feat: 实现jwt认证接口
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/api/InfrasApiUserController.java b/gateway/src/main/java/com/supwisdom/infras/security/api/InfrasApiUserController.java
new file mode 100644
index 0000000..26eea40
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/api/InfrasApiUserController.java
@@ -0,0 +1,55 @@
+package com.supwisdom.infras.security.api;
+
+import java.security.Principal;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.MediaType;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.supwisdom.infras.security.authentication.JwtAuthenticationToken;
+import com.supwisdom.infras.security.core.userdetails.InfrasUser;
+
+@RestController
+@RequestMapping("/api/user")
+public class InfrasApiUserController {
+
+ private static final Logger logger = LoggerFactory.getLogger(InfrasApiUserController.class);
+
+ @RequestMapping(method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
+ @ResponseBody
+ public InfrasUser current(Principal principal) {
+
+ logger.debug("ApiUserController.current(Principal) is {}", principal);
+
+ if (principal == null) {
+ throw new RuntimeException("exception.principal.is.null");
+ }
+
+ if (principal instanceof UsernamePasswordAuthenticationToken) {
+
+ UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) principal;
+
+ if (token.isAuthenticated()) {
+ if (token.getPrincipal() instanceof User) {
+ return (InfrasUser) token.getPrincipal();
+ }
+ }
+ } else if (principal instanceof JwtAuthenticationToken) {
+ JwtAuthenticationToken token = (JwtAuthenticationToken) principal;
+
+ InfrasUser user = new InfrasUser((String) token.getPrincipal(), (String) token.getToken(), token.getAuthorities(), token.getAttributes());
+ user.eraseCredentials();
+
+ return user;
+ }
+
+ throw new RuntimeException("exception.principal.not.correct");
+ }
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/authentication/JwtAuthenticationToken.java b/gateway/src/main/java/com/supwisdom/infras/security/authentication/JwtAuthenticationToken.java
new file mode 100644
index 0000000..73a1944
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/authentication/JwtAuthenticationToken.java
@@ -0,0 +1,74 @@
+package com.supwisdom.infras.security.authentication;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Map;
+
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+
+public class JwtAuthenticationToken extends AbstractAuthenticationToken {
+
+ /**
+ *
+ */
+ private static final long serialVersionUID = 4407107653933017523L;
+
+ private Object principal;
+ private String credentials;
+ private String token;
+
+ private final Map<String, Object> attributes;
+
+ public Map<String, Object> getAttributes() {
+ return this.attributes;
+ }
+
+ public JwtAuthenticationToken(String token) {
+ super(Collections.emptyList());
+ this.token = token;
+
+ this.attributes = Collections.emptyMap();
+
+ setAuthenticated(false);
+ }
+
+ public JwtAuthenticationToken(Object principal, String token,
+ Collection<? extends GrantedAuthority> authorities) {
+ this(principal, token, authorities, Collections.emptyMap());
+ }
+
+ public JwtAuthenticationToken(Object principal, String token,
+ Collection<? extends GrantedAuthority> authorities,
+ Map<? extends String, ? extends Object> attributes) {
+ super(authorities);
+ this.principal = principal;
+ this.token = token;
+
+ this.attributes = Collections.unmodifiableMap(attributes);
+
+ setAuthenticated(true);
+ }
+
+ @Override
+ public void setDetails(Object details) {
+ super.setDetails(details);
+
+ this.setAuthenticated(true);
+ }
+
+ @Override
+ public Object getCredentials() {
+ return credentials;
+ }
+
+ @Override
+ public Object getPrincipal() {
+ return principal;
+ }
+
+ public String getToken() {
+ return token;
+ }
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/core/userdetails/InfrasUser.java b/gateway/src/main/java/com/supwisdom/infras/security/core/userdetails/InfrasUser.java
new file mode 100644
index 0000000..8764974
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/core/userdetails/InfrasUser.java
@@ -0,0 +1,49 @@
+package com.supwisdom.infras.security.core.userdetails;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+
+public class InfrasUser extends User {
+
+ /**
+ *
+ */
+ private static final long serialVersionUID = 6535845256804630918L;
+
+ public InfrasUser(String username, String password,
+ Collection<? extends GrantedAuthority> authorities,
+ Map<? extends String, ? extends Object> attributes) {
+ this(username, password, true, true, true, true, authorities, attributes);
+
+ }
+
+ public InfrasUser(String username, String password,
+ boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked,
+ Collection<? extends GrantedAuthority> authorities,
+ Map<? extends String, ? extends Object> attributes) {
+ super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
+
+ this.attributes = Collections.unmodifiableMap(attributes);
+ }
+
+ private final Map<String, Object> attributes;
+ public Map<String, Object> getAttributes() {
+ return this.attributes;
+ }
+
+ public List<String> getRoles() {
+ List<String> roles = new ArrayList<>();
+ for (GrantedAuthority grantedAuthority : this.getAuthorities()) {
+ roles.add(grantedAuthority.getAuthority());
+ }
+
+ return roles;
+ }
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/reactive/basic/BasicWebFluxSecurityConfiguration.java b/gateway/src/main/java/com/supwisdom/infras/security/reactive/basic/BasicWebFluxSecurityConfiguration.java
index aa792e1..76cc927 100644
--- a/gateway/src/main/java/com/supwisdom/infras/security/reactive/basic/BasicWebFluxSecurityConfiguration.java
+++ b/gateway/src/main/java/com/supwisdom/infras/security/reactive/basic/BasicWebFluxSecurityConfiguration.java
@@ -10,7 +10,7 @@
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
@Configuration
-@ConditionalOnProperty(name="infras.security.basic.enabled", havingValue="true")
+@ConditionalOnProperty(name="infras.security.basic.reactive.enabled", havingValue="true")
public class BasicWebFluxSecurityConfiguration {
@Bean
@@ -28,10 +28,9 @@
//http.addFilterAt(webFilter, SecurityWebFiltersOrder.LAST);
http.httpBasic();
-
- http.csrf().disable();
-
http.formLogin().disable();
+
+ http.csrf().disable();
return http.build();
}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/EnableInfrasJWTWebFluxApi.java b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/EnableInfrasJWTWebFluxApi.java
new file mode 100644
index 0000000..51062b2
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/EnableInfrasJWTWebFluxApi.java
@@ -0,0 +1,17 @@
+package com.supwisdom.infras.security.reactive.jwt;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import org.springframework.context.annotation.Import;
+
+@Target(ElementType.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+@Import(JWTWebFluxConfiguration.class)
+public @interface EnableInfrasJWTWebFluxApi {
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTKeyController.java b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTKeyController.java
new file mode 100644
index 0000000..3c4b036
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTKeyController.java
@@ -0,0 +1,25 @@
+package com.supwisdom.infras.security.reactive.jwt;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.supwisdom.infras.security.utils.JWTTokenUtil;
+
+@RestController
+public class JWTKeyController {
+
+ @Autowired
+ private JWTTokenUtil jwtTokenUtil;
+
+ /**
+ * curl -i -s -X GET 'http://localhost:8080/jwt/publicKey'
+ * @return
+ */
+ @GetMapping(value = "/jwt/publicKey")
+ public String publicKey() {
+
+ return jwtTokenUtil.getPublicKeyPem();
+ }
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTSecurityContextRepository.java b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTSecurityContextRepository.java
new file mode 100644
index 0000000..bf2f6a7
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTSecurityContextRepository.java
@@ -0,0 +1,118 @@
+package com.supwisdom.infras.security.reactive.jwt;
+
+import io.jsonwebtoken.Claims;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextImpl;
+import org.springframework.security.web.server.context.ServerSecurityContextRepository;
+import org.springframework.web.server.ServerWebExchange;
+
+import com.supwisdom.infras.security.authentication.JwtAuthenticationToken;
+import com.supwisdom.infras.security.utils.JWTTokenUtil;
+
+import reactor.core.publisher.Mono;
+
+public class JWTSecurityContextRepository implements ServerSecurityContextRepository {
+
+ private static final Logger logger = LoggerFactory.getLogger(JWTSecurityContextRepository.class);
+
+ @Value("${infras.security.jwt.token.authorization.prefix:Bearer}")
+ private String authorizationPrefix;
+
+ private JWTTokenUtil jwtTokenUtil;
+
+ @Autowired
+ public JWTSecurityContextRepository(JWTTokenUtil jwtTokenUtil) {
+ this.jwtTokenUtil = jwtTokenUtil;
+ }
+
+ @Override
+ public Mono<Void> save(ServerWebExchange exchange, SecurityContext context) {
+ return Mono.empty();
+ }
+
+ @Override
+ public Mono<SecurityContext> load(ServerWebExchange exchange) {
+
+ ServerHttpRequest request = exchange.getRequest();
+
+ String authToken = null;
+
+ String authParamter = request.getQueryParams().getFirst("token"); logger.debug("authParamter is [{}]", authParamter);
+ if (authParamter != null && !authParamter.isEmpty()) {
+ authToken = authParamter;
+ }
+
+ if (authToken == null) {
+ String authHeader = request.getHeaders().getFirst(HttpHeaders.AUTHORIZATION); logger.debug("authHeader is [{}]", authHeader);
+ if (authHeader != null && authHeader.toLowerCase().startsWith(authorizationPrefix.toLowerCase())) {
+ authToken = authHeader.substring(authorizationPrefix.length() + 1);
+ }
+ }
+
+ logger.debug("authToken is [{}]", authToken);
+
+ if (authToken != null && !authToken.isEmpty()) {
+
+ String username = getUsernameFromToken(authToken);
+
+ if (username != null) {
+ List<GrantedAuthority> authorities = getAuthoritiesFromToken(authToken);
+
+ Authentication authentication = new JwtAuthenticationToken(username, authToken, authorities);
+
+ return Mono.justOrEmpty(new SecurityContextImpl(authentication));
+ }
+
+ }
+
+ return Mono.empty();
+ }
+
+
+ /**
+ * 从令牌中获取用户名
+ *
+ * @param token 令牌
+ * @return 用户名
+ */
+ private String getUsernameFromToken(String token) {
+ String username;
+ try {
+ Claims claims = jwtTokenUtil.getClaimsFromToken(token);
+ username = claims.getSubject();
+ } catch (Exception e) {
+ username = null;
+ }
+ return username;
+ }
+
+ private List<GrantedAuthority> getAuthoritiesFromToken(String token) {
+ List<GrantedAuthority> collAuthorities = new ArrayList<GrantedAuthority>();
+ try {
+ Claims claims = jwtTokenUtil.getClaimsFromToken(token);
+ String roles = claims.get("roles", String.class);
+
+ for (String role : roles.split(",")) {
+ collAuthorities.add(new SimpleGrantedAuthority(role));
+ }
+ } catch (Exception e) {
+ collAuthorities = new ArrayList<GrantedAuthority>();
+ }
+ return collAuthorities;
+ }
+
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTTokenController.java b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTTokenController.java
new file mode 100644
index 0000000..9a357f6
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTTokenController.java
@@ -0,0 +1,232 @@
+package com.supwisdom.infras.security.reactive.jwt;
+
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.security.authentication.ReactiveAuthenticationManager;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
+import org.springframework.util.MimeTypeUtils;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RestController;
+
+import reactor.core.publisher.Mono;
+
+import com.supwisdom.infras.security.configure.jwt.util.SignUtil;
+import com.supwisdom.infras.security.core.userdetails.InfrasUser;
+import com.supwisdom.infras.security.utils.JWTTokenUtil;
+
+@RestController
+public class JWTTokenController {
+
+ private static final Logger logger = LoggerFactory.getLogger(JWTTokenController.class);
+
+ @Value("${infras.security.jwt.token.sign.enabled:false}")
+ private boolean signEnabled;
+ @Value("${infras.security.jwt.token.sign.key:}")
+ private String signKey;
+
+ @Value("${infras.security.jwt.token.authorization.prefix:Bearer}")
+ private String authorizationPrefix;
+
+ @Autowired
+ private ReactiveAuthenticationManager reactiveAuthenticationManager;
+ @Autowired
+ private ReactiveUserDetailsService reactiveUserDetailsService;
+ @Autowired
+ private JWTTokenUtil jwtTokenUtil;
+
+ /**
+ * 用户登录
+ *
+ * curl -i -s -X POST 'http://localhost:8080/jwt/token/login' -d 'username=user&password=user' -H 'Content-Type: application/json'
+ *
+ * @param username 用户名
+ * @param password 密码
+ * @return 操作结果
+ * @throws AuthenticationException 错误信息
+ */
+ @PostMapping(path = "/jwt/token/login", consumes = MimeTypeUtils.APPLICATION_JSON_VALUE)
+ public Mono<String> login(
+ @RequestBody LoginRequest loginRequest
+ ) throws AuthenticationException {
+
+ return Mono.just(loginRequest).flatMap(req -> {
+ try {
+ String username = req.getUsername();
+ String password = req.getPassword();
+
+ // TODO：判断用户的登录频次
+
+ UsernamePasswordAuthenticationToken upToken = new UsernamePasswordAuthenticationToken(username, password);
+
+ return reactiveAuthenticationManager.authenticate(upToken);
+ } catch (AuthenticationException e) {
+ // TODO: 记录失败
+ throw e;
+ }
+ }).filter(a -> a.isAuthenticated() && a.getPrincipal() instanceof InfrasUser)
+ .map(Authentication::getPrincipal)
+ .cast(InfrasUser.class)
+ .map(userDetails -> {
+ String jwtToken = generateToken(userDetails);
+ return jwtToken;
+ })
+ ;
+
+ // 判断签名
+// if (signEnabled) {
+// String timestamp = request.queryParam("timestamp").get();
+// String sign = request.queryParam("sign").get();
+//
+// if (timestamp == null || timestamp.isEmpty()) {
+// throw new BadCredentialsException("timestamp error");
+// }
+//
+// if (sign == null || sign.isEmpty()) {
+// throw new BadCredentialsException("sign error");
+// }
+//
+// String data = timestamp + username + password;
+//
+// if (!SignUtil.checkIntervalTime(timestamp, 10000)) {
+// throw new BadCredentialsException("timestamp error");
+// }
+//
+// String currentSign = SignUtil.HMACSHA1(data, signKey);
+// if (!currentSign.equals(sign)) {
+// throw new BadCredentialsException("sign error");
+// }
+// }
+
+// String username = loginRequest.getUsername();
+// String password = loginRequest.getPassword();
+//
+// // TODO：判断用户的登录频次
+//
+// try {
+// UsernamePasswordAuthenticationToken upToken = new UsernamePasswordAuthenticationToken(username, password);
+//
+// Mono<String> token =
+// reactiveAuthenticationManager.authenticate(upToken)
+// .filter(a -> a.isAuthenticated() && a.getPrincipal() instanceof UserDetails)
+// .map(Authentication::getPrincipal)
+// .cast(UserDetails.class)
+// .map(userDetails -> {
+// String jwtToken = generateToken(userDetails);
+// return jwtToken;
+// });
+//
+//// reactiveAuthenticationManager.authenticate(upToken)
+//// .filter(a -> a.isAuthenticated() && a.getPrincipal() instanceof String)
+//// .map(Authentication::getPrincipal)
+//// .cast(String.class)
+//// .map(principal -> {
+//// return reactiveUserDetailsService.findByUsername(principal)
+//// .map(userDetails -> {
+//// String jwtToken = generateToken(userDetails);
+//// return jwtToken;
+//// });
+//// });
+//
+// return token.block();
+//
+//// reactiveAuthenticationManager.authenticate(upToken)
+//// .filter(a -> a.isAuthenticated() && a.getPrincipal() instanceof UserDetails)
+//// .map(Authentication::getPrincipal)
+//// .cast(UserDetails.class)
+//// .map(userDetails -> {
+//// String jwtToken = generateToken(userDetails);
+//// return jwtToken;
+//// })
+//// ;
+//
+// } catch (AuthenticationException e) {
+// // TODO: 记录失败
+// throw e;
+// }
+//
+// //throw new UsernameNotFoundException(String.format("%s not found", username));
+ }
+
+
+ /**
+ * 生成令牌
+ *
+ * @param userDetails 用户
+ * @return 令牌
+ */
+ private String generateToken(InfrasUser userDetails) {
+ String roles = "";
+ for (GrantedAuthority ga : userDetails.getAuthorities()) {
+ String role = ga.getAuthority();
+ roles += (roles.length() > 0 ? "," : "") + role;
+ }
+
+ Map<String, Object> claims = new HashMap<>();
+ claims.put("sub", userDetails.getUsername());
+ claims.put("roles", roles);
+ claims.put("created", new Date());
+ return jwtTokenUtil.generateToken(claims);
+ }
+
+
+ /**
+ * 刷新密钥
+ *
+ * curl -i -s -X GET 'http://localhost:8080/jwt/token/refreshToken' -H 'Authorization: Bearer JWTToken'
+ *
+ * @param authorization 原密钥
+ * @return 新密钥
+ * @throws AuthenticationException 错误信息
+ */
+ @GetMapping(path = "/jwt/token/refreshToken")
+ public String refreshToken(@RequestHeader("Authorization") String authorization) throws AuthenticationException {
+
+ if (authorization == null || !authorization.toLowerCase().startsWith(authorizationPrefix.toLowerCase())) {
+ return "authorization error";
+ }
+
+ String token = authorization.substring(authorizationPrefix.length() + 1);
+ //if (!jwtTokenUtil.isTokenExpired(token)) {
+ return jwtTokenUtil.refreshToken(token);
+ //}
+
+ //return "error";
+ }
+
+ /**
+ * 注销密钥
+ *
+ * curl -i -s -X GET 'http://localhost:8080/jwt/token/logout' -H 'Authorization: Bearer JWTToken'
+ *
+ * @param authorization 原密钥
+ * @return
+ * @throws AuthenticationException
+ */
+ @GetMapping(path = "/jwt/token/logout")
+ public String expireToken(@RequestHeader("Authorization") String authorization) throws AuthenticationException {
+
+ if (authorization == null || !authorization.toLowerCase().startsWith(authorizationPrefix.toLowerCase())) {
+ return "authorization error";
+ }
+
+ String token = authorization.substring(authorizationPrefix.length() + 1);
+
+ jwtTokenUtil.expireToken(token);
+
+ return "success";
+ }
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTWebFluxConfiguration.java b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTWebFluxConfiguration.java
new file mode 100644
index 0000000..014e483
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/JWTWebFluxConfiguration.java
@@ -0,0 +1,141 @@
+package com.supwisdom.infras.security.reactive.jwt;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.authentication.ReactiveAuthenticationManager;
+import org.springframework.security.authentication.UserDetailsRepositoryReactiveAuthenticationManager;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
+
+import com.supwisdom.infras.security.utils.JWTTokenUtil;
+
+@Configuration
+@ConditionalOnProperty(name="infras.security.jwt.reactive.enabled", havingValue="true")
+public class JWTWebFluxConfiguration {
+
+ private static final Logger logger = LoggerFactory.getLogger(JWTWebFluxConfiguration.class);
+
+// @ConditionalOnClass(RedisConnectionFactory.class)
+// @Configuration
+// public static class RedisStoreConfiguration {
+//
+// @Bean
+// public JWTTokenRedisStore jwtTokenRedisStore(RedisConnectionFactory connectionFactory) {
+//
+// JWTTokenRedisStore jwtTokenRedisStore = new JWTTokenRedisStore(connectionFactory);
+//
+// return jwtTokenRedisStore;
+// }
+//
+// }
+
+ @Autowired(required = false)
+ private ReactiveUserDetailsService reactiveUserDetailsService;
+
+ @Autowired(required = false)
+ private PasswordEncoder passwordEncoder;
+
+ @Bean
+ public ReactiveAuthenticationManager reactiveAuthenticationManager() {
+ if(this.reactiveUserDetailsService != null) {
+ UserDetailsRepositoryReactiveAuthenticationManager manager =
+ new UserDetailsRepositoryReactiveAuthenticationManager(this.reactiveUserDetailsService);
+ if(this.passwordEncoder != null) {
+ manager.setPasswordEncoder(this.passwordEncoder);
+ }
+ return manager;
+ }
+ return null;
+ }
+
+ @Bean
+ public JWTTokenUtil jwtTokenUtil() {
+
+ return new JWTTokenUtil();
+ }
+
+ @Bean
+ JWTKeyController jwtKeyController() {
+
+ JWTKeyController jwtKeyController = new JWTKeyController();
+ logger.debug("JWTWebFluxConfiguration jwtKeyController is {}", jwtKeyController);
+
+ return jwtKeyController;
+ }
+
+
+
+ @Bean
+ public JWTTokenController jwtTokenController() {
+
+ JWTTokenController jwtTokenController = new JWTTokenController();
+ logger.debug("JWTWebFluxConfiguration jwtTokenController is {}", jwtTokenController);
+
+ return jwtTokenController;
+ }
+
+ @Bean
+ public JWTSecurityContextRepository jwtSecurityContextRepository(JWTTokenUtil jwtTokenUtil) {
+ JWTSecurityContextRepository jwtSecurityContextRepository = new JWTSecurityContextRepository(jwtTokenUtil);
+
+ return jwtSecurityContextRepository;
+ }
+
+
+ @Bean
+ public SecurityWebFilterChain jwtTokenSpringSecurityFilterChain(ServerHttpSecurity http) {
+
+ logger.debug("jwtTokenSpringSecurityFilterChain(ServerHttpSecurity)");
+
+ http
+ .securityMatcher(ServerWebExchangeMatchers.pathMatchers("/jwt/**"))
+ .authorizeExchange()
+ .pathMatchers(HttpMethod.OPTIONS).permitAll()
+ .pathMatchers("/jwt/publicKey").permitAll()
+ .pathMatchers("/jwt/**").permitAll()
+ .anyExchange().authenticated();
+
+ http.httpBasic().disable();
+ http.formLogin().disable();
+
+ http.csrf().disable();
+
+ return http.build();
+ }
+
+
+
+ @Bean
+ public SecurityWebFilterChain jwtApiSpringSecurityFilterChain(ServerHttpSecurity http) {
+ http
+ .securityMatcher(ServerWebExchangeMatchers.pathMatchers("/api/**"))
+ .authorizeExchange()
+ .pathMatchers(HttpMethod.OPTIONS).permitAll()
+ .pathMatchers("/api/public/**", "/api/open/**").permitAll()
+ .pathMatchers("/api/v*/public/**", "/api/v*/open/**").permitAll()
+ .pathMatchers("/api/*/v*/public/**", "/api/*/v*/open/**").permitAll()
+ .pathMatchers("/api/**").authenticated()
+ .anyExchange().authenticated();
+
+ //http.addFilterAt(webFilter, SecurityWebFiltersOrder.LAST);
+
+ http.securityContextRepository(jwtSecurityContextRepository(jwtTokenUtil()));
+
+ http.httpBasic().disable();
+ http.formLogin().disable();
+
+ http.csrf().disable();
+
+ return http.build();
+ }
+
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/LoginRequest.java b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/LoginRequest.java
new file mode 100644
index 0000000..2e47c2c
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/reactive/jwt/LoginRequest.java
@@ -0,0 +1,13 @@
+package com.supwisdom.infras.security.reactive.jwt;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@AllArgsConstructor
+@NoArgsConstructor
+public class LoginRequest {
+ private String username;
+ private String password;
+}
diff --git a/gateway/src/main/java/com/supwisdom/infras/security/utils/JWTTokenUtil.java b/gateway/src/main/java/com/supwisdom/infras/security/utils/JWTTokenUtil.java
new file mode 100644
index 0000000..abbf378
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/infras/security/utils/JWTTokenUtil.java
@@ -0,0 +1,261 @@
+package com.supwisdom.infras.security.utils;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+
+import java.io.IOException;
+import java.security.KeyPair;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.interfaces.RSAPublicKey;
+import java.security.spec.InvalidKeySpecException;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+//import org.springframework.security.core.GrantedAuthority;
+//import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.stereotype.Component;
+
+import com.supwisdom.infras.security.cert.CertUtil;
+import com.supwisdom.infras.security.token.store.redis.JWTTokenRedisStore;
+
+@Component
+public class JWTTokenUtil implements InitializingBean {
+
+ private static final Logger logger = LoggerFactory.getLogger(JWTTokenUtil.class);
+
+ private static ConcurrentMap<String, Long> mapTokenExpiration = new ConcurrentHashMap<String, Long>();
+
+ @Autowired(required = false)
+ private JWTTokenRedisStore redisTokenStore;
+
+ /**
+ * 密钥
+ */
+ //@Value("${infras.security.jwt.secret:MyJwtSecret}")
+ //private String secret;
+
+
+ @Value("${infras.security.jwt.iss:supwisdom}")
+ private String issuer;
+ @Value("${infras.security.jwt.jti:supwisdom-jwt}")
+ private String jti;
+
+
+ @Value("${infras.security.jwt.expiration:2592000}")
+ private Long expiration;
+
+ @Value("${infras.security.jwt.kickout.enabled:false}")
+ private boolean kickoutEnabled;
+
+
+ @Value("${infras.security.jwt.key-alias:supwisdom-jwt-key}")
+ private String keyAlias;
+ @Value("${infras.security.jwt.key-password:kingstar}")
+ private String keyPassword;
+
+ @Value("${infras.security.jwt.key-store:}")
+ private String keyStore;
+ @Value("${infras.security.jwt.key-store-password:kingstar}")
+ private String keyStorePassword;
+
+
+ @Value("${infras.security.jwt.public-key-pem:}")
+ private String publicKeyPem;
+ @Value("${infras.security.jwt.private-key-pem-pkcs8:}")
+ private String privateKeyPemPKCS8;
+
+ @Override
+ public void afterPropertiesSet() throws Exception {
+ this.initKey();
+ }
+
+ private KeyPair keyPair;
+
+ public void initKey() {
+
+ try {
+ this.keyPair = CertUtil.initKeyFromPem(publicKeyPem, privateKeyPemPKCS8);
+ logger.debug("init keyPair from pem");
+ return;
+ } catch (NoSuchAlgorithmException e) {
+ e.printStackTrace();
+ } catch (InvalidKeySpecException e) {
+ e.printStackTrace();
+ }
+
+ try {
+ this.keyPair = CertUtil.initKeyFromKeyStore(keyStore, keyStorePassword, keyAlias, keyPassword);
+ logger.debug("init keyPair from keyStore");
+ } catch (UnrecoverableKeyException e) {
+ e.printStackTrace();
+ } catch (KeyStoreException e) {
+ e.printStackTrace();
+ } catch (CertificateException e) {
+ e.printStackTrace();
+ } catch (IOException e) {
+ e.printStackTrace();
+ } catch (NoSuchAlgorithmException e) {
+ e.printStackTrace();
+ }
+
+ }
+
+ public RSAPublicKey getPublicKey() {
+ return (RSAPublicKey) this.keyPair.getPublic();
+ }
+
+ public RSAPrivateKey getPrivateKey() {
+ return (RSAPrivateKey) this.keyPair.getPrivate();
+ }
+
+ public String getPublicKeyPem() {
+ return CertUtil.publicKeyToPem(getPublicKey());
+ }
+
+ private void storeTokenExpiration(String token, Long expiration) {
+ if (!kickoutEnabled) {
+ return;
+ }
+
+ logger.debug("store <token, expiration> to Map");
+ mapTokenExpiration.put(token, expiration); // FIXME: 存储到 redis 或 数据库
+
+ if (redisTokenStore != null) {
+ logger.debug("store <token, expiration> to Redis");
+ redisTokenStore.storeTokenExpiration(token, expiration);
+ }
+ }
+
+ private Long loadTokenExpiration(String token) {
+ if (!kickoutEnabled) {
+ return Long.MAX_VALUE;
+ }
+
+ if (redisTokenStore != null) {
+ logger.debug("load <token, expiration> from Redis");
+ return redisTokenStore.loadTokenExpiration(token, -1L);
+ }
+
+ logger.debug("load <token, expiration> from Map");
+ return mapTokenExpiration.getOrDefault(token, -1L); // FIXME: 存储到 redis 或 数据库
+ }
+
+ /**
+ * 从数据声明生成令牌
+ *
+ * @param claims 数据声明
+ * @return 令牌
+ */
+ public String generateToken(Map<String, Object> claims) {
+ Date expirationDate = new Date(System.currentTimeMillis() + expiration * 1000);
+ String token = Jwts.builder()
+ .setClaims(claims)
+ .setIssuer(issuer)
+ .setId(jti)
+ .setIssuedAt(new Date(System.currentTimeMillis()))
+ .setExpiration(expirationDate)
+ .signWith(SignatureAlgorithm.RS512, this.getPrivateKey())
+ .compact();
+
+ storeTokenExpiration(token, expirationDate.getTime());
+
+ return token;
+ }
+
+ /**
+ * 从令牌中获取数据声明
+ *
+ * @param token 令牌
+ * @return 数据声明
+ */
+ public Claims getClaimsFromToken(String token) {
+ Claims claims;
+ try {
+ claims = Jwts.parser().setSigningKey(this.getPublicKey()).parseClaimsJws(token).getBody();
+ } catch (Exception e) {
+ claims = null;
+ }
+ return claims;
+ }
+
+ /**
+ * 判断令牌是否过期
+ *
+ * @param token 令牌
+ * @return 是否过期
+ */
+ public Boolean isTokenExpired(String token) {
+ try {
+ Claims claims = getClaimsFromToken(token);
+ Date expiration = claims.getExpiration();
+
+ Date now = new Date();
+
+ // 判断存储中的 token 是否过期
+ Long expirationTimeMillis = loadTokenExpiration(token);
+ if (expirationTimeMillis < now.getTime()) {
+ return true;
+ }
+
+ return expiration.before(now);
+ } catch (Exception e) {
+ return false; // FIXME: ?
+ }
+ }
+
+ /**
+ * 刷新令牌
+ *
+ * @param token 原令牌
+ * @return 新令牌
+ */
+ public String refreshToken(String token) {
+ String refreshedToken;
+ try {
+ Claims claims = getClaimsFromToken(token);
+ claims.put("created", new Date());
+ refreshedToken = generateToken(claims);
+ } catch (Exception e) {
+ refreshedToken = null;
+ }
+ return refreshedToken;
+ }
+
+ /**
+ * 验证令牌
+ *
+ * @param token 令牌
+ * @param userDetails 用户
+ * @return 是否有效
+ */
+ public Boolean validateToken(String token, String username) {
+ Claims claims = getClaimsFromToken(token);
+ String sub = claims.getSubject();
+
+ return (sub.equals(username) && !isTokenExpired(token));
+ }
+
+ /**
+ * 踢出令牌
+ * @param token
+ */
+ public void expireToken(String token) {
+ if (!isTokenExpired(token)) {
+ storeTokenExpiration(token, -1L);
+ }
+ }
+
+}
diff --git a/gateway/src/main/resources/META-INF/spring.factories b/gateway/src/main/resources/META-INF/spring.factories
new file mode 100644
index 0000000..9a872fd
--- /dev/null
+++ b/gateway/src/main/resources/META-INF/spring.factories
@@ -0,0 +1,3 @@
+# Auto Configure
+org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
+com.supwisdom.infras.security.reactive.InfrasSecurityReactiveAutoConfiguration
\ No newline at end of file