spring cloud oauth2 jwt 使用说明

Dear 丶 2023-07-03 12:20 65阅读 0赞

spring cloud oauth2 jwt 使用说明

*************************

jwt签名、验签相关类及接口

JwtAccessTokenConverter：token转换类

  1. public class JwtAccessTokenConverter implements TokenEnhancer, AccessTokenConverter, InitializingBean {
  2.     public static final String TOKEN_ID = "jti";
  3.     public static final String ACCESS_TOKEN_ID = "ati";
  4.     private static final Log logger = LogFactory.getLog(JwtAccessTokenConverter.class);
  5.     private AccessTokenConverter tokenConverter = new DefaultAccessTokenConverter();
  6.     private JwtClaimsSetVerifier jwtClaimsSetVerifier = new JwtAccessTokenConverter.NoOpJwtClaimsSetVerifier();
  7.     private JsonParser objectMapper = JsonParserFactory.create();
  8.     private String verifierKey = (new RandomValueStringGenerator()).generate(); //验签key，默认为随机值
  9.     private Signer signer;              //签名操作
  10.     private String signingKey;          //签名key
  11.     private SignatureVerifier verifier; //验签操作
  13. *************
  14. 构造方法
  16.     public JwtAccessTokenConverter() {
  17.         this.signer = new MacSigner(this.verifierKey);   //默认使用时MacSigner签名，使用算法HMACSHA256
  18.         this.signingKey = this.verifierKey;              //签名key默认与verifierKey相同
  19.     }
  21. *************
  22. 普通方法
  24.     public void setSigningKey(String key) {      //设置签名key
  25.         Assert.hasText(key);
  26.         key = key.trim();
  27.         this.signingKey = key;
  28.         if (this.isPublic(key)) {  //key以"----BEGIN"开头，则使用RsaSigner签名
  29.             this.signer = new RsaSigner(key);
  30.             logger.info("Configured with RSA signing key");
  31.         } else {
  32.             this.verifierKey = key;
  33.             this.signer = new MacSigner(key);
  34.         } //不以"----BEGIN"开头，则使用MacSigner签名
  36.     }
  38.     private boolean isPublic(String key) {
  39.         return key.startsWith("-----BEGIN");
  40.     }
  42.     public void setVerifierKey(String key) {               //设置验签key
  43.     public void setVerifier(SignatureVerifier verifier) {  //设置签名验证方法
  44.     public void setSigner(Signer signer) {                 //设置签名方法
  46.     public Map<String, String> getKey() {
  47.     public void setKeyPair(KeyPair keyPair) {
  49.     public void setAccessTokenConverter(AccessTokenConverter tokenConverter) {
  50.     public AccessTokenConverter getAccessTokenConverter() {
  52.     public OAuth2AccessToken extractAccessToken(String value, Map<String, ?> map) {
  53.     public OAuth2Authentication extractAuthentication(Map<String, ?> map) {
  54.     public Map<String, ?> convertAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
  56.     public void setJwtClaimsSetVerifier(JwtClaimsSetVerifier jwtClaimsSetVerifier) {
  57.     public JwtClaimsSetVerifier getJwtClaimsSetVerifier() {
  59.     public OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {
  61.     public boolean isPublic() {
  62.     public boolean isRefreshToken(OAuth2AccessToken token) {
  64.     public void afterPropertiesSet() throws Exception {
  65.         if (this.verifier == null) {
  66.             Object verifier = new MacSigner(this.verifierKey);
  67.                               //验签优先使用MacSigner
  68.             try {
  69.                 verifier = new RsaVerifier(this.verifierKey);  //Rsaverifier创建成功，则使用RsaVerifier验签
  70.             } catch (Exception var5) {
  71.                 logger.warn("Unable to create an RSA verifier from verifierKey (ignoreable if using MAC)");
  72.             }
  74.             if (this.signer instanceof RsaSigner) {
  75.                 byte[] test = "test".getBytes();
  77.                 try {
  78.                     ((SignatureVerifier)verifier).verify(test, this.signer.sign(test));
  79.                     logger.info("Signing and verification RSA keys match");
  80.                 } catch (InvalidSignatureException var4) {
  81.                     logger.error("Signing and verification RSA keys do not match");
  82.                 }
  83.             } else if (verifier instanceof MacSigner) {
  84.                 Assert.state(this.signingKey == this.verifierKey, "For MAC signing you do not need to specify the verifier key separately, and if you do it must match the signing key");
  85.             } //signingKey、verifierKey要相同，不同抛出异常
  87.             this.verifier = (SignatureVerifier)verifier;
  88.         }
  89.     }

MacSigner：签名、验签类，默认使用的算法为HMACSHA256

  1. public class MacSigner implements SignerVerifier {
  2.     private static final String DEFAULT_ALGORITHM = "HMACSHA256";
  3.     private final String algorithm;
  4.     private final SecretKey key;
  6. **************
  7. 构造方法
  9.     public MacSigner(byte[] key) {
  10.     public MacSigner(String key) {
  11.     public MacSigner(SecretKey key) {
  12.     public MacSigner(String algorithm, SecretKey key) {
  14. **************
  15. 普通方法
  17.     public byte[] sign(byte[] bytes) {                
  18.         try {
  19.             Mac mac = Mac.getInstance(this.algorithm);
  20.             mac.init(this.key);
  21.             return mac.doFinal(bytes);
  22.         } catch (GeneralSecurityException var3) {
  23.             throw new RuntimeException(var3);
  24.         }  //对bytes进行签名
  25.     } 
  27.     public void verify(byte[] content, byte[] signature) { 
  28.         byte[] signed = this.sign(content);
  29.         if (!this.isEqual(signed, signature)) {
  30.             throw new InvalidSignatureException("Calculated signature did not match actual value");
  31.         } //检验content、签名内容signature是否想等，不相等则抛出异常
  32.     }
  35.     public String algorithm() {
  36.         return this.algorithm;
  37.     }

RsaVerifier：rsa验签类，默认使用的算法为SHA256withRSA

  1. public class RsaVerifier implements SignatureVerifier {
  2.     private final RSAPublicKey key;
  3.     private final String algorithm;
  5.     public RsaVerifier(BigInteger n, BigInteger e) {
  6.         this(RsaKeyHelper.createPublicKey(n, e));
  7.     }
  9.     public RsaVerifier(RSAPublicKey key) {
  10.         this(key, "SHA256withRSA");
  11.     }
  13.     public RsaVerifier(RSAPublicKey key, String algorithm) {
  14.         this.key = key;
  15.         this.algorithm = algorithm;
  16.     }
  18.     public RsaVerifier(String key) {
  19.         this(RsaKeyHelper.parsePublicKey(key.trim()), "SHA256withRSA");
  20.     }
  22.     public void verify(byte[] content, byte[] sig) {
  23.         try {
  24.             Signature signature = Signature.getInstance(this.algorithm);
  25.             signature.initVerify(this.key);
  26.             signature.update(content);
  27.             if (!signature.verify(sig)) {
  28.                 throw new InvalidSignatureException("RSA Signature did not match content");
  29.             }
  30.         } catch (GeneralSecurityException var4) {
  31.             throw new RuntimeException(var4);
  32.         }
  33.     }
  35.     public String algorithm() {
  36.         return this.algorithm;
  37.     }
  38. }

SignerVerifier：签名、验签接口

  1. public interface SignerVerifier extends Signer, SignatureVerifier {
  2. }

Signer：签名接口

  1. public interface Signer extends AlgorithmMetadata {
  2.     byte[] sign(byte[] var1);
  3. }

SignatureVerifier：验签接口

  1. public interface SignatureVerifier extends AlgorithmMetadata {
  2.     void verify(byte[] var1, byte[] var2);
  3. }

AlgorithmMetadata：签名、验签算法

  1. public interface AlgorithmMetadata {
  2.     String algorithm();
  3. }

*************************

jwt 存储相关类及接口

JwtTokenStore：jwt存储

  1. public class JwtTokenStore implements TokenStore {
  2.     private JwtAccessTokenConverter jwtTokenEnhancer;  //token转换类
  3.     private ApprovalStore approvalStore;               //token使用状态
  5. ***************
  6. 构造方法
  8.     public JwtTokenStore(JwtAccessTokenConverter jwtTokenEnhancer) {
  10. ***************
  11. 普通方法
  13.     public void setApprovalStore(ApprovalStore approvalStore) {
  15.     public OAuth2AccessToken readAccessToken(String tokenValue) {
  16.     public void removeAccessToken(OAuth2AccessToken token) {
  17.     public void removeAccessTokenUsingRefreshToken(OAuth2RefreshToken refreshToken) {
  19.     public OAuth2RefreshToken readRefreshToken(String tokenValue) {
  20.     public void removeRefreshToken(OAuth2RefreshToken token) {
  22.     public OAuth2AccessToken getAccessToken(OAuth2Authentication authentication) {
  23.     public Collection<OAuth2AccessToken> findTokensByClientIdAndUserName(String clientId, String userName) {
  24.     public Collection<OAuth2AccessToken> findTokensByClientId(String clientId) {
  26.     public OAuth2Authentication readAuthentication(OAuth2AccessToken token) {
  27.     public OAuth2Authentication readAuthentication(String token) {
  28.     public OAuth2Authentication readAuthenticationForRefreshToken(OAuth2RefreshToken token) {
  30.     public void storeAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
  31.     public void storeRefreshToken(OAuth2RefreshToken refreshToken, OAuth2Authentication authentication) {
  33.     public void setTokenEnhancer(JwtAccessTokenConverter tokenEnhancer) {

ApprovalStore：设置客户端使用、禁用接口

  1. public interface ApprovalStore {
  2.     boolean addApprovals(Collection<Approval> var1);
  4.     boolean revokeApprovals(Collection<Approval> var1);
  6.     Collection<Approval> getApprovals(String var1, String var2);
  7. }

Approval：token使用状态

  1. public class Approval {
  2.     private String userId;
  3.     private String clientId;
  4.     private String scope;
  5.     private Approval.ApprovalStatus status;
  6.     private Date expiresAt;
  7.     private Date lastUpdatedAt;
  9. ************
  10. 构造方法
  12.     public Approval(String userId, String clientId, String scope, int expiresIn, Approval.ApprovalStatus status) {
  13.     public Approval(String userId, String clientId, String scope, Date expiresAt, Approval.ApprovalStatus status) {
  14.     public Approval(String userId, String clientId, String scope, Date expiresAt, Approval.ApprovalStatus status, Date lastUpdatedAt) {
  16. ************
  17. 普通方法
  19.     public void setUserId(String userId) {
  20.     public void setClientId(String clientId) {
  21.     public void setScope(String scope) {
  22.     public void setStatus(Approval.ApprovalStatus status) {
  23.     public void setExpiresAt(Date expiresAt) {
  24.     public void setLastUpdatedAt(Date lastUpdatedAt) {
  26.     public String getUserId() {
  27.     public String getClientId() {
  28.     public String getScope() {
  29.     public Approval.ApprovalStatus getStatus() {
  30.     public Date getExpiresAt() {
  31.     public Date getLastUpdatedAt() {
  33.     public boolean isCurrentlyActive() {
  34.         return this.expiresAt != null && this.expiresAt.after(new Date());
  35.     } //过期时间不为null，且在当前时间之后则token存活
  37.     public boolean isApproved() {
  38.         return this.isCurrentlyActive() && this.status == Approval.ApprovalStatus.APPROVED;
  39.     } //token处于存活状态，且approval为Approved，则返回true
  41.     public static enum ApprovalStatus {
  42.         APPROVED,  //使用
  43.         DENIED;    //拒绝使用
  45.         private ApprovalStatus() {
  46.         }
  47.     }

发表评论

表情：
评论列表 （有 0 条评论，65人围观）

还没有评论，来说两句吧...

相关阅读