经验首页 前端设计 程序设计 Java相关 移动开发 数据库/运维 软件/图像 大数据/云计算 其他经验
当前位置：技术经验 » Java相关 » Scala » 查看文章
Akka-CQRS（14）- Http标准安全解决方案：OAuth2-资源使用授权
来源：cnblogs　　作者：雪川大虫　　时间：2019/7/5 9:16:44　　对本文有异议

   上一篇讨论了SSL/TLS安全连接，主要是一套在通信层面的数据加密解决方案。但我们更需要一套方案来验证客户端。要把不能通过验证的网络请求过滤掉。

OAuth2是一套行业标准的网络资源使用授权协议，也就是为用户提供一种授权凭证，用户凭授权凭证来使用网络资源。申请凭证、然后使用凭证进行网络操作流程如下：

 

??

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

实际上OAuth2是一套3方授权模式，但我们只需要资源管理方授权，所以划去了1、2两个步骤。剩下的两个步骤，包括：申请令牌，使用令牌，这些在官方文件中有详细描述。用户身份和令牌的传递是通过Http Header实现的，具体情况可参考RFC2617,RFC6750

简单来说：用户向服务器提交身份信息申请令牌，下面是一个HttpRequest样例：

  1. POST /token HTTP/1.1
  2. Host: server.example.com
  3. Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW   
  4. Content-Type: application/x-www-form-urlencoded

上面Basic后面一串代码就是 user+password的加密文，它的产生方法示范如下：

  1. final case class BasicHttpCredentials(username: String, password: String) extends jm.headers.BasicHttpCredentials {
  2.   val cookie = {
  3.     val userPass = username + ':' + password
  4.     val bytes = userPass.getBytes(`UTF-8`.nioCharset)
  5.     Base64.rfc2045.encodeToChar(bytes, false)
  6.   }
  7.   def render[R <: Rendering](r: R): r.type = r ~~ "Basic " ~~ cookie
  9.   override def scheme: String = "Basic"
  10.   override def token: String = String.valueOf(cookie)
  11.   override def params: Map[String, String] = Map.empty
  12. }

注：在OAuth2版本中如果使用https://，则容许明文用户和密码。

服务端在返回的HttpResponse中返回令牌access_token:

  1. {"access_token":"2e510027-0eb9-4367-b310-68e1bab9dc3d", "token_type":"bearer", "expires_in":3600}

注意：这个expires_in是应用系统自定义内部使用的参数，也就是说应用系统必须自备令牌过期失效处理机制。

得到令牌后每个使用网络资源的Request都必须在Authorization类Header里附带这个令牌，如：

  1.    GET /resource HTTP/1.1
  2.    Host: server.example.com
  3.    Authorization: Bearer 2e510027-0eb9-4367-b310-68e1bab9dc3d

Bearer后就是服务端返回的令牌值。我们还是设计一个例子来示范整个授权使用过程。先看看下面一些基本操作代码：

  1. object JsonMarshaller extends  SprayJsonSupport with DefaultJsonProtocol {
  3.   case class UserInfo(username: String, password: String)
  5.   case class AuthToken(access_token: String = java.util.UUID.randomUUID().toString,
  6.                         token_type: String = "bearer",
  7.                         expires_in: Int = 3600)
  9.   case class AuthUser(credentials: UserInfo,
  10.                       token: AuthToken = new AuthToken(expires_in = 60 * 60 * 8),
  11.                           loggedInAt: String = LocalDateTime.now().toString)
  13.    val validUsers = Seq(UserInfo("johnny", "p4ssw0rd"),UserInfo("tiger", "secret"))
  14.    val loggedInUsers = mutable.ArrayBuffer.empty[AuthUser]
  16.    def getValidUser(credentials: Credentials): Option[UserInfo] =
  17.     credentials match {
  18.       case p @ Credentials.Provided(_) =>
  19.         validUsers.find(user => user.username == p.identifier && p.verify(user.password))
  20.       case _ => None
  21.     }
  23.    def authenticateUser(credentials: Credentials): Option[AuthUser] =
  24.     credentials match {
  25.       case p @ Credentials.Provided(_) =>
  26.         loggedInUsers.find(user => p.verify(user.token.access_token))
  27.       case _ => None
  28.     }
  30.   implicit val fmtCredentials = jsonFormat2(UserInfo.apply)
  31.   implicit val fmtToken = jsonFormat3(AuthToken.apply)
  32.   implicit val fmtUser = jsonFormat3(AuthUser.apply)
  33. }

validUers: Seq[UserInfo] 模拟是个在服务端数据库里的用户登记表，loggedInUsers是一个已经通过验证的用户请单。函数 getValidUser(credentials: Credentials) 用传人参数Credentials来获取用户信息Option[UserInfo]。Credentials是这样定义的：

  1. object Credentials {
  2.   case object Missing extends Credentials
  3.   abstract case class Provided(identifier: String) extends Credentials {
  5.     /**
  6.      * First applies the passed in `hasher` function to the received secret part of the Credentials
  7.      * and then safely compares the passed in `secret` with the hashed received secret.
  8.      * This method can be used if the secret is not stored in plain text.
  9.      * Use of this method instead of manual String equality testing is recommended in order to guard against timing attacks.
  10.      *
  11.      * See also [[EnhancedString#secure_==]], for more information.
  12.      */
  13.     def verify(secret: String, hasher: String ? String): Boolean
  15.     /**
  16.      * Safely compares the passed in `secret` with the received secret part of the Credentials.
  17.      * Use of this method instead of manual String equality testing is recommended in order to guard against timing attacks.
  18.      *
  19.      * See also [[EnhancedString#secure_==]], for more information.
  20.      */
  21.     def verify(secret: String): Boolean = verify(secret, x ? x)
  22.   }
  24.   def apply(cred: Option[HttpCredentials]): Credentials = {
  25.     cred match {
  26.       case Some(BasicHttpCredentials(username, receivedSecret)) ?
  27.         new Credentials.Provided(username) {
  28.           def verify(secret: String, hasher: String ? String): Boolean = secret secure_== hasher(receivedSecret)
  29.         }
  30.       case Some(OAuth2BearerToken(token)) ?
  31.         new Credentials.Provided(token) {
  32.           def verify(secret: String, hasher: String ? String): Boolean = secret secure_== hasher(token)
  33.         }
  34.       case Some(GenericHttpCredentials(scheme, token, params)) ?
  35.         throw new UnsupportedOperationException("cannot verify generic HTTP credentials")
  36.       case None ? Credentials.Missing
  37.     }
  38.   }
  39. }

在apply函数里定义了verify函数功能。这个时候Credentials的实际类型是BasicHttpCredentials。另一个函数authenticateUser(credentials: Credentials)是用Crentials来验证令牌的，那么它的类型应该是OAuth2BearerToken了，具体验证令牌的过程是从loggedInUser清单里对比找出拥有相同令牌的用户。这就意味着每次一个用户通过验证获取令牌后服务端必须把用户信息和令牌值保存起来方便以后对比。我们再来看看route的定义：

  1.   val route =
  2.     pathEndOrSingleSlash {
  3.       get {
  4.         complete("Welcome!")
  5.       }
  6.     } ~
  7.       path("auth") {
  8.         authenticateBasic(realm = "auth", getValidUser) { user =>
  9.           post {
  10.             val loggedInUser = AuthUser(user)
  11.             loggedInUsers.append(loggedInUser)
  12.             complete(loggedInUser.token)
  13.           }
  14.         }
  15.       } ~
  16.       path("api") {
  17.         authenticateOAuth2(realm = "api", authenticateUser) { validToken =>
  18.           complete(s"It worked! user = $validToken")
  19.         }
  20.       }

现在这段代码就比较容易理解了：authenticateBasic(realm = "auth", getValidUser) {user => ...} 用上了自定义的geValidUser来产生user对象。而authenticateOAuth2(realm = "api", authenticateUser) { validToken =>...}则用了自定义的authenticateUser函数来验证令牌。

下面我们写一段客户端代码来测试上面这个webserver的功能：

  1. import akka.actor._
  2. import akka.stream._
  3. import akka.http.scaladsl.Http
  4. import akka.http.scaladsl.model.headers._
  5. import scala.concurrent._
  6. import akka.http.scaladsl.model._
  7. import org.json4s._
  8. import org.json4s.jackson.JsonMethods._
  9. import scala.concurrent.duration._
  11. object Oauth2Client  {
  12.     def main(args: Array[String]): Unit = {
  13.       implicit val system = ActorSystem()
  14.       implicit val materializer = ActorMaterializer()
  15.       // needed for the future flatMap/onComplete in the end
  16.       implicit val executionContext = system.dispatcher
  18.       val helloRequest = HttpRequest(uri = "http://192.168.11.189:50081/")
  20.       val authorization = headers.Authorization(BasicHttpCredentials("johnny", "p4ssw0rd"))
  21.       val authRequest = HttpRequest(
  22.         HttpMethods.POST,
  23.         uri = "http://192.168.11.189:50081/auth",
  24.         headers = List(authorization)
  25.       )
  27.       val futToken: Future[HttpResponse] = Http().singleRequest(authRequest)
  29.       val respToken = for {
  30.         resp <- futToken
  31.         jstr <- resp.entity.dataBytes.runFold("") {(s,b) => s + b.utf8String}
  32.       } yield jstr
  34.       val jstr =  Await.result[String](respToken,2 seconds)
  35.       println(jstr)
  37.       val token = (parse(jstr).asInstanceOf[JObject] \ "access_token").values
  38.       println(token)
  41.       val authentication = headers.Authorization(OAuth2BearerToken(token.toString))
  42.       val apiRequest = HttpRequest(
  43.         HttpMethods.POST,
  44.         uri = "http://192.168.11.189:50081/api",
  45.       ).addHeader(authentication)
  47.       val futAuth: Future[HttpResponse] = Http().singleRequest(apiRequest)
  49.       println(Await.result(futAuth,2 seconds))
  52.       scala.io.StdIn.readLine()
  53.       system.terminate()
  54.     }
  56.   }

测试显示结果如下：

  1. {"access_token":"6280dcd7-71fe-4203-8163-8ac7dbd5450b","expires_in":28800,"token_type":"bearer"}
  2. 6280dcd7-71fe-4203-8163-8ac7dbd5450b
  3. HttpResponse(200 OK,List(Server: akka-http/10.1.8, Date: Wed, 03 Jul 2019 09:32:32 GMT),HttpEntity.Strict(text/plain; charset=UTF-8,It worked! user = AuthUser(UserInfo(johnny,p4ssw0rd),AuthToken(6280dcd7-71fe-4203-8163-8ac7dbd5450b,bearer,28800),2019-07-03T17:32:32.627)),HttpProtocol(HTTP/1.1))

下面是服务端源代码：

build.sbt

 

  1. name := "oauth2"
  3. version := "0.1"
  5. scalaVersion := "2.12.8"
  7. libraryDependencies ++= Seq(
  8.   "com.typesafe.akka" %% "akka-http"   % "10.1.8",
  9.   "com.typesafe.akka" %% "akka-stream" % "2.5.23",
  10.   "com.pauldijou" %% "jwt-core" % "3.0.1",
  11.   "de.heikoseeberger" %% "akka-http-json4s" % "1.22.0",
  12.   "org.json4s" %% "json4s-native" % "3.6.1",
  13.   "com.typesafe.akka" %% "akka-http-spray-json" % "10.1.8",
  14.   "com.typesafe.scala-logging" %% "scala-logging" % "3.9.0",
  15.   "org.slf4j" % "slf4j-simple" % "1.7.25",
  16.   "org.json4s" %% "json4s-jackson" % "3.6.7"
  17. )

 

OAuth2Server.scala

  1. import akka.actor._
  2. import akka.stream._
  3. import akka.http.scaladsl.Http
  4. import akka.http.scaladsl.server.Directives._
  5. import akka.http.scaladsl.server.directives.Credentials
  6. import java.time.LocalDateTime
  7. import scala.collection.mutable
  9. import akka.http.scaladsl.marshallers.sprayjson._
  10. import spray.json._
  12. object JsonMarshaller extends  SprayJsonSupport with DefaultJsonProtocol {
  14.   case class UserInfo(username: String, password: String)
  16.   case class AuthToken(access_token: String = java.util.UUID.randomUUID().toString,
  17.                         token_type: String = "bearer",
  18.                         expires_in: Int = 3600)
  20.   case class AuthUser(credentials: UserInfo,
  21.                       token: AuthToken = new AuthToken(expires_in = 60 * 60 * 8),
  22.                           loggedInAt: String = LocalDateTime.now().toString)
  24.    val validUsers = Seq(UserInfo("johnny", "p4ssw0rd"),UserInfo("tiger", "secret"))
  25.    val loggedInUsers = mutable.ArrayBuffer.empty[AuthUser]
  27.    def getValidUser(credentials: Credentials): Option[UserInfo] =
  28.     credentials match {
  29.       case p @ Credentials.Provided(_) =>
  30.         validUsers.find(user => user.username == p.identifier && p.verify(user.password))
  31.       case _ => None
  32.     }
  34.    def authenticateUser(credentials: Credentials): Option[AuthUser] =
  35.     credentials match {
  36.       case p @ Credentials.Provided(_) =>
  37.         loggedInUsers.find(user => p.verify(user.token.access_token))
  38.       case _ => None
  39.     }
  41.   implicit val fmtCredentials = jsonFormat2(UserInfo.apply)
  42.   implicit val fmtToken = jsonFormat3(AuthToken.apply)
  43.   implicit val fmtUser = jsonFormat3(AuthUser.apply)
  44. }
  47. object Oauth2ServerDemo extends App {
  49.   implicit val httpSys = ActorSystem("httpSystem")
  50.   implicit val httpMat = ActorMaterializer()
  51.   implicit val httpEC = httpSys.dispatcher
  54.   import JsonMarshaller._
  57.   val route =
  58.     pathEndOrSingleSlash {
  59.       get {
  60.         complete("Welcome!")
  61.       }
  62.     } ~
  63.       path("auth") {
  64.         authenticateBasic(realm = "auth", getValidUser) { user =>
  65.           post {
  66.             val loggedInUser = AuthUser(user)
  67.             loggedInUsers.append(loggedInUser)
  68.             complete(loggedInUser.token)
  69.           }
  70.         }
  71.       } ~
  72.       path("api") {
  73.         authenticateOAuth2(realm = "api", authenticateUser) { validToken =>
  74.           complete(s"It worked! user = $validToken")
  75.         }
  76.       }
  79.   val (port, host) = (50081,"192.168.11.189")
  81.   val bindingFuture = Http().bindAndHandle(route,host,port)
  83.   println(s"Server running at $host $port. Press any key to exit ...")
  85.   scala.io.StdIn.readLine()
  88.   bindingFuture.flatMap(_.unbind())
  89.     .onComplete(_ => httpSys.terminate())
  92. }

 

原文链接：http://www.cnblogs.com/tiger-xc/p/11132207.html

 友情链接：直通硅谷 　点职佳 　北美留学生论坛

Scala热门文章

  • scala (3) Function 和 Method
  • flink 两个datastream实现left_join的两种方法
  • scala case class + BeanProperty+fastjson 快速实现类的序列化与反序列化
  • Scala解析MDF文件
  • flink 如何实现对watermark 的checkpoint,防止数据复写
  • Spark笔记(一):错误总结
  • 踩坑 scala 打包上传 找不到类
  • akka-typed(2) - typed-actor交流方式和交流协议
  • Scala(二)：元组、数组、映射
  • scala 命名规范

    • Scala推荐文章

  • Scala中Array和List的区别说明
  • alpakka-kafka(5)-kafka集群配置与分布式应用部署
  • alpakka-kafka(2)-consumer
  • alpakka-kafka(1)-producer
  • akka-typed(1) - actor生命周期管理
  • akka-typed(2) - typed-actor交流方式和交流协议
  • akka-typed(3) - PersistentActor has EventSourcedBehavior
  • akka-typed(4) - EventSourcedBehavior in action
  • kka-typed(5) - cluster：集群节点状态监视
  • akka-typed(6) - cluster：group router, cluster-load-balancing

    • 本站QQ群：前端 618073944 | Java 606181507 | Python 626812652 | C/C++ 612253063 | 微信 634508462 | 苹果 692586424 | C#/.net 182808419 | PHP 305140648 | 运维 608723728

    W3xue 的所有内容仅供测试，对任何法律问题及风险不承担任何责任。通过使用本站内容随之而来的风险与本站无关。
    关于我们  |  意见建议  |  捐助我们  |  报错有奖  |  广告合作、友情链接（目前9元/月）请联系QQ：27243702 沸活量
    皖ICP备17017327号-2　皖公网安备34020702000426号