详解SpringCloud服务认证（JWT）

{ "iss": "JWT Builder", 
 "iat": 1416797419, 
 "exp": 1448333419, 
 "aud": "www.battcn.com", 
 "sub": "1837307557@qq.com", 
 "GivenName": "Levin", 
 "Surname": "Levin", 
 "Email": "1837307557@qq.com", 
 "Role": [ "ADMIN", "MEMBER" ] 
}

@Configuration
@ConfigurationProperties(prefix = "battcn.security.token")
public class TokenProperties {
 /**
 * {@link com.battcn.security.model.token.Token} token的过期时间
 */
 private Integer expirationTime;

 /**
 * 发行人
 */
 private String issuer;

 /**
 * 使用的签名KEY {@link com.battcn.security.model.token.Token}.
 */
 private String signingKey;

 /**
 * {@link com.battcn.security.model.token.Token} 刷新过期时间
 */
 private Integer refreshExpTime;

 // get set ...
}

@Component
public class TokenFactory {

 private final TokenProperties properties;

 @Autowired
 public TokenFactory(TokenProperties properties) {
 this.properties = properties;
 }

 /**
 * 利用JJWT 生成 Token
 * @param context
 * @return
 */
 public AccessToken createAccessToken(UserContext context) {
 Optional.ofNullable(context.getUsername()).orElseThrow(()-> new IllegalArgumentException("Cannot create Token without username"));
 Optional.ofNullable(context.getAuthorities()).orElseThrow(()-> new IllegalArgumentException("User doesn't have any privileges"));
 Claims claims = Jwts.claims().setSubject(context.getUsername());
 claims.put("scopes", context.getAuthorities().stream().map(Object::toString).collect(toList()));
 LocalDateTime currentTime = LocalDateTime.now();
 String token = Jwts.builder()
  .setClaims(claims)
  .setIssuer(properties.getIssuer())
  .setIssuedAt(Date.from(currentTime.atZone(ZoneId.systemDefault()).toInstant()))
  .setExpiration(Date.from(currentTime
  .plusMinutes(properties.getExpirationTime())
  .atZone(ZoneId.systemDefault()).toInstant()))
  .signWith(SignatureAlgorithm.HS512, properties.getSigningKey())
 .compact();
 return new AccessToken(token, claims);
 }

 /**
 * 生成 刷新 RefreshToken
 * @param userContext
 * @return
 */
 public Token createRefreshToken(UserContext userContext) {
 if (StringUtils.isBlank(userContext.getUsername())) {
  throw new IllegalArgumentException("Cannot create Token without username");
 }
 LocalDateTime currentTime = LocalDateTime.now();
 Claims claims = Jwts.claims().setSubject(userContext.getUsername());
 claims.put("scopes", Arrays.asList(Scopes.REFRESH_TOKEN.authority()));
 String token = Jwts.builder()
  .setClaims(claims)
  .setIssuer(properties.getIssuer())
  .setId(UUID.randomUUID().toString())
  .setIssuedAt(Date.from(currentTime.atZone(ZoneId.systemDefault()).toInstant()))
  .setExpiration(Date.from(currentTime
  .plusMinutes(properties.getRefreshExpTime())
  .atZone(ZoneId.systemDefault()).toInstant()))
  .signWith(SignatureAlgorithm.HS512, properties.getSigningKey())
 .compact();

 return new AccessToken(token, claims);
 }
}

battcn:
 security:
 token:
 expiration-time: 10 # 分钟 1440
 refresh-exp-time: 30 # 分钟 2880
 issuer: http://blog.battcn.com
 signing-key: battcn

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

 public static final String TOKEN_HEADER_PARAM = "X-Authorization";
 public static final String FORM_BASED_LOGIN_ENTRY_POINT = "/api/auth/login";
 public static final String TOKEN_BASED_AUTH_ENTRY_POINT = "/api/**";
 public static final String MANAGE_TOKEN_BASED_AUTH_ENTRY_POINT = "/manage/**";
 public static final String TOKEN_REFRESH_ENTRY_POINT = "/api/auth/token";

 @Autowired private RestAuthenticationEntryPoint authenticationEntryPoint;
 @Autowired private AuthenticationSuccessHandler successHandler;
 @Autowired private AuthenticationFailureHandler failureHandler;
 @Autowired private LoginAuthenticationProvider loginAuthenticationProvider;
 @Autowired private TokenAuthenticationProvider tokenAuthenticationProvider;

 @Autowired private TokenExtractor tokenExtractor;

 @Autowired private AuthenticationManager authenticationManager;

 protected LoginProcessingFilter buildLoginProcessingFilter() throws Exception {
 LoginProcessingFilter filter = new LoginProcessingFilter(FORM_BASED_LOGIN_ENTRY_POINT, successHandler, failureHandler);
 filter.setAuthenticationManager(this.authenticationManager);
 return filter;
 }

 protected TokenAuthenticationProcessingFilter buildTokenAuthenticationProcessingFilter() throws Exception {
 List<String> list = Lists.newArrayList(TOKEN_BASED_AUTH_ENTRY_POINT,MANAGE_TOKEN_BASED_AUTH_ENTRY_POINT);
 SkipPathRequestMatcher matcher = new SkipPathRequestMatcher(list);
 TokenAuthenticationProcessingFilter filter = new TokenAuthenticationProcessingFilter(failureHandler, tokenExtractor, matcher);
 filter.setAuthenticationManager(this.authenticationManager);
 return filter;
 }

 @Bean
 @Override
 public AuthenticationManager authenticationManagerBean() throws Exception {
 return super.authenticationManagerBean();
 }

 @Override
 protected void configure(AuthenticationManagerBuilder auth) {
 auth.authenticationProvider(loginAuthenticationProvider);
 auth.authenticationProvider(tokenAuthenticationProvider);
 }

 @Override
 protected void configure(HttpSecurity http) throws Exception {
 http
 .csrf().disable() // 因为使用的是JWT，因此这里可以关闭csrf了
 .exceptionHandling()
 .authenticationEntryPoint(this.authenticationEntryPoint)
 .and()
  .sessionManagement()
  .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
 .and()
  .authorizeRequests()
  .antMatchers(FORM_BASED_LOGIN_ENTRY_POINT).permitAll() // Login end-point
  .antMatchers(TOKEN_REFRESH_ENTRY_POINT).permitAll() // Token refresh end-point
 .and()
  .authorizeRequests()
  .antMatchers(TOKEN_BASED_AUTH_ENTRY_POINT).authenticated() // Protected API End-points
  .antMatchers(MANAGE_TOKEN_BASED_AUTH_ENTRY_POINT).hasAnyRole(RoleEnum.ADMIN.name())
 .and()
  .addFilterBefore(buildLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
  .addFilterBefore(buildTokenAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class);
 }
}