spring boot 基于外部權(quán)限系統(tǒng)擴展Session Repository實現(xiàn)登陸權(quán)限驗證

thekingisalwaysluc 發(fā)布于2019-08-15 17:45 / 1183人閱讀

摘要：在進行一些公司內(nèi)部系統(tǒng)開發(fā)中，經(jīng)常會需要對接公司內(nèi)部統(tǒng)一的權(quán)限管理系統(tǒng)進行權(quán)限角色驗證等等。在實際開發(fā)過程中可以借助的實現(xiàn)權(quán)限驗證功能。

在進行一些公司內(nèi)部系統(tǒng)開發(fā)中，經(jīng)常會需要對接公司內(nèi)部統(tǒng)一的權(quán)限管理系統(tǒng)進行權(quán)限角色驗證等等。在實際開發(fā)過程中可以借助Spring的Session Repository實現(xiàn)權(quán)限驗證功能。
實現(xiàn)步驟如下：

一、添加自定義Session注解EnableUserHttpSession

package com.web.common.session;

import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;
import java.lang.annotation.Documented;
import java.lang.annotation.Retention;
import java.lang.annotation.Target;

/**
 * 用戶Session
 *
 */
@Retention(java.lang.annotation.RetentionPolicy.RUNTIME)
@Target({java.lang.annotation.ElementType.TYPE})
@Documented
@Import(UserHttpSessionConfiguration.class)
@Configuration
public @interface EnableUserHttpSession {
    /**
     * session 生效最大時間
     *
     * @return
     */
    int maxInactiveIntervalInSeconds() default 1800;
}

二、添加自定義Session Configuration配置UserHttpSessionConfiguration

package com.web.common.session;

import java.util.Map;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.ImportAware;
import org.springframework.core.annotation.AnnotationAttributes;
import org.springframework.core.type.AnnotationMetadata;
import org.springframework.session.config.annotation.web.http.SpringHttpSessionConfiguration;

import com.pingan.manpan.user.service.AuthService;

/**
 * Session配置
 */
@Configuration
public class UserHttpSessionConfiguration extends SpringHttpSessionConfiguration implements ImportAware {

    //session 最大生存時間
    private Integer maxInactiveIntervalInSeconds = 1800;

    // @Bean配置UserSessionRepository
    @Bean
    public UserSessionRepository sessionRepository(AuthService authService) {
        UserSessionRepository repository = new UserSessionRepository(authService);
        repository.setDefaultMaxInactiveInterval(this.maxInactiveIntervalInSeconds);
        return repository;
    }

/*
 * ImportAware 在注解解析完成后調(diào)用 setImportMetadata 注解獲取導(dǎo)入
 *（@Configuration）配置的注解的元數(shù)據(jù)
 */
    @Override
    public void setImportMetadata(AnnotationMetadata importMetadata) {
        Map enableAttrMap =
                importMetadata.getAnnotationAttributes(EnableHaofangUserHttpSession.class.getName());
        AnnotationAttributes enableAttrs = AnnotationAttributes.fromMap(enableAttrMap);
        this.maxInactiveIntervalInSeconds = enableAttrs.getNumber("maxInactiveIntervalInSeconds");
    }
}

三、自定義Session Repository：UserSessionRepository

package com.web.common.session;

import java.util.HashMap;
import java.util.Map;
import java.util.Set;

import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.session.ExpiringSession;
import org.springframework.session.SessionRepository;

import com.user.dto.VisitorDTO;
import com.user.service.AuthService;
import com.web.common.constant.WebConstants;
import com.web.common.handler.WebExceptionHandler;

/**
 * 用戶session獲取
 *
 */
public class UserSessionRepository
        implements SessionRepository {
    static Logger LOG = LoggerFactory.getLogger(UserSessionRepository.class);

    /**
     * 生效時間
     */
    private Integer defaultMaxInactiveInterval;

    /**
     * 權(quán)限系統(tǒng)訪問服務(wù)類
     */
    private AuthService authService;

    /**
     * 構(gòu)造方法
     *
     * @param authService
     */
    public UserSessionRepository(AuthService authService) {
        super();
        this.authService = authService;
    }

    /**
     * 設(shè)置最大生效時間
     *
     * @param defaultMaxInactiveInterval
     */
    public void setDefaultMaxInactiveInterval(int defaultMaxInactiveInterval) {
        this.defaultMaxInactiveInterval = defaultMaxInactiveInterval;
    }

    @Override
    public UserSession createSession() {
        UserSession UserSession = new UserSession();
        UserSession.setNew(true);
        return UserSession;
    }

    @Override
    public void save(UserSession session) {
        if (session.isNew()) {
            String preToken = (String) session.getAttribute(WebConstants.PRE_TOKEN_KEY);
            LOG.info("session save,pretoken:{}",preToken);
            VisitorDTO visitor = authService.getLoginInfoByPreToken(preToken);
            if (visitor != null) {
                session.setToken(visitor.getToken());
                session.setNew(false);
            }
        }
    }

    @Override
    public UserSession getSession(String id) {
        UserSession session = new UserSession();
        // 判斷id是否有效
        VisitorDTO visitor = authService.getLoginInfoByToken(id);
        if ((visitor == null)) {
            session.setToken("");
            session.setNew(true);
            return session;
        }
        session.setToken(id);
        session.setAttribute("visitor", visitor);
        session.setNew(false);
        return session;
    }

    @Override
    public void delete(String id) {
        // 用戶登出
        if (StringUtils.isNotBlank(id)) {
            authService.logout(id);
        }
    }

    /**
     * 封裝相關(guān)session
     */
    final class UserSession implements ExpiringSession {

        private Map attributeMap = new HashMap<>();
        private String token;
        private boolean isNew = false;

        public UserSession() {
        }

        public void setNew(boolean aNew) {
            isNew = aNew;
        }

        public boolean isNew() {
            return isNew;
        }

        public void setToken(String token) {
            this.token = token;
        }

        @Override
        public String getId() {
            return this.token;
        }

        @Override
        public Set getAttributeNames() {
            return attributeMap.keySet();
        }

        @Override
        public void setAttribute(String attributeName, Object attributeValue) {
            attributeMap.put(attributeName, attributeValue);
        }

        @Override
        public void removeAttribute(String attributeName) {
            attributeMap.remove(attributeName);
        }

        /*
         * (non-Javadoc)
         *
         * @see org.springframework.session.Session#getAttribute(java.lang.String)
         */
        @Override
        public Object getAttribute(String attributeName) {
            return attributeMap.get(attributeName);
        }

        /*
         * (non-Javadoc)
         *
         * @see org.springframework.session.ExpiringSession#getCreationTime()
         */
        @Override
        public long getCreationTime() {
            // TODO Auto-generated method stub
            return 0;
        }

        /*
         * (non-Javadoc)
         *
         * @see org.springframework.session.ExpiringSession#setLastAccessedTime(long)
         */
        @Override
        public void setLastAccessedTime(long lastAccessedTime) {
            // TODO Auto-generated method stub

        }

        /*
         * (non-Javadoc)
         *
         * @see org.springframework.session.ExpiringSession#getLastAccessedTime()
         */
        @Override
        public long getLastAccessedTime() {
            // TODO Auto-generated method stub
            return 0;
        }

        /*
         * (non-Javadoc)
         *
         * @see org.springframework.session.ExpiringSession#setMaxInactiveIntervalInSeconds(int)
         */
        @Override
        public void setMaxInactiveIntervalInSeconds(int interval) {
            // TODO Auto-generated method stub

        }

        /*
         * (non-Javadoc)
         *
         * @see org.springframework.session.ExpiringSession#getMaxInactiveIntervalInSeconds()
         */
        @Override
        public int getMaxInactiveIntervalInSeconds() {
            // TODO Auto-generated method stub
            return 0;
        }

        /*
         * (non-Javadoc)
         *
         * @see org.springframework.session.ExpiringSession#isExpired()
         */
        @Override
        public boolean isExpired() {
            // TODO Auto-generated method stub
            return false;
        }
    }
}

四、在Spring WEB配置中啟用Spring Session

package com.pingan.manpan.web.common.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.session.web.http.SessionRepositoryFilter;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;

import org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport;

import com.web.common.interceptor.AuthorizationInterceptor;

/**
 * WEB相關(guān)配置
 *
 */
@Configuration
public class WebConfiguration extends WebMvcConfigurationSupport {

    @Autowired
    private AuthorizationInterceptor authorizationInterceptor;

    @Autowired
    private SessionRepositoryFilter sessionRepositoryFilter;

    /**
     * 登陸權(quán)限驗證攔截器
     *
     * @return
     */   
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authorizationInterceptor).addPathPatterns(WebConstants.BASE_API_PATH + "/**");
    }


    /**
     * session wrapper對應(yīng)Filter注冊啟用Spring Session
     *
     * @return
     */
    @Bean
    public FilterRegistrationBean sessionRepositoryFilterRegistrationBean() {
        FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
        filterRegistrationBean.setFilter(sessionRepositoryFilter);
        filterRegistrationBean.addUrlPatterns(WebConstants.BASE_API_PATH + "/*");
        return filterRegistrationBean;
    }

}