# 用戶中心 user-center在項目中的位置  用戶中心作為認證授權分離架構的oauth資源服務器，需要引入 <!-- 資源服務器 --> <dependency> <groupId>com.open.capacity</groupId> <artifactId>security-core</artifactId> <version>${core.version}</version> </dependency> ## 攜帶access_token訪問api > > access_token 放在請求頭 OAuth2AuthentiactionProcessingFilter，從request中提取access_token，構建PreAuthenticatedAuthenticationToken并驗證。  tokenExtractor.extract(request)實際調用的是BearTokenExtractor里的extract方法，從Authorization header? ?“Bearer? xxxx”中抽取token，或者從request parameters抽取名為“access_token”的參數值。  ?構建后的authentication參數如下，tokenType="Bearer"，principal=token值。再根據**OAuth2AuthenticationManager**驗證該authentication的合法性。  ## 通過arthas理解驗證token流程  ## user-center 登錄核心圖  ``` public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (authentication == null) { throw new InvalidTokenException("Invalid token (token not found)"); } String token = (String) authentication.getPrincipal(); OAuth2Authentication auth = tokenServices.loadAuthentication(token); if (auth == null) { throw new InvalidTokenException("Invalid token: " + token); } Collection<String> resourceIds = auth.getOAuth2Request().getResourceIds(); if (resourceId != null && resourceIds != null && !resourceIds.isEmpty() && !resourceIds.contains(resourceId)) { throw new OAuth2AccessDeniedException("Invalid token does not contain resource id (" + resourceId + ")"); } checkClientDetails(auth); if (authentication.getDetails() instanceof OAuth2AuthenticationDetails) { OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) authentication.getDetails(); // Guard against a cached copy of the same details if (!details.equals(auth.getDetails())) { // Preserve the authentication details from the one loaded by token services details.setDecodedDetails(auth.getDetails()); } } auth.setDetails(authentication.getDetails()); auth.setAuthenticated(true); return auth; } ``` ## 登錄邏輯處理SysUserController，為auth-server認證中心服務 ``` @GetMapping(value = "/users-anon/login", params = "username") @ApiOperation(value = "根據用戶名查詢用戶") public LoginAppUser findByUsername(String username) { String num = PointUtil.getRandom();//生成日志隨機數 log.info("SysUserController|findByUsername|num:{}|input:{}",num , username ); return appUserService.findByUsername(username); } ``` ## RBAC模式 ### 表設計 | 表 | 備注 | | --- | --- | | sys_user| 用戶表 | | sys_role | 角色表 | | sys_permission | 權限表 | | sys_menu | 菜單表 | | sys_role_menu | 角色菜單表 | | sys_role_permission | 角色權限表 | ### 實體類  ### 用戶實體類關聯UML圖  ``` /** * @author 作者 owen E-mail: 624191343@qq.com * @version 創建時間：2017年11月12日 上午22:57:51 * 用戶實體綁定spring security */ @Getter @Setter public class LoginAppUser extends SysUser implements UserDetails { /** * */ private static final long serialVersionUID = -3685249101751401211L; private Set<SysRole> sysRoles; private Set<String> permissions; /*** * 權限重寫 */ @JsonIgnore @Override public Collection<? extends GrantedAuthority> getAuthorities() { Collection<GrantedAuthority> collection = new HashSet<>(); if (!CollectionUtils.isEmpty(sysRoles)) { sysRoles.parallelStream().forEach(role -> { if (role.getCode().startsWith("ROLE_")) { collection.add(new SimpleGrantedAuthority(role.getCode())); } else { collection.add(new SimpleGrantedAuthority("ROLE_" + role.getCode())); } }); } if (!CollectionUtils.isEmpty(permissions)) { permissions.parallelStream().forEach(per -> { collection.add(new SimpleGrantedAuthority(per)); }); } return collection; } @Override public boolean isAccountNonExpired() { return true; } @Override public boolean isAccountNonLocked() { return true; } @Override public boolean isCredentialsNonExpired() { return true; } @Override public boolean isEnabled() { return getEnabled(); } } ``` ### 驗證流程  ### 授權流程  >@PreAuthorize("hasAuthority('user:get/users/{id}')") 處理流程     #### 啟用授權 ``` @EnableGlobalMethodSecurity(prePostEnabled = true) /** * @author 作者 owen E-mail: 624191343@qq.com * @version 創建時間：2017年11月12日 上午22:57:51 */ @Component @Configuration @EnableResourceServer // 開啟spring security 注解 // @EnableGlobalMethodSecurity(prePostEnabled = true) @EnableConfigurationProperties(PermitUrlProperties.class) public class OAuth2ClientConfig extends ResourceServerConfigurerAdapter { } ``` ### 配置接口權限   ## swagger  ## 項目pom依賴關系