.*), /$\\{path}/$\\{path}/v3/api-docs\n\ngateway:\n encode-key: \'thanks,pig4cloud\'\n ignore-clients:\n - test\n - client', '000988cf0102382d3f23df35027b47fd', '2022-05-08 12:10:37', '2022-06-07 14:00:11', 'nacos', '127.0.0.1', '', '', '', '', '', 'yaml', '', '');
INSERT INTO `config_info` VALUES (5, 'pig-monitor-dev.yml', 'DEFAULT_GROUP', 'spring:\n autoconfigure:\n exclude: com.pig4cloud.pig.common.core.config.JacksonConfiguration\n # 安全配置\n security:\n user:\n name: ENC(8Hk2ILNJM8UTOuW/Xi75qg==) # pig\n password: ENC(o6cuPFfUevmTbkmBnE67Ow====) # pig\n', '650bdfa15f60f3faa84dfe6e6878b8cf', '2022-05-08 12:10:37', '2022-05-08 12:10:37', NULL, '127.0.0.1', '', '', NULL, NULL, NULL, 'yaml', NULL, '');
-INSERT INTO `config_info` VALUES (6, 'pig-upms-biz-dev.yml', 'DEFAULT_GROUP', 'security:\n oauth2:\n client:\n client-id: ENC(imENTO7M8bLO38LFSIxnzw==)\n client-secret: ENC(i3cDFhs26sa2Ucrfz2hnQw==)\n scope: server\n\n# 数据源\nspring:\n datasource:\n type: com.zaxxer.hikari.HikariDataSource\n driver-class-name: com.mysql.cj.jdbc.Driver\n username: root\n password: root\n url: jdbc:mysql://pig-mysql:3306/pig?characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=false&allowMultiQueries=true&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=Asia/Shanghai&nullCatalogMeansCurrent=true&allowPublicKeyRetrieval=true\n\n# 文件上传相关 支持阿里云、华为云、腾讯、minio\noss:\n endpoint: http://minio.pig4cloud.com\n accessKey: lengleng\n secretKey: lengleng\n bucket-name: tmp', '107614b40932e8237787b769e0937ed2', '2022-05-08 12:10:37', '2022-05-08 12:10:37', NULL, '127.0.0.1', '', '', NULL, NULL, NULL, 'yaml', NULL, '');
+INSERT INTO `config_info` VALUES (6, 'pig-upms-biz-dev.yml', 'DEFAULT_GROUP', '# 数据源\nspring:\n datasource:\n type: com.zaxxer.hikari.HikariDataSource\n driver-class-name: com.mysql.cj.jdbc.Driver\n username: root\n password: root\n url: jdbc:mysql://pig-mysql:3306/pig?characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=false&allowMultiQueries=true&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=Asia/Shanghai&nullCatalogMeansCurrent=true&allowPublicKeyRetrieval=true\n\n# 文件上传相关 支持阿里云、华为云、腾讯、minio\noss:\n endpoint: http://minio.pig4cloud.com\n accessKey: lengleng\n secretKey: lengleng\n bucket-name: tmp', '899d2431d91da0d521378cc7fa61268d', '2022-05-08 12:10:37', '2023-01-28 14:01:46', '', '0:0:0:0:0:0:0:1', '', '', '', '', '', 'yaml', '', '');
INSERT INTO `config_info` VALUES (7, 'pig-xxl-job-admin-dev.yml', 'DEFAULT_GROUP', '# xxl\nxxl:\n job:\n accessToken: default_token\n i18n: zh_CN\n logretentiondays: 30\n triggerpool:\n fast.max: 200\n slow.max: 200\n\n# mybatis\nmybatis:\n mapper-locations: classpath:/mybatis-mapper/*Mapper.xml\n\nspring:\n datasource:\n url: jdbc:mysql://${MYSQL_HOST:pig-mysql}:${MYSQL_PORT:3306}/${MYSQL_DB:pig_job}?characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=false&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=GMT%2B8&nullCatalogMeansCurrent=true&allowPublicKeyRetrieval=true\n driver-class-name: com.mysql.cj.jdbc.Driver\n username: ${MYSQL_USER:root}\n password: ${MYSQL_PWD:root}\n mvc:\n static-path-pattern: /static/**\n freemarker:\n suffix: .ftl\n request-context-attribute: request\n settings:\n number_format: 0.##########\n mail:\n host: smtp.mxhichina.com\n port: 465\n from: xxxx@gitee.wang\n username: xxxx@gitee.wang\n password: xxxx\n properties:\n mail:\n smtp:\n auth: true\n ssl.enable: true\n starttls.enable: false\n required: false\n# spring boot admin 配置\n\nmanagement:\n health:\n mail:\n enabled: false\n endpoints:\n web:\n exposure:\n include: \'*\'\n endpoint:\n health:\n show-details: ALWAYS\n\n', 'b67cbbd37c8b42cdc6521780b3ed742a', '2022-11-27 17:23:42', '2022-11-27 17:28:01', 'nacos', '0:0:0:0:0:0:0:1', '', '', '', '', '', 'yaml', '', '');
COMMIT;
diff --git a/db/pig_job.sql b/db/pig_job.sql
index 585c6e8bf1b3554de2f4d752bc3a7f20b1a93e32..766178296f540d33db266d7944a47753ece907dd 100644
--- a/db/pig_job.sql
+++ b/db/pig_job.sql
@@ -1,10 +1,10 @@
DROP DATABASE IF EXISTS `pig_job`;
-CREATE DATABASE `pig_job` DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;
+CREATE DATABASE `pig_job` DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;
use `pig_job`;
-SET NAMES utf8;
+SET NAMES utf8mb4;
CREATE TABLE `xxl_job_info` (
`id` int(11) NOT NULL AUTO_INCREMENT,
@@ -32,7 +32,7 @@ CREATE TABLE `xxl_job_info` (
`trigger_last_time` bigint(13) NOT NULL DEFAULT '0' COMMENT '上次调度时间',
`trigger_next_time` bigint(13) NOT NULL DEFAULT '0' COMMENT '下次调度时间',
PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
CREATE TABLE `xxl_job_log` (
`id` bigint(20) NOT NULL AUTO_INCREMENT,
@@ -53,7 +53,7 @@ CREATE TABLE `xxl_job_log` (
PRIMARY KEY (`id`),
KEY `I_trigger_time` (`trigger_time`),
KEY `I_handle_code` (`handle_code`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
CREATE TABLE `xxl_job_log_report` (
`id` int(11) NOT NULL AUTO_INCREMENT,
@@ -64,7 +64,7 @@ CREATE TABLE `xxl_job_log_report` (
`update_time` datetime DEFAULT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `i_trigger_day` (`trigger_day`) USING BTREE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
CREATE TABLE `xxl_job_logglue` (
`id` int(11) NOT NULL AUTO_INCREMENT,
@@ -75,7 +75,7 @@ CREATE TABLE `xxl_job_logglue` (
`add_time` datetime DEFAULT NULL,
`update_time` datetime DEFAULT NULL,
PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
CREATE TABLE `xxl_job_registry` (
`id` int(11) NOT NULL AUTO_INCREMENT,
@@ -85,7 +85,7 @@ CREATE TABLE `xxl_job_registry` (
`update_time` datetime DEFAULT NULL,
PRIMARY KEY (`id`),
KEY `i_g_k_v` (`registry_group`,`registry_key`,`registry_value`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
CREATE TABLE `xxl_job_group` (
`id` int(11) NOT NULL AUTO_INCREMENT,
@@ -95,7 +95,7 @@ CREATE TABLE `xxl_job_group` (
`address_list` text COMMENT '执行器地址列表，多地址逗号分隔',
`update_time` datetime DEFAULT NULL,
PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
CREATE TABLE `xxl_job_user` (
`id` int(11) NOT NULL AUTO_INCREMENT,
@@ -105,12 +105,12 @@ CREATE TABLE `xxl_job_user` (
`permission` varchar(255) DEFAULT NULL COMMENT '权限：执行器ID列表，多个逗号分割',
PRIMARY KEY (`id`),
UNIQUE KEY `i_username` (`username`) USING BTREE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
CREATE TABLE `xxl_job_lock` (
`lock_name` varchar(50) NOT NULL COMMENT '锁名称',
PRIMARY KEY (`lock_name`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
INSERT INTO `xxl_job_group`(`id`, `app_name`, `title`, `address_type`, `address_list`, `update_time`) VALUES (1, 'xxl-job-executor-sample', '示例执行器', 0, NULL, '2018-11-03 22:21:31' );
INSERT INTO `xxl_job_info`(`id`, `job_group`, `job_desc`, `add_time`, `update_time`, `author`, `alarm_email`, `schedule_type`, `schedule_conf`, `misfire_strategy`, `executor_route_strategy`, `executor_handler`, `executor_param`, `executor_block_strategy`, `executor_timeout`, `executor_fail_retry_count`, `glue_type`, `glue_source`, `glue_remark`, `glue_updatetime`, `child_jobid`) VALUES (1, 1, '测试任务1', '2018-11-03 22:21:31', '2018-11-03 22:21:31', 'XXL', '', 'CRON', '0 0 0 * * ? *', 'DO_NOTHING', 'FIRST', 'demoJobHandler', '', 'SERIAL_EXECUTION', 0, 0, 'BEAN', '', 'GLUE代码初始化', '2018-11-03 22:21:31', '');
diff --git a/docker-compose.yml b/docker-compose.yml
index be4193263a711c9f496c142fc9e4faa3f257b1e8..3380751d680e7175bec8baaefb9d19a69a152e0b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,13 +9,9 @@ services:
restart: always
container_name: pig-mysql
image: pig-mysql
- ports:
- - 3306:3306
pig-redis:
image: redis:7.0.0
- ports:
- - 6379:6379
restart: always
container_name: pig-redis
hostname: pig-redis
diff --git a/pig-auth/pom.xml b/pig-auth/pom.xml
index 1e5e2da47c9c7087d584f1b5064692ad4e8d1e1c..9557d78de3f53e184bae675d41c99a3bc4fecfca 100755
--- a/pig-auth/pom.xml
+++ b/pig-auth/pom.xml
@@ -21,7 +21,7 @@
com.pig4cloud
pig
- 3.6.4
+ 3.6.7
pig-auth
diff --git a/pig-auth/src/main/java/com/pig4cloud/pig/auth/config/AuthorizationServerConfiguration.java b/pig-auth/src/main/java/com/pig4cloud/pig/auth/config/AuthorizationServerConfiguration.java
index a6e9105d567dcad462d5fdef34d94a1c30677a24..a9c01e433c3d85147e545ab49b0d9ae3759de0f2 100755
--- a/pig-auth/src/main/java/com/pig4cloud/pig/auth/config/AuthorizationServerConfiguration.java
+++ b/pig-auth/src/main/java/com/pig4cloud/pig/auth/config/AuthorizationServerConfiguration.java
@@ -35,6 +35,7 @@ import org.springframework.core.annotation.Order;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
+import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
import org.springframework.security.oauth2.server.authorization.token.DelegatingOAuth2TokenGenerator;
@@ -44,14 +45,13 @@ import org.springframework.security.oauth2.server.authorization.web.authenticati
import org.springframework.security.web.DefaultSecurityFilterChain;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.AuthenticationConverter;
-import org.springframework.security.web.util.matcher.RequestMatcher;
import java.util.Arrays;
/**
* @author lengleng
* @date 2022/5/27
- *
+ *
* 认证服务器配置
*/
@Configuration
@@ -63,25 +63,34 @@ public class AuthorizationServerConfiguration {
@Bean
@Order(Ordered.HIGHEST_PRECEDENCE)
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
- OAuth2AuthorizationServerConfigurer authorizationServerConfigurer = new OAuth2AuthorizationServerConfigurer();
- http.apply(authorizationServerConfigurer.tokenEndpoint((tokenEndpoint) -> {// 个性化认证授权端点
+ // OAuth 2.1 默认配置
+ // 缺省配置：authorizeRequests.anyRequest().authenticated()、
+ // csrf.ignoringRequestMatchers(endpointsMatcher) 等等
+ OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
+
+ // 使用 HttpSecurity 获取 OAuth 2.1 配置中的 OAuth2AuthorizationServerConfigurer 对象
+ OAuth2AuthorizationServerConfigurer authorizationServerConfigurer = http
+ .getConfigurer(OAuth2AuthorizationServerConfigurer.class);
+
+ authorizationServerConfigurer.tokenEndpoint((tokenEndpoint) -> {// 个性化认证授权端点
tokenEndpoint.accessTokenRequestConverter(accessTokenRequestConverter()) // 注入自定义的授权认证Converter
- .accessTokenResponseHandler(new PigAuthenticationSuccessEventHandler()) // 登录成功处理器
- .errorResponseHandler(new PigAuthenticationFailureEventHandler());// 登录失败处理器
+ .accessTokenResponseHandler(new PigAuthenticationSuccessEventHandler()) // 登录成功处理器
+ .errorResponseHandler(new PigAuthenticationFailureEventHandler());// 登录失败处理器
}).clientAuthentication(oAuth2ClientAuthenticationConfigurer -> // 个性化客户端认证
oAuth2ClientAuthenticationConfigurer.errorResponseHandler(new PigAuthenticationFailureEventHandler()))// 处理客户端认证异常
- .authorizationEndpoint(authorizationEndpoint -> authorizationEndpoint// 授权码端点个性化confirm页面
- .consentPage(SecurityConstants.CUSTOM_CONSENT_PAGE_URI)));
-
- RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
- DefaultSecurityFilterChain securityFilterChain = http.requestMatcher(endpointsMatcher)
- .authorizeRequests(authorizeRequests -> authorizeRequests.anyRequest().authenticated())
- .apply(authorizationServerConfigurer.authorizationService(authorizationService)// redis存储token的实现
- .authorizationServerSettings(AuthorizationServerSettings.builder()
- .issuer(SecurityConstants.PROJECT_LICENSE).build()))
- // 授权码登录的登录页个性化
- .and().apply(new FormIdentityLoginConfigurer()).and().build();
+ .authorizationEndpoint(authorizationEndpoint -> authorizationEndpoint// 授权码端点个性化confirm页面
+ .consentPage(SecurityConstants.CUSTOM_CONSENT_PAGE_URI));
+
+ DefaultSecurityFilterChain securityFilterChain = authorizationServerConfigurer
+ .authorizationService(authorizationService)// redis存储token的实现
+ .authorizationServerSettings(
+ AuthorizationServerSettings.builder().issuer(SecurityConstants.PROJECT_LICENSE).build())
+ // 授权码登录的登录页个性化
+ .and()
+ .apply(new FormIdentityLoginConfigurer())
+ .and()
+ .build();
// 注入自定义授权模式实现
addCustomOAuth2GrantAuthenticationProvider(http);
@@ -106,20 +115,17 @@ public class AuthorizationServerConfiguration {
* @return DelegatingAuthenticationConverter
*/
private AuthenticationConverter accessTokenRequestConverter() {
- return new DelegatingAuthenticationConverter(Arrays.asList(
- new OAuth2ResourceOwnerPasswordAuthenticationConverter(),
- new OAuth2ResourceOwnerSmsAuthenticationConverter(), new OAuth2RefreshTokenAuthenticationConverter(),
- new OAuth2ClientCredentialsAuthenticationConverter(),
- new OAuth2AuthorizationCodeAuthenticationConverter(),
- new OAuth2AuthorizationCodeRequestAuthenticationConverter()));
+ return new DelegatingAuthenticationConverter(
+ Arrays.asList(new OAuth2ResourceOwnerPasswordAuthenticationConverter(),
+ new OAuth2ResourceOwnerSmsAuthenticationConverter(),
+ new OAuth2AuthorizationCodeRequestAuthenticationConverter()));
}
/**
* 注入授权模式实现提供方
- *
+ *
* 1. 密码模式
* 2. 短信登录
- *
*/
@SuppressWarnings("unchecked")
private void addCustomOAuth2GrantAuthenticationProvider(HttpSecurity http) {
diff --git a/pig-auth/src/main/java/com/pig4cloud/pig/auth/config/WebSecurityConfiguration.java b/pig-auth/src/main/java/com/pig4cloud/pig/auth/config/WebSecurityConfiguration.java
index 0ebc699d9a1821d14d1b01016b6e18c8ce9d481d..81736c799df44d05d7c97c89d57f80065487e833 100755
--- a/pig-auth/src/main/java/com/pig4cloud/pig/auth/config/WebSecurityConfiguration.java
+++ b/pig-auth/src/main/java/com/pig4cloud/pig/auth/config/WebSecurityConfiguration.java
@@ -41,9 +41,15 @@ public class WebSecurityConfiguration {
*/
@Bean
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
- http.authorizeRequests(authorizeRequests -> authorizeRequests.antMatchers("/token/*").permitAll()// 开放自定义的部分端点
- .anyRequest().authenticated()).headers().frameOptions().sameOrigin()// 避免iframe同源无法登录
- .and().apply(new FormIdentityLoginConfigurer()); // 表单登录个性化
+ http.authorizeRequests(authorizeRequests -> authorizeRequests.antMatchers("/token/*")
+ .permitAll()// 开放自定义的部分端点
+ .anyRequest()
+ .authenticated())
+ .headers()
+ .frameOptions()
+ .sameOrigin()// 避免iframe同源无法登录
+ .and()
+ .apply(new FormIdentityLoginConfigurer()); // 表单登录个性化
// 处理 UsernamePasswordAuthenticationToken
http.authenticationProvider(new PigDaoAuthenticationProvider());
return http.build();
@@ -61,8 +67,13 @@ public class WebSecurityConfiguration {
@Order(0)
SecurityFilterChain resources(HttpSecurity http) throws Exception {
http.requestMatchers((matchers) -> matchers.antMatchers("/actuator/**", "/css/**", "/error"))
- .authorizeHttpRequests((authorize) -> authorize.anyRequest().permitAll()).requestCache().disable()
- .securityContext().disable().sessionManagement().disable();
+ .authorizeHttpRequests((authorize) -> authorize.anyRequest().permitAll())
+ .requestCache()
+ .disable()
+ .securityContext()
+ .disable()
+ .sessionManagement()
+ .disable();
return http.build();
}
diff --git a/pig-auth/src/main/java/com/pig4cloud/pig/auth/endpoint/PigTokenEndpoint.java b/pig-auth/src/main/java/com/pig4cloud/pig/auth/endpoint/PigTokenEndpoint.java
index 99b64714535553384f0c626854da741e39a46268..51b358ed244c8b458f411dd1c79c0ccff542e2a7 100644
--- a/pig-auth/src/main/java/com/pig4cloud/pig/auth/endpoint/PigTokenEndpoint.java
+++ b/pig-auth/src/main/java/com/pig4cloud/pig/auth/endpoint/PigTokenEndpoint.java
@@ -107,8 +107,9 @@ public class PigTokenEndpoint {
@RequestParam(OAuth2ParameterNames.CLIENT_ID) String clientId,
@RequestParam(OAuth2ParameterNames.SCOPE) String scope,
@RequestParam(OAuth2ParameterNames.STATE) String state) {
- SysOauthClientDetails clientDetails = RetOps.of(clientDetailsService.getClientDetailsById(clientId)).getData()
- .orElseThrow(() -> new OAuthClientException("clientId 不合法"));
+ SysOauthClientDetails clientDetails = RetOps.of(clientDetailsService.getClientDetailsById(clientId))
+ .getData()
+ .orElseThrow(() -> new OAuthClientException("clientId 不合法"));
Set authorizedScopes = StringUtils.commaDelimitedListToSet(clientDetails.getScope());
modelAndView.addObject("clientId", clientId);
diff --git a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/CustomeOAuth2AccessTokenGenerator.java b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/CustomeOAuth2AccessTokenGenerator.java
index 7865f68d376b6fb1a8d21c239dcbd1f5f69b6679..667f6da5ada7b3382a871bc1233a4c93f85942e4 100644
--- a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/CustomeOAuth2AccessTokenGenerator.java
+++ b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/CustomeOAuth2AccessTokenGenerator.java
@@ -30,7 +30,7 @@ public class CustomeOAuth2AccessTokenGenerator implements OAuth2TokenGenerator additionalParameters = parameters.entrySet().stream()
- .filter(e -> !e.getKey().equals(OAuth2ParameterNames.GRANT_TYPE)
- && !e.getKey().equals(OAuth2ParameterNames.SCOPE))
- .collect(Collectors.toMap(Map.Entry::getKey, e -> e.getValue().get(0)));
+ Map additionalParameters = parameters.entrySet()
+ .stream()
+ .filter(e -> !e.getKey().equals(OAuth2ParameterNames.GRANT_TYPE)
+ && !e.getKey().equals(OAuth2ParameterNames.SCOPE))
+ .collect(Collectors.toMap(Map.Entry::getKey, e -> e.getValue().get(0)));
// 创建token
return buildToken(clientPrincipal, requestedScopes, additionalParameters);
diff --git a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/base/OAuth2ResourceOwnerBaseAuthenticationProvider.java b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/base/OAuth2ResourceOwnerBaseAuthenticationProvider.java
index f551f77b98f4e0074866e22825cb199ea5b1bd80..0ef6892c1950a21228c1372bc0761061b0e33d7d 100644
--- a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/base/OAuth2ResourceOwnerBaseAuthenticationProvider.java
+++ b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/base/OAuth2ResourceOwnerBaseAuthenticationProvider.java
@@ -3,6 +3,7 @@ package com.pig4cloud.pig.auth.support.base;
import cn.hutool.extra.spring.SpringUtil;
import com.pig4cloud.pig.common.security.util.OAuth2ErrorCodesExpand;
import com.pig4cloud.pig.common.security.util.ScopeException;
+import lombok.extern.slf4j.Slf4j;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.springframework.context.support.MessageSourceAccessor;
@@ -35,6 +36,7 @@ import java.util.function.Supplier;
*
* 处理自定义授权
*/
+@Slf4j
public abstract class OAuth2ResourceOwnerBaseAuthenticationProvider
implements AuthenticationProvider {
@@ -109,29 +111,29 @@ public abstract class OAuth2ResourceOwnerBaseAuthenticationProvider authorizedScopes;
// Default to configured scopes
- if (!CollectionUtils.isEmpty(resouceOwnerBaseAuthentication.getScopes())) {
- for (String requestedScope : resouceOwnerBaseAuthentication.getScopes()) {
+ if (!CollectionUtils.isEmpty(resourceOwnerBaseAuthentication.getScopes())) {
+ for (String requestedScope : resourceOwnerBaseAuthentication.getScopes()) {
if (!registeredClient.getScopes().contains(requestedScope)) {
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_SCOPE);
}
}
- authorizedScopes = new LinkedHashSet<>(resouceOwnerBaseAuthentication.getScopes());
+ authorizedScopes = new LinkedHashSet<>(resourceOwnerBaseAuthentication.getScopes());
}
else {
throw new ScopeException(OAuth2ErrorCodesExpand.SCOPE_IS_EMPTY);
}
- Map reqParameters = resouceOwnerBaseAuthentication.getAdditionalParameters();
+ Map reqParameters = resourceOwnerBaseAuthentication.getAdditionalParameters();
try {
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = buildToken(reqParameters);
@@ -139,7 +141,7 @@ public abstract class OAuth2ResourceOwnerBaseAuthenticationProvider) () -> new InternalAuthenticationServiceException("web request is empty"));
+ HttpServletRequest request = WebUtils.getRequest()
+ .orElseThrow(
+ (Supplier) () -> new InternalAuthenticationServiceException("web request is empty"));
Map paramMap = ServletUtil.getParamMap(request);
String grantType = paramMap.get(OAuth2ParameterNames.GRANT_TYPE);
@@ -104,12 +104,13 @@ public class PigDaoAuthenticationProvider extends AbstractUserDetailsAuthenticat
}
Map userDetailsServiceMap = SpringUtil
- .getBeansOfType(PigUserDetailsService.class);
+ .getBeansOfType(PigUserDetailsService.class);
String finalClientId = clientId;
- Optional optional = userDetailsServiceMap.values().stream()
- .filter(service -> service.support(finalClientId, grantType))
- .max(Comparator.comparingInt(Ordered::getOrder));
+ Optional optional = userDetailsServiceMap.values()
+ .stream()
+ .filter(service -> service.support(finalClientId, grantType))
+ .max(Comparator.comparingInt(Ordered::getOrder));
if (!optional.isPresent()) {
throw new InternalAuthenticationServiceException("UserDetailsService error , not register");
diff --git a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/handler/PigAuthenticationFailureEventHandler.java b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/handler/PigAuthenticationFailureEventHandler.java
index a12b2a99df77d857c9396d9783b2300b4576a225..979282e179ebbb2fed9efdb47bbdd18b4a05f766 100644
--- a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/handler/PigAuthenticationFailureEventHandler.java
+++ b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/handler/PigAuthenticationFailureEventHandler.java
@@ -23,6 +23,7 @@ import com.pig4cloud.pig.common.core.constant.SecurityConstants;
import com.pig4cloud.pig.common.core.util.MsgUtils;
import com.pig4cloud.pig.common.core.util.R;
import com.pig4cloud.pig.common.core.util.SpringContextHolder;
+import com.pig4cloud.pig.common.core.util.WebUtils;
import com.pig4cloud.pig.common.log.event.SysLogEvent;
import com.pig4cloud.pig.common.log.util.LogTypeEnum;
import com.pig4cloud.pig.common.log.util.SysLogUtils;
@@ -75,6 +76,8 @@ public class PigAuthenticationFailureEventHandler implements AuthenticationFailu
Long endTime = System.currentTimeMillis();
logVo.setTime(endTime - startTime);
}
+
+ logVo.setServiceId(WebUtils.getClientId());
logVo.setCreateBy(username);
logVo.setUpdateBy(username);
SpringContextHolder.publishEvent(new SysLogEvent(logVo));
diff --git a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/handler/PigAuthenticationSuccessEventHandler.java b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/handler/PigAuthenticationSuccessEventHandler.java
index 162babd2133ea5fbf0800244d2efd67f9830ff80..09e6f01f88b659b4e2ab96d89e8ec4a754ffbae8 100644
--- a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/handler/PigAuthenticationSuccessEventHandler.java
+++ b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/handler/PigAuthenticationSuccessEventHandler.java
@@ -30,6 +30,7 @@ import lombok.extern.slf4j.Slf4j;
import org.springframework.http.converter.HttpMessageConverter;
import org.springframework.http.server.ServletServerHttpResponse;
import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.core.OAuth2AccessToken;
import org.springframework.security.oauth2.core.OAuth2RefreshToken;
@@ -71,7 +72,10 @@ public class PigAuthenticationSuccessEventHandler implements AuthenticationSucce
// 发送异步日志事件
PigUser userInfo = (PigUser) map.get(SecurityConstants.DETAILS_USER);
log.info("用户：{} 登录成功", userInfo.getName());
- SecurityContextHolder.getContext().setAuthentication(accessTokenAuthentication);
+ // 避免 race condition
+ SecurityContext context = SecurityContextHolder.createEmptyContext();
+ context.setAuthentication(accessTokenAuthentication);
+ SecurityContextHolder.setContext(context);
SysLog logVo = SysLogUtils.getSysLog();
logVo.setTitle("登录成功");
String startTimeStr = request.getHeader(CommonConstants.REQUEST_START_TIME);
@@ -80,6 +84,8 @@ public class PigAuthenticationSuccessEventHandler implements AuthenticationSucce
Long endTime = System.currentTimeMillis();
logVo.setTime(endTime - startTime);
}
+
+ logVo.setServiceId(accessTokenAuthentication.getRegisteredClient().getClientId());
logVo.setCreateBy(userInfo.getName());
logVo.setUpdateBy(userInfo.getName());
SpringContextHolder.publishEvent(new SysLogEvent(logVo));
@@ -99,7 +105,8 @@ public class PigAuthenticationSuccessEventHandler implements AuthenticationSucce
Map additionalParameters = accessTokenAuthentication.getAdditionalParameters();
OAuth2AccessTokenResponse.Builder builder = OAuth2AccessTokenResponse.withToken(accessToken.getTokenValue())
- .tokenType(accessToken.getTokenType()).scopes(accessToken.getScopes());
+ .tokenType(accessToken.getTokenType())
+ .scopes(accessToken.getScopes());
if (accessToken.getIssuedAt() != null && accessToken.getExpiresAt() != null) {
builder.expiresIn(ChronoUnit.SECONDS.between(accessToken.getIssuedAt(), accessToken.getExpiresAt()));
}
diff --git a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/sms/OAuth2ResourceOwnerSmsAuthenticationProvider.java b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/sms/OAuth2ResourceOwnerSmsAuthenticationProvider.java
index bc556612772a2396d2be582f0845d47e3e368a66..d7779e90198d687a550ab6bc2d19b99f54b13e2e 100644
--- a/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/sms/OAuth2ResourceOwnerSmsAuthenticationProvider.java
+++ b/pig-auth/src/main/java/com/pig4cloud/pig/auth/support/sms/OAuth2ResourceOwnerSmsAuthenticationProvider.java
@@ -52,7 +52,7 @@ public class OAuth2ResourceOwnerSmsAuthenticationProvider
public void checkClient(RegisteredClient registeredClient) {
assert registeredClient != null;
if (!registeredClient.getAuthorizationGrantTypes()
- .contains(new AuthorizationGrantType(SecurityConstants.APP))) {
+ .contains(new AuthorizationGrantType(SecurityConstants.APP))) {
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.UNAUTHORIZED_CLIENT);
}
}
diff --git a/pig-auth/src/main/resources/application.yml b/pig-auth/src/main/resources/application.yml
index 3690b33d37c0324eec92acae55a12685e09da6bb..8c60e73e60b42a207c12ba89c7da6e8a3c9ef853 100755
--- a/pig-auth/src/main/resources/application.yml
+++ b/pig-auth/src/main/resources/application.yml
@@ -6,6 +6,8 @@ spring:
name: @artifactId@
cloud:
nacos:
+ username: @nacos.username@
+ password: @nacos.password@
discovery:
server-addr: ${NACOS_HOST:pig-register}:${NACOS_PORT:8848}
config:
diff --git a/pig-auth/src/main/resources/templates/ftl/login.ftl b/pig-auth/src/main/resources/templates/ftl/login.ftl
index ede5e7ddc2f122bd6f5cf3a956e9ba8663d0c567..8935f8e51388c9c6b181ccce9cb7deb32ae92c31 100755
--- a/pig-auth/src/main/resources/templates/ftl/login.ftl
+++ b/pig-auth/src/main/resources/templates/ftl/login.ftl
@@ -28,9 +28,5 @@
-
