spring cloud security集成zuul

冷不防 2022-02-16 14:11 377阅读 0赞

# 研究spring cloud security与Zuul集成 #

需要将请求通过zuul网关转发到后端,同时,zuul作为AuthorizeServer,集成了Eureka,通过Eureka做服务发现.  
首先生成一个Eureka server ,非常简单

more application.properties
    
    server.port=7999
    eureka.client.register-with-eureka=false
    eureka.client.fetch-registry=false
    spring.application.name=eureka-server
    eureka.instance.hostname=localhost
    eureka.client.serviceUrl.defaultZone=http://localhost:7999/eureka/
    eureka.client.enabled=true
    eureka.client.allow-redirects=true
    eureka.server.eviction-interval-timer-in-ms=10000

然后配置一个ResourceServer

more application.properties
    
    server.port=8081
    spring.application.name=biz
    
    security.oauth2.client.client-id=biz
    security.oauth2.client.client-secret=bizsecret
    security.oauth2.resource.id=biz
    security.oauth2.resource.token-info-uri=http://localhost:8080/oauth/check_token
    security.oauth2.authorization.check-token-access=http://localhost:8080/oauth/check_token
    security.oauth2.resource.prefer-token-info=true
    logging.level.org.springframework.security=DEBUG
    
    spring_scurity_token_access_url=http://localhost:8080/oauth/token
    
    #security.basic.enabled=true
    
    #spring.redis.database=0
    #spring.redis.cluster.nodes=10.20.100.228:6376,10.20.100.228:6377,10.20.100.228:6378
    #spring.redis.cluster.max-redirects=3
    #spring.redis.jedis.pool.max-active=50
    #spring.redis.jedis.pool.max-idle=10
    #spring.redis.jedis.pool.min-idle=1
    #spring.redis.jedis.pool.max-wait=3000
    #spring.redis.port=6377
    
    spring.redis.port=6379
    spring.redis.database=0
    spring.redis.host=10.20.100.235
    #spring.redis.pool.max-active=50
    #spring.redis.pool.max-idle=10
    #spring.redis.pool.max-wait=3000
    #spring.redis.pool.min-idle=3
    
    
    grails.mongodb.url=mongodb://localhost:27017/wsbiz
    grails.mongodb.engine=codec
    grails.mongodb.options.autoConnectRetry=true
    grails.mongodb.options.connectTimeout=30000
    spring.data.mongodb.uri=mongodb://localhost:27017/wensheng
    
    ### actuator##
    management.endpoints.web.exposure.include=*
    management.endpoint.shutdown.enabled=true
    management.endpoint.health.show-details=always
    
    ###eureka
    ###eureka
    eureka.client.allow-redirects=true
    eureka.client.enabled=true
    eureka.client.register-with-eureka=true
    eureka.client.fetch-registry=true
    eureka.client.service-url.defaultZone=http://localhost:7999/eureka/

在biz的Application上加上

@SpringBootApplication
    @EnableResourceServer
    @EnableEurekaClient
    class BizApplication{
    ...
    }

正常配置tokenStore,用来解析用户的内容

package com.ws.biz
    
    import org.springframework.beans.factory.annotation.Autowired
    import org.springframework.context.annotation.Bean
    import org.springframework.context.annotation.Configuration
    import org.springframework.context.annotation.Primary
    import org.springframework.data.redis.core.RedisTemplate
    import org.springframework.http.HttpMethod
    import org.springframework.security.config.annotation.web.builders.HttpSecurity
    import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter
    import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer
    import org.springframework.security.oauth2.provider.token.DefaultTokenServices
    import org.springframework.security.oauth2.provider.token.TokenStore
    import org.springframework.web.client.RestTemplate
    
    import java.nio.charset.StandardCharsets
    import java.util.concurrent.TimeUnit
    
    @Configuration
    class ResourceConf extends ResourceServerConfigurerAdapter{
        @Bean
        RestTemplate restTemplate(){
            def restTemplate = new RestTemplate()
            restTemplate.getMessageConverters().set(1,new org.springframework.http.converter.StringHttpMessageConverter(StandardCharsets.UTF_8))
            return restTemplate
        }
    
        @Autowired
        RedisTemplate redisTemplate
    
        @Bean
        public TokenStore tokenStore() {
            return new JedisTokenStore(redisTemplate: redisTemplate)
        }
    
        @Bean
        @Primary  //这里必须定义primary  让resource在使用的时候选择这个 不然会有多个默认的实现 会报错.
        public DefaultTokenServices tokenServices() {
            final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
            defaultTokenServices.setTokenStore(tokenStore());
            defaultTokenServices.setSupportRefreshToken(true);
            defaultTokenServices.setAccessTokenValiditySeconds((int) TimeUnit.DAYS.toSeconds(30)); // 30天
            return defaultTokenServices;
        }
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.cors().and().csrf().disable()
                    .authorizeRequests()
                    .antMatchers("/api/all/**").permitAll()
                    .antMatchers("/api/user/**").fullyAuthenticated()
                    .antMatchers("/user/**").fullyAuthenticated()
                    .antMatchers("/api/amc/**").fullyAuthenticated()
                    .antMatchers("/api/all/**").permitAll()
                    .antMatchers("/all/**").permitAll()
    
            //you can implement it like this, but I show method invocation security on write
            //http.addFilterAfter(new RecordFilter(),SecurityContextHolderAwareRequestFilter.class)
        }
    
        @Override
        public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
            resources.resourceId("biz").tokenStore(tokenStore());
        }
    }

JedisTokenStore是网上抄来的,主要原因为,redis升级为redis cluster后,原来的RedisTokenStore,不能正常使用了,所以,使用手工编写的版本.

package com.ws.biz
    
    import org.springframework.data.redis.core.RedisTemplate
    import org.springframework.security.oauth2.common.OAuth2AccessToken
    import org.springframework.security.oauth2.common.OAuth2RefreshToken
    import org.springframework.security.oauth2.provider.OAuth2Authentication
    import org.springframework.security.oauth2.provider.token.AuthenticationKeyGenerator
    import org.springframework.security.oauth2.provider.token.DefaultAuthenticationKeyGenerator
    import org.springframework.security.oauth2.provider.token.TokenStore
    
    import java.util.concurrent.TimeUnit
    
    /**
     * Created by songtao on 2019/3/1.
     */
    class JedisTokenStore implements TokenStore{
        private static final String ACCESS = "access:";
        private static final String AUTH_TO_ACCESS = "auth_to_access:";
        private static final String AUTH = "auth:";
        private static final String REFRESH_AUTH = "refresh_auth:";
        private static final String ACCESS_TO_REFRESH = "access_to_refresh:";
        private static final String REFRESH = "refresh:";
        private static final String REFRESH_TO_ACCESS = "refresh_to_access:";
        private static final String CLIENT_ID_TO_ACCESS = "client_id_to_access:";
        private static final String UNAME_TO_ACCESS = "uname_to_access:";
    
        private RedisTemplate<String,Object> redisTemplate ;
    
        public RedisTemplate<String,Object> getRedisTemplate() {
            return redisTemplate;
        }
    
        public void setRedisTemplate(RedisTemplate<String,Object> redisTemplate) {
            this.redisTemplate = redisTemplate;
        }
        private AuthenticationKeyGenerator authenticationKeyGenerator = new DefaultAuthenticationKeyGenerator();
    
        public void setAuthenticationKeyGenerator(AuthenticationKeyGenerator authenticationKeyGenerator) {
            this.authenticationKeyGenerator = authenticationKeyGenerator;
        }
    
        @Override
        public OAuth2AccessToken getAccessToken(OAuth2Authentication authentication) {
            String key = authenticationKeyGenerator.extractKey(authentication);
            OAuth2AccessToken accessToken = (OAuth2AccessToken) redisTemplate.opsForValue().get(AUTH_TO_ACCESS+key);
            if (accessToken != null
                    && !key.equals(authenticationKeyGenerator.extractKey(readAuthentication(accessToken.getValue())))) {
                // Keep the stores consistent (maybe the same user is represented by this authentication but the details
                // have changed)
                storeAccessToken(accessToken, authentication);
            }
            return accessToken;
        }
        @Override
        public OAuth2Authentication readAuthentication(OAuth2AccessToken token) {
            return readAuthentication(token.getValue());
        }
    
        @Override
        public OAuth2Authentication readAuthentication(String token) {
            return (OAuth2Authentication) this.redisTemplate.opsForValue().get(AUTH +  token);
        }
    
        @Override
        public OAuth2Authentication readAuthenticationForRefreshToken(OAuth2RefreshToken token) {
            return readAuthenticationForRefreshToken(token.getValue());
        }
    
        public OAuth2Authentication readAuthenticationForRefreshToken(String token) {
            return (OAuth2Authentication) this.redisTemplate.opsForValue().get( REFRESH_AUTH+token);
        }
    
        @Override
        public void storeAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
    
            this.redisTemplate.opsForValue().set(ACCESS+ token.getValue(), token);
            this.redisTemplate.opsForValue().set(AUTH +token.getValue(), authentication);
            this.redisTemplate.opsForValue().set(AUTH_TO_ACCESS+authenticationKeyGenerator.extractKey(authentication), token);
            if (!authentication.isClientOnly()) {
                redisTemplate.opsForList().rightPush(UNAME_TO_ACCESS+getApprovalKey(authentication), token) ;
            }
    
            redisTemplate.opsForList().rightPush(CLIENT_ID_TO_ACCESS+authentication.getOAuth2Request().getClientId(), token) ;
    
            if (token.getExpiration() != null) {
    
                int seconds = token.getExpiresIn();
                redisTemplate.expire(ACCESS+ token.getValue(), seconds, TimeUnit.SECONDS) ;
                redisTemplate.expire(AUTH+ token.getValue(), seconds, TimeUnit.SECONDS) ;
    
                redisTemplate.expire(AUTH_TO_ACCESS+ authenticationKeyGenerator.extractKey(authentication), seconds, TimeUnit.SECONDS) ;
                redisTemplate.expire(CLIENT_ID_TO_ACCESS+authentication.getOAuth2Request().getClientId(), seconds, TimeUnit.SECONDS) ;
                redisTemplate.expire(UNAME_TO_ACCESS+ getApprovalKey(authentication), seconds, TimeUnit.SECONDS) ;
            }
            if (token.getRefreshToken() != null && token.getRefreshToken().getValue() != null) {
                this.redisTemplate.opsForValue().set( REFRESH_TO_ACCESS+   token.getRefreshToken().getValue(), token.getValue());
                this.redisTemplate.opsForValue().set(ACCESS_TO_REFRESH+token.getValue(), token.getRefreshToken().getValue());
            }
        }
    
        private String getApprovalKey(OAuth2Authentication authentication) {
            String userName = authentication.getUserAuthentication() == null ? "" : authentication.getUserAuthentication()
                    .getName();
            return getApprovalKey(authentication.getOAuth2Request().getClientId(), userName);
        }
    
        private String getApprovalKey(String clientId, String userName) {
            return clientId + (userName==null ? "" : ":" + userName);
        }
    
        @Override
        public void removeAccessToken(OAuth2AccessToken accessToken) {
            removeAccessToken(accessToken.getValue());
        }
    
        @Override
        public OAuth2AccessToken readAccessToken(String tokenValue) {
            return (OAuth2AccessToken) this.redisTemplate.opsForValue().get(ACCESS+tokenValue);
        }
    
        public void removeAccessToken(String tokenValue) {
            OAuth2AccessToken removed = (OAuth2AccessToken) redisTemplate.opsForValue().get(ACCESS+tokenValue);
            // Don't remove the refresh token - it's up to the caller to do that
            OAuth2Authentication authentication = (OAuth2Authentication) this.redisTemplate.opsForValue().get(AUTH+tokenValue);
    
            this.redisTemplate.delete(AUTH+tokenValue);
            redisTemplate.delete(ACCESS+tokenValue);
            this.redisTemplate.delete(ACCESS_TO_REFRESH +tokenValue);
    
            if (authentication != null) {
                this.redisTemplate.delete(AUTH_TO_ACCESS+authenticationKeyGenerator.extractKey(authentication));
    
                String clientId = authentication.getOAuth2Request().getClientId();
                // redisTemplate.opsForList().rightPush("UNAME_TO_ACCESS:"+getApprovalKey(authentication), token) ;
                redisTemplate.opsForList().leftPop(UNAME_TO_ACCESS+getApprovalKey(clientId, authentication.getName()));
                redisTemplate.opsForList().leftPop(CLIENT_ID_TO_ACCESS+clientId);
    
                this.redisTemplate.delete(AUTH_TO_ACCESS+authenticationKeyGenerator.extractKey(authentication));
            }
        }
    
        @Override
        public void storeRefreshToken(OAuth2RefreshToken refreshToken, OAuth2Authentication authentication) {
            this.redisTemplate.opsForValue().set(REFRESH+refreshToken.getValue(), refreshToken);
            this.redisTemplate.opsForValue().set( REFRESH_AUTH + refreshToken.getValue(), authentication);
        }
    
        @Override
        public OAuth2RefreshToken readRefreshToken(String tokenValue) {
            return (OAuth2RefreshToken) this.redisTemplate.opsForValue().get(REFRESH+tokenValue);
        }
    
        @Override
        public void removeRefreshToken(OAuth2RefreshToken refreshToken) {
            removeRefreshToken(refreshToken.getValue());
        }
    
        public void removeRefreshToken(String tokenValue) {
            this.redisTemplate.delete( REFRESH + tokenValue);
            this.redisTemplate.delete( REFRESH_AUTH + tokenValue);
            this.redisTemplate.delete(REFRESH_TO_ACCESS +tokenValue);
        }
    
        @Override
        public void removeAccessTokenUsingRefreshToken(OAuth2RefreshToken refreshToken) {
            removeAccessTokenUsingRefreshToken(refreshToken.getValue());
        }
    
        void removeAccessTokenUsingRefreshToken(String refreshToken) {
    
            String token = (String) this.redisTemplate.opsForValue().get( REFRESH_TO_ACCESS  +refreshToken) ;
    
            if (token != null) {
                redisTemplate.delete(ACCESS+ token);
            }
        }
    
        @Override
        public Collection<OAuth2AccessToken> findTokensByClientIdAndUserName(String clientId, String userName) {
            List<Object> result =    redisTemplate.opsForList().range(UNAME_TO_ACCESS+ getApprovalKey(clientId, userName), 0, -1);
    
            if (result == null || result.size() == 0) {
                return Collections.<OAuth2AccessToken> emptySet();
            }
            List<OAuth2AccessToken> accessTokens = new ArrayList<OAuth2AccessToken>(result.size());
    
            for(Iterator<Object> it = result.iterator();it.hasNext();){
                OAuth2AccessToken accessToken = (OAuth2AccessToken) it.next();
                accessTokens.add(accessToken);
            }
    
            return Collections.<OAuth2AccessToken> unmodifiableCollection(accessTokens);
        }
    
        @Override
        public Collection<OAuth2AccessToken> findTokensByClientId(String clientId) {
            List<Object> result =    redisTemplate.opsForList().range((CLIENT_ID_TO_ACCESS+clientId), 0, -1);
    
            if (result == null || result.size() == 0) {
                return Collections.<OAuth2AccessToken> emptySet();
            }
            List<OAuth2AccessToken> accessTokens = new ArrayList<OAuth2AccessToken>(result.size());
    
            for(Iterator<Object> it = result.iterator();it.hasNext();){
                OAuth2AccessToken accessToken = (OAuth2AccessToken) it.next();
                accessTokens.add(accessToken);
            }
    
            return Collections.<OAuth2AccessToken> unmodifiableCollection(accessTokens);
        }
    }

现在开始配置网关Zuul的配置

more application.properties
    
    server.port=8080
    spring.application.name=zuul
    
    security.oauth2.client.client-id=dw
    security.oauth2.client.client-secret=dwsecret
    security.oauth2.resource.id=dw
    security.oauth2.resource.token-info-uri=http://localhost:8080/oauth/check_token
    security.oauth2.authorization.check-token-access=http://localhost:8080/oauth/check_token
    security.oauth2.resource.prefer-token-info=true
    logging.level.org.springframework.security=DEBUG
    
    spring_scurity_token_access_url=http://localhost:8080/oauth/token
    
    #security.basic.enabled=true
    
    #spring.redis.database=0
    #spring.redis.cluster.nodes=10.20.100.228:6376,10.20.100.228:6377,10.20.100.228:6378
    #spring.redis.cluster.max-redirects=3
    #spring.redis.jedis.pool.max-active=50
    #spring.redis.jedis.pool.max-idle=10
    #spring.redis.jedis.pool.min-idle=1
    #spring.redis.jedis.pool.max-wait=3000
    #spring.redis.port=6377
    
    spring.redis.port=6379
    spring.redis.database=0
    spring.redis.host=10.20.100.235
    #spring.redis.pool.max-active=50
    #spring.redis.pool.max-idle=10
    #spring.redis.pool.max-wait=3000
    #spring.redis.pool.min-idle=3
    
    
    grails.mongodb.url=mongodb://localhost:27017/wensheng
    grails.mongodb.engine=codec
    grails.mongodb.options.autoConnectRetry=true
    grails.mongodb.options.connectTimeout=30000
    spring.data.mongodb.uri=mongodb://localhost:27017/wensheng
    
    ### actuator##
    management.endpoints.web.exposure.include=*
    management.endpoint.shutdown.enabled=true
    management.endpoint.health.show-details=always
    
    
    ### zuul
    #zuul.prefix=/api
    zuul.routes.biz.service-id=biz
    zuul.routes.biz.path=/api/**
    zuul.routes..biz.strip-prefix=false
    #zuul.routes.biz.path=http://localhost:8081/
    zuul.routes.biz.custom-sensitive-headers=true
    #开始写的是不带引号的模式,一直不行,后来加上了双引号,才能正常的将header传到下游去
    #zuul.routes.biz.sensitive-headers=Cookie,Set-Cookie,Content-Range,Authorization
    zuul.routes.biz.sensitive-headers="Cookie","Set-Cookie","Content-Range","Authorization"
    #zuul.add-host-header=true##实测 暂时没什么用 不能将header转到下游
    #zuul.add-proxy-headers=true#这个也没用,不能将header传到下游去
    #zuul.ignore-security-headers=true#这个网上说可以将下游的信息带过来,不能传下去,没测怎么带信息过来.
    
    ###eureka
    eureka.client.allow-redirects=true
    eureka.client.enabled=true
    eureka.client.register-with-eureka=true
    eureka.client.fetch-registry=true
    eureka.client.service-url.defaultZone=http://localhost:7999/eureka/

然后配置AuthorizationServer

package com.ws.zuul
    
    import org.springframework.beans.factory.annotation.Autowired
    import org.springframework.context.annotation.Bean
    import org.springframework.context.annotation.Configuration
    import org.springframework.context.annotation.Primary
    import org.springframework.data.redis.core.RedisTemplate
    import org.springframework.security.authentication.AuthenticationManager
    import org.springframework.security.authentication.ProviderManager
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
    import org.springframework.security.crypto.password.PasswordEncoder
    import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer
    import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter
    import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer
    import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer
    import org.springframework.security.oauth2.provider.token.DefaultTokenServices
    import org.springframework.security.oauth2.provider.token.TokenStore
    
    import java.util.concurrent.TimeUnit
    
    @Configuration
    @EnableAuthorizationServer
    class AuthServerConfig extends AuthorizationServerConfigurerAdapter{
        @Autowired
        private AuthProvider authProvider;
    
        @Bean
        public AuthenticationManager authenticationManager() {
            println "authenticationProvider now is : "+authProvider
            return new ProviderManager(Arrays.asList(authProvider));
        }
    
        @Bean
        public PasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }
    
        @Autowired
        RedisTemplate redisTemplate
    
        @Bean
        public TokenStore tokenStore() {
            return new JedisTokenStore(redisTemplate: redisTemplate)
        }
    
        @Bean
        @Primary  //这里必须定义primary  让resource在使用的时候选择这个 不然会有多个默认的实现 会报错.
        public DefaultTokenServices tokenServices() {
            final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
            defaultTokenServices.setTokenStore(tokenStore());
            defaultTokenServices.setSupportRefreshToken(true);
            defaultTokenServices.setAccessTokenValiditySeconds((int) TimeUnit.DAYS.toSeconds(30)); // 30天
            return defaultTokenServices;
        }
    
        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.authenticationManager(authenticationManager());
    //        endpoints.authenticationManager(authenticationManager);
            endpoints.tokenStore(tokenStore())
    
    //        DefaultTokenServices tokenServices = new DefaultTokenServices();
    //        tokenServices.setTokenStore(tokenStore);
    //        tokenServices.setSupportRefreshToken(true);
    //        tokenServices.setClientDetailsService(endpoints.getClientDetailsService());
    //        tokenServices.setTokenEnhancer(endpoints.getTokenEnhancer());
    //        tokenServices.setAccessTokenValiditySeconds((int) TimeUnit.DAYS.toSeconds(30)); // 30天
    
            endpoints.tokenServices(tokenServices());
        }
    
        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            //        oauthServer.checkTokenAccess("isAuthenticated()");
            oauthServer
                    .checkTokenAccess("permitAll()")
                    .tokenKeyAccess("permitAll()")
                    .allowFormAuthenticationForClients()
    //                .checkTokenAccess("isAuthenticated()")
    //        oauthServer.checkTokenAccess("permitAll()");
    //        oauthServer.allowFormAuthenticationForClients();
        }
    
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            PasswordEncoder encoder = passwordEncoder()
            clients.inMemory()
                    .withClient("dw").secret(encoder.encode("dwsecret"))
                    .authorizedGrantTypes("authorization_code","password").authorities("ROLE_USER")
                    .scopes("app")
                    .and()
                    .withClient("peixun").secret(encoder.encode("peixunsecret"))
                    .authorizedGrantTypes("authorization_code","password").authorities("ROLE_AMC,ROLE_USER,ROLE_ADMIN")
                    .scopes("app")
                    .and()
                    .withClient("biz").secret(encoder.encode("bizsecret"))
                    .authorizedGrantTypes("authorization_code","password").authorities("ROLE_AMC,ROLE_USER,ROLE_ADMIN")
                    .scopes("app")
        }
    }

其中的其他配置类为AuthProvider :

package com.ws.zuul
    
    import org.springframework.beans.factory.annotation.Autowired
    import org.springframework.beans.factory.annotation.Qualifier
    import org.springframework.security.authentication.AuthenticationProvider
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
    import org.springframework.security.core.Authentication
    import org.springframework.security.core.userdetails.UserDetailsService
    import org.springframework.security.crypto.password.PasswordEncoder
    import org.springframework.security.oauth2.provider.OAuth2Authentication
    import org.springframework.stereotype.Component
    
    import javax.naming.AuthenticationException
    
    /**
     * Created by songtao on 2018/3/26.
     */
    @Component
    class AuthProvider implements AuthenticationProvider{
        @Autowired
        @Qualifier("userDetailsService")
        UserDetailsService userDetailsService
    
        @Autowired
        PasswordEncoder passwordEncoder
    
        @Override
        Authentication authenticate(Authentication authentication) throws AuthenticationException {
            println "  "+authentication.getPrincipal()+"   "+authentication.getCredentials()+"        ===================================="
            def user = userDetailsService.loadUserByUsername(authentication.getPrincipal())
            if(!user){
                throw new AuthenticationException("no user found")
            }
    //        def flag = passwordEncoder().matches(authentication.getCredentials(),user.password)	//这里是原来的简单逻辑
    //下面是根据我们自己的业务需求写的认证方式
    
            def flag1 = (passwordEncoder.matches(authentication.getCredentials(),user.password))
            def flag2 = false
            if(authentication instanceof OAuth2Authentication){ //由微信等第三方登录时,由服务器端产生的authentication是这种形式的
                def auth = authentication as OAuth2Authentication
                String pass = auth.userAuthentication.getCredentials()
                flag2 = pass.equals(user.password)
            }
            def flag = (flag1 || flag2)
            if(!flag){
                throw new AuthenticationException("password error")
            }
    //        return new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), authentication.getCredentials(), user.authorities);
            return new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), user.password, user.authorities);
        }
    
        @Override
        boolean supports(Class<?> authentication) {
            return true
        }
    }

用户的认证的UserDetailService

package com.ws.zuul
    
    import com.ws.zuul.user.Role
    import com.ws.zuul.user.User
    import com.ws.zuul.user.oauth.ThirdOauth
    import org.springframework.security.core.GrantedAuthority
    import org.springframework.security.core.authority.SimpleGrantedAuthority
    import org.springframework.security.core.userdetails.UserDetails
    import org.springframework.security.core.userdetails.UserDetailsService
    import org.springframework.security.core.userdetails.UsernameNotFoundException
    import org.springframework.stereotype.Component
    import org.springframework.stereotype.Service
    
    /**
     * Created by songtao on 2018/3/26.
     */
    @Component
    @Service("userDetailsService")
    class CustomUserDetailService implements UserDetailsService{
    
        @Override
        UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            User user = User.findByUsernameOrMobileNumber(username,username)
            if(!user){
                def third = ThirdOauth.findAllByUnionid(username)
                if(third.size()==0){
                    throw new UsernameNotFoundException("user not found",username)
                }else{
                    user = third.user
                }
            }
            System.out.println("User : "+user);
            if(user==null){
                System.out.println("User not found");
                throw new UsernameNotFoundException("Username not found");
            }
            return new org.springframework.security.core.userdetails.User(user.username, user.password,
                    user.enabled, !user.accountExpired,!user.passwordExpired,!user.accountLocked, getGrantedAuthorities(user));
    
        }
    
        private List<GrantedAuthority> getGrantedAuthorities(User user){
            List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
    
            for(Role aut in user.authorities){
                authorities.add(new SimpleGrantedAuthority(aut.authority))
            }
            System.out.print("authorities :"+authorities);
            return authorities;
        }
    }

以及配置的sessionConfig是为了SpringCloud 的Session共享使用的,暂时还没用到,后续继续添加

package com.ws.zuul
    
    import org.springframework.context.annotation.Configuration
    import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession
    
    
    @Configuration
    @EnableRedisHttpSession(maxInactiveIntervalInSeconds = 86400)//1天
    class SessionConfig {
        /**
         * 还有一个比较大的坑，使用Spring Session实际是Spring加入了一个Filter，
         * 其本质是：对每一个请求的request都会被DelegatingFilterProxy进行了一次封装。
         * 那么，在Controller里面拿出的request实际上是封装后的request，因为Session要存在Session，
         * 所以调用request.getSession()的时候，实际上拿到是Spring封装后的session ，
         * 因此对于request实际上拿到是Spring封装后的request。那么可能会导致Request.getInputStream无法获取到流数据，
         * 对于使用raw格式，即非Key,Value参数的提交 会被Spring-Session获取，当contentType为application/x-www-form-urlencoded时，
         * 就会被解析成Paramater，从而导致request.getInputStream的数据再获取时为空了。
         * 还有就是Controller里如果用到了request.setCharacterEncoding("GBK");
         * 设置字符集，这样的请求也无法生效，因为request.setCharacterEncoding只有在request.getSession或者request.getParamater之前使用有效，
         * 而由于使用Spring Session加入了filter,所以Controller里的request.setCharacterEncoding这种方式转编码就失效了，
         * 解决办法，可以是new String(request.getParameter(key).getBytes(), "GBK")，获取到参数后转码
         *
         */
    
        /**
         * session的实现5种方式 :
         *  1.粘性session  -> 服务器(tomcat中存储session)
         *  2.session复制 -> tomcat发送到其他的tomcat
         *  3.session共享 -> 1.粘性(缓存中备份) 2.非粘性(只在缓存中存储session)
         *  4.session持久化到数据库
         *  5.terracotta实现session复制 原理是只复制改变的session对应的tomcat的session 是对2的优化.
         */
    }

ZuulApplication的运行为:

@SpringBootApplication
    @EnableZuulProxy
    @EnableEurekaClient
    class ZuulApplication {
    	...
    }

以上,就能配置一个Eureka集成Spring Cloud Security 以及Zuul做网关和认证中心的微服务了.