpeg]: /images/20220213/b6adee541f3e48caa9e060fca5e0de42.png
[Spring Cloud_OAuth2.0_Vue]: https://gitee.com/log4j/pig
[QQ_ 2270033969 _ spring cloud]: https://pig4cloud.com
[20190320090314_J6KIQM_rmjs.jpeg]: /images/20220213/256cf64ba3af49078ba7d2d989ba0103.png