提交 f3b5ec77 编写于 作者: H haoxr

fix: 资源服务配置统一处理和发布问题调整

上级 01d0f175
......@@ -11,11 +11,11 @@ spring:
nacos:
discovery:
server-addr: nacos-headless.infrastructure:8848 # 使用k8s无头服务
namespace: prod-namespace-id
namespace: youlai-namespace-id
config:
server-addr: ${spring.cloud.nacos.discovery.server-addr}
file-extension: yaml
namespace: prod-namespace-id
namespace: youlai-namespace-id
shared-configs[0]:
data-id: youlai-common.yaml
refresh: true
......
package com.youlai.mall.pms.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.convert.converter.Converter;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceServerConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.csrf().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/webjars/**", "/doc.html", "/swagger-resources/**", "/v2/api-docs").permitAll()
.anyRequest().authenticated();
http.oauth2ResourceServer()
.jwt()
.jwtAuthenticationConverter(jwtAuthenticationConverter());
return http.build();
}
/**
* 自定义JWT Converter
*
* @return
* @see JwtAuthenticationProvider#setJwtAuthenticationConverter(Converter)
*/
public Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter() {
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("authorities");
JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
return jwtAuthenticationConverter;
}
}
......@@ -11,11 +11,11 @@ spring:
nacos:
discovery:
server-addr: nacos-headless.infrastructure:8848 # 使用k8s无头服务
namespace: prod-namespace-id
namespace: youlai-namespace-id
config:
server-addr: ${spring.cloud.nacos.discovery.server-addr}
file-extension: yaml
namespace: prod-namespace-id
namespace: youlai-namespace-id
# 公共配置
shared-configs[0]:
data-id: youlai-common.yaml
......
package com.youlai.mall.sms.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.convert.converter.Converter;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceServerConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.csrf().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/webjars/**", "/doc.html", "/swagger-resources/**", "/v2/api-docs").permitAll()
.anyRequest().authenticated();
http.oauth2ResourceServer()
.jwt()
.jwtAuthenticationConverter(jwtAuthenticationConverter())
;
return http.build();
}
/**
* 自定义JWT Converter
*
* @return
* @see JwtAuthenticationProvider#setJwtAuthenticationConverter(Converter)
*/
public Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter() {
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("authorities");
JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
return jwtAuthenticationConverter;
}
}
......@@ -12,12 +12,12 @@ spring:
# 注册中心
discovery:
server-addr: nacos-headless.infrastructure:8848 # 使用k8s无头服务
namespace: prod-namespace-id
namespace: youlai-namespace-id
# 配置中心
config:
server-addr: ${spring.cloud.nacos.discovery.server-addr}
file-extension: yaml
namespace: prod-namespace-id
namespace: youlai-namespace-id
shared-configs[0]:
data-id: youlai-common.yaml
refresh: true
\ No newline at end of file
package com.youlai.mall.ums.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.convert.converter.Converter;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceServerConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.csrf().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/webjars/**", "/doc.html", "/swagger-resources/**", "/v2/api-docs").permitAll()
.anyRequest().authenticated();
http.oauth2ResourceServer()
.jwt()
.jwtAuthenticationConverter(jwtAuthenticationConverter())
;
return http.build();
}
/**
* 自定义JWT Converter
*
* @return
* @see JwtAuthenticationProvider#setJwtAuthenticationConverter(Converter)
*/
public Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter() {
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("authorities");
JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
return jwtAuthenticationConverter;
}
}
......@@ -11,11 +11,11 @@ spring:
nacos:
discovery:
server-addr: nacos-headless.infrastructure:8848 # 使用k8s无头服务
namespace: prod-namespace-id
namespace: youlai-namespace-id
config:
server-addr: ${spring.cloud.nacos.discovery.server-addr}
file-extension: yaml
namespace: prod-namespace-id
namespace: youlai-namespace-id
shared-configs[0]:
data-id: youlai-common.yaml
refresh: true
......@@ -387,11 +387,11 @@
</pluginManagement>
</build>
<repositories>
<!-- <repositories>
<repository>
<id>aliyunmaven</id>
<name>aliyun</name>
<url>https://maven.aliyun.com/repository/public</url>
</repository>
</repositories>
</repositories>-->
</project>
......@@ -53,17 +53,6 @@
<artifactId>spring-security-oauth2-jose</artifactId>
</dependency>
<!-- Sentinel流量控制、熔断降级 -->
<dependency>
<groupId>com.alibaba.cloud</groupId>
<artifactId>spring-cloud-starter-alibaba-sentinel</artifactId>
</dependency>
<!-- Sentinel规则持久化至Nacos配置 -->
<dependency>
<groupId>com.alibaba.csp</groupId>
<artifactId>sentinel-datasource-nacos</artifactId>
</dependency>
<dependency>
<groupId>com.youlai</groupId>
<artifactId>ums-api</artifactId>
......@@ -109,8 +98,6 @@
<groupId>com.youlai</groupId>
<artifactId>common-mybatis</artifactId>
</dependency>
</dependencies>
<build>
......@@ -119,6 +106,14 @@
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>${spring-boot.version}</version>
<executions>
<execution>
<goals>
<goal>repackage</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
......
package com.youlai.auth.config;
import cn.binarywang.wx.miniapp.api.WxMaService;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.convert.Convert;
import cn.hutool.json.JSONUtil;
import com.youlai.auth.extension.mobile.SmsCodeAuthenticationProvider;
import com.youlai.auth.extension.wechat.WechatAuthenticationProvider;
import com.youlai.mall.ums.api.MemberFeignClient;
import lombok.RequiredArgsConstructor;
import lombok.Setter;
import lombok.extern.slf4j.Slf4j;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.StringRedisTemplate;
......@@ -19,6 +24,10 @@ import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import java.util.Arrays;
import java.util.List;
@ConfigurationProperties(prefix = "security")
@Configuration
@EnableWebSecurity
@Slf4j
......@@ -31,13 +40,21 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private final MemberFeignClient memberFeignClient;
private final StringRedisTemplate redisTemplate;
@Setter
private List<String> ignoreUrls;
@Override
protected void configure(HttpSecurity http) throws Exception {
if (CollectionUtil.isEmpty(ignoreUrls)) {
ignoreUrls = Arrays.asList("/webjars/**", "/doc.html", "/swagger-resources/**", "/v2/api-docs");
}
log.info("whitelist path:{}", JSONUtil.toJsonStr(ignoreUrls));
http
.authorizeRequests().antMatchers("/oauth/**","/rsa/publicKey", "/sms-code").permitAll()
// @link https://gitee.com/xiaoym/knife4j/issues/I1Q5X6 (接口文档knife4j需要放行的规则)
.antMatchers("/webjars/**", "/doc.html", "/swagger-resources/**", "/v2/api-docs").permitAll()
.authorizeRequests()
.antMatchers(Convert.toStrArray(ignoreUrls)).permitAll()
.anyRequest().authenticated()
.and()
.csrf().disable();
......
......@@ -13,7 +13,7 @@ spring:
# 注册中心
discovery:
server-addr: nacos-headless.infrastructure:8848 # 使用k8s无头服务
namespace: prod-namespace-id
namespace: youlai-namespace-id
# 配置中心
config:
server-addr: ${spring.cloud.nacos.discovery.server-addr}
......
......@@ -18,4 +18,5 @@ spring:
namespace: prod-namespace-id
shared-configs[0]:
data-id: youlai-common.yaml
namespace: prod-namespace-id
refresh: true
\ No newline at end of file
......@@ -6,7 +6,7 @@
<include resource="org/springframework/boot/logging/logback/defaults.xml" />
<springProperty scope="context" name="APP_NAME" source="spring.application.name"/>
<property name="LOG_HOME" value="/var/log/${APP_NAME}" />
<property name="LOG_HOME" value="/logs/${APP_NAME}" />
<!--1. 输出到控制台-->
<appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
......
......@@ -17,6 +17,7 @@
</properties>
<dependencies>
<dependency>
<groupId>com.youlai</groupId>
<artifactId>common-core</artifactId>
......
package com.youlai.mall.oms.config;
package com.youlai.common.security.config;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.convert.Convert;
import cn.hutool.json.JSONUtil;
import lombok.Setter;
import lombok.extern.slf4j.Slf4j;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.convert.converter.Converter;
......@@ -14,19 +20,34 @@ import org.springframework.security.oauth2.server.resource.authentication.JwtAut
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.security.web.SecurityFilterChain;
import java.util.Arrays;
import java.util.List;
@ConfigurationProperties(prefix = "security")
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Slf4j
public class ResourceServerConfig {
@Setter
private List<String> ignoreUrls;
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
if (CollectionUtil.isEmpty(ignoreUrls)) {
ignoreUrls = Arrays.asList("/webjars/**", "/doc.html", "/swagger-resources/**", "/v2/api-docs");
}
log.info("whitelist path:{}", JSONUtil.toJsonStr(ignoreUrls));
http
.csrf().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/webjars/**", "/doc.html", "/swagger-resources/**", "/v2/api-docs").permitAll()
.antMatchers(Convert.toStrArray(ignoreUrls)).permitAll()
.anyRequest().authenticated();
http.oauth2ResourceServer()
.jwt()
......@@ -39,7 +60,7 @@ public class ResourceServerConfig {
* 自定义JWT Converter
*
* @return
* @see JwtAuthenticationProvider#setJwtAuthenticationConverter(Converter)
* @see JwtAuthenticationProvider#setJwtAuthenticationConverter(Converter)
*/
public Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter() {
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
......@@ -51,5 +72,4 @@ public class ResourceServerConfig {
return jwtAuthenticationConverter;
}
}
com.youlai.common.security.service.PermissionService
\ No newline at end of file
com.youlai.common.security.service.PermissionService
com.youlai.common.security.config.ResourceServerConfig
\ No newline at end of file
......@@ -23,5 +23,6 @@
<module>common-log</module>
<module>common-sms</module>
<module>common-file</module>
<module>common-security</module>
</modules>
</project>
......@@ -19,20 +19,14 @@ import java.util.List;
* @author haoxr
* @date 2022/8/28
*/
@ConfigurationProperties(prefix = "security")
@EnableWebFluxSecurity
@Slf4j
public class OAuth2ClientSecurityConfig {
@Setter
private List<String> ignoreUrls;
@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http
) {
if (ignoreUrls == null) {
log.error("failed to read ignoreUrls configuration,please check your nacos connection or configuration!");
}
http.authorizeExchange()
.pathMatchers("/**").permitAll()
.anyExchange().authenticated()
......
......@@ -10,11 +10,11 @@ spring:
nacos:
discovery:
server-addr: nacos-headless.infrastructure:8848 # 使用k8s无头服务
namespace: prod-namespace-id
namespace: youlai-namespace-id
config:
server-addr: ${spring.cloud.nacos.discovery.server-addr}
file-extension: yaml
namespace: prod-namespace-id
namespace: youlai-namespace-id
shared-configs[0]:
data-id: youlai-common.yaml
refresh: true
......@@ -17,4 +17,5 @@ spring:
namespace: prod-namespace-id
shared-configs[0]:
data-id: youlai-common.yaml
namespace: prod-namespace-id
refresh: true
......@@ -12,7 +12,7 @@ RUN /bin/cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \&& echo 'Asia/Shan
VOLUME /tmp
# 复制主机文件至镜像内,复制的目录需放置在 Dockerfile 文件同级目录下
ADD target/admin-boot.jar app.jar
ADD target/system-boot.jar app.jar
# 容器启动执行命令
ENTRYPOINT ["java", "-Xmx128m", "-Djava.security.egd=file:/dev/./urandom", "-jar", "/app.jar"]
......
package com.youlai.system.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.convert.converter.Converter;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceServerConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.csrf().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/api/v1/users/{username}/authinfo","/webjars/**", "/doc.html", "/swagger-resources/**", "/v2/api-docs").permitAll()
.anyRequest().authenticated();
http.oauth2ResourceServer()
.jwt()
.jwtAuthenticationConverter(jwtAuthenticationConverter())
;
return http.build();
}
/**
* 自定义JWT Converter
*
* @return
* @see JwtAuthenticationProvider#setJwtAuthenticationConverter(Converter)
*/
public Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter() {
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("authorities");
JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
return jwtAuthenticationConverter;
}
}
......@@ -11,11 +11,11 @@ spring:
nacos:
discovery:
server-addr: nacos-headless.infrastructure:8848 # 使用k8s无头服务
namespace: prod-namespace-id
namespace: youlai-namespace-id
config:
server-addr: ${spring.cloud.nacos.discovery.server-addr}
file-extension: yaml
namespace: prod-namespace-id
namespace: youlai-namespace-id
shared-configs[0]:
data-id: youlai-common.yaml
refresh: true
......
......@@ -18,5 +18,6 @@ spring:
namespace: prod-namespace-id
shared-configs[0]:
data-id: youlai-common.yaml
namespace: prod-namespace-id
refresh: true
package com.youlai.system.service.impl;
import com.youlai.system.mapper.SysPermissionMapper;
import com.youlai.system.pojo.entity.SysPermission;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import java.util.List;
/**
* @author haoxr
* @description TODO
* @createTime 2021/5/30 23:19
*/
@SpringBootTest
@Slf4j
class SysPermissionServiceImplTest {
@Autowired
SysPermissionMapper sysPermissionMapper;
SysPermissionService sysPermissionService;
@Test
void listPermissionRoles() {
List<SysPermission> sysPermissions = sysPermissionMapper.listPermRoles();
log.info(sysPermissions.toString());
}
@Test
void refreshPermRolesRules(){
}
}
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册