基于springboot和redis实现的单点登录

1、pom.xml配置

server:
  port: 8888
spring:
  datasource:
    url: jdbc:mysql://127.0.0.1:3306/users?useSSL=false&serverTimezone=GMT%2B8
    username: root
    password: sasa
    driver-class-name: com.mysql.cj.jdbc.Driver
  jpa:
    show-sql: true
    database: mysql
    hibernate:
      ddl-auto: update
      naming:
        implicit-strategy: org.hibernate.boot.model.naming.ImplicitNamingStrategyComponentPathImpl
        physical-strategy: org.hibernate.boot.model.naming.PhysicalNamingStrategyStandardImpl
  redis:
    host: 122.51.85.243
    port: 6379
    password:
    jedis:
      pool:
        max-total: 200
  main:
    allow-bean-definition-overriding: true

2、实体类

package com.xkxx.sso.pojo;

import lombok.Data;

import javax.persistence.*;

@Data
@Entity
@Table(name = "user")
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Column(name = "id")
    private Integer id;
    @Column(name = "userName")
    private String userName;
    @Column(name = "password")
    private String password;

}

3、编写Dao，UserDao.class

public interface UserDao extends JpaRepository<User,Integer> {
   public User findByUsernameAndPassword(String username, String password);
}

4、编写serviceImpl,UserServiceImpl.class进行登录的业务逻辑处理

@Service
public class UserServiceImpl{
    @Autowired
    private UserDao userDao;
    @Autowired
    private JedisDao jedisDao;
    @Value("${REDIS_KEY}")   //从配置文件中取值
    private String KEY;

    private Map<Integer,String> UserLogin = new HashMap<>();

    /**
     * 登录
     * @param request
     * @param response
     * @param u
     * @return
     */
    public User userlogin(HttpServletRequest request, HttpServletResponse response, User u){
        //查询登录是否成功
        User user=userDao.findByUsernameAndPassword(u.getUsername(),u.getPassword());
        //判断us是否为空
        if(user==null){
            return null;
        }
        //生成token
        String token="user_"+ UUID.randomUUID().toString();
        //从map中获得redis中的key
        String oldToken = UserLogin.get(user.getId());
        //判断map中是否存在该id
        if(!StringUtils.isEmpty(oldToken)){
            //删除redis中老的值
            jedisDao.delValue(oldToken);
        }
        //将新的的key保存到map中
        UserLogin.put(user.getId(),token);
        //将信息存入redis
        jedisDao.setValue(token, JsonUtils.objectToJson(user));
        //将token放入cookie中
        CookieUtils.setCookie(request,response,KEY,token,5*60,true);
        return user;
    }

    /**
     * 判断是否登录
     * @param response
     * @param request
     * @return
     */
    public String getUserByToken(HttpServletResponse response, HttpServletRequest request) {
        //从cookie中取出用户token
        String token=CookieUtils.getCookieValue(request,KEY);
        //从redis中取出用户信息
        String user= jedisDao.getValue(token);
        return user;
    }
}

5、编写controller，接收前端请求，返回数据

@RestController
public class LoginController {

    @Autowired
    private UserServiceImpl userService;

    /**
     * 登录
     * @param response
     * @param request
     * @param user
     * @param model
     * @return
     */
    @PostMapping("/login")
    public ResponseResult Login(HttpServletResponse response , HttpServletRequest request, @RequestBody User user, Model model){
        ResponseResult responseResult=new ResponseResult();
        try {
            User user2 = userService.userlogin(request, response, user);
            if (user2!=null){
                responseResult.setState(200);
                responseResult.setMsg("登录成功！");
                return responseResult;
            }else{
                responseResult.setState(202);
                responseResult.setMsg("用户名或密码错误！");
                return responseResult;
            }
        }catch (Exception e) {
            responseResult.setState(500);
            responseResult.setMsg("发生错误，登录失败！");
            return responseResult;
        }
    }

    /**
     * 判断是否登录
     * @param response
     * @param request
     * @return
     * @throws Exception
     */
    @GetMapping("/toLogin")
    public ResponseResult getUserInfo(HttpServletResponse response , HttpServletRequest request) throws Exception {
        ResponseResult responseResult=new ResponseResult();
        try{
            String token = userService.getUserByToken(response, request);
            if(token!=null){
                responseResult.setState(200);
                responseResult.setMsg("登录中！");
                return responseResult;
            }else{
                responseResult.setState(202);
                responseResult.setMsg("在别处登录！");
                return responseResult;
            }
        }catch (Exception e){
            response.setStatus(500);
            responseResult.setMsg("发生错误！");
            return responseResult;
        }
    }
}

方法二

1、具体的加密和解密方法

package com.example.demo.util;

import com.google.common.base.Strings;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.spec.SecretKeySpec;
import java.security.SecureRandom;

/**
 * Create by zhuenbang on 2018/12/3 11:27
 */
public class AESUtil {
    private static final String defaultKey = "7bf72345-6266-4381-a4d3-988754c5f9d1";
    /** 
    * @Description: 加密
    * @Param:  
    * @returns: java.lang.String 
    * @Author: zhuenbang
    * @Date: 2018/12/3 11:33
    */
    public static String encryptByDefaultKey(String content) throws Exception {
        return encrypt(content, defaultKey);
    }

    
    /** 
    * @Description: 解密 
    * @Param:  
    * @returns: java.lang.String 
    * @Author: zhuenbang
    * @Date: 2018/12/3 11:30
    */
    public static String decryptByDefaultKey(String encryptStr) throws Exception {
        return decrypt(encryptStr, defaultKey);
    }

    /**
     * AES加密为base 64 code
     *
     * @param content    待加密的内容
     * @param encryptKey 加***
     * @return 加密后的base 64 code
     * @throws Exception
     */

    public static String encrypt(String content, String encryptKey) throws Exception {
        return base64Encode(aesEncryptToBytes(content, encryptKey));

    }

    /**
     * AES加密
     *
     * @param content    待加密的内容
     * @param encryptKey 加***
     * @return 加密后的byte[]
     * @throws Exception
     */

    private static byte[] aesEncryptToBytes(String content, String encryptKey) throws Exception {

        KeyGenerator kgen = KeyGenerator.getInstance("AES");

        SecureRandom random;
        if (System.getProperty("os.name").toLowerCase().contains("linux")) {
            random = SecureRandom.getInstance("SHA1PRNG");
        } else {
            random = new SecureRandom();
        }

        random.setSeed(encryptKey.getBytes());
        kgen.init(128, random);

        Cipher cipher = Cipher.getInstance("AES");

        cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(kgen.generateKey().getEncoded(), "AES"));


        return cipher.doFinal(content.getBytes("utf-8"));

    }

    /**
     * base 64 加密
     *
     * @param bytes 待编码的byte[]
     * @return 编码后的base 64 code
     */

    private static String base64Encode(byte[] bytes) {

        return new BASE64Encoder().encode(bytes);

    }
    
    /**
     * 将base 64 code AES解密
     *
     * @param encryptStr 待解密的base 64 code
     * @param decryptKey 解***
     * @return 解密后的string
     * @throws Exception
     */

    public static String decrypt(String encryptStr, String decryptKey) throws Exception {

        return Strings.isNullOrEmpty(encryptStr) ? null : aesDecryptByBytes(base64Decode(encryptStr), decryptKey);

    }
    
    /**
     * AES解密
     *
     * @param encryptBytes 待解密的byte[]
     * @param decryptKey   解***
     * @return 解密后的String
     * @throws Exception
     */
    private static String aesDecryptByBytes(byte[] encryptBytes, String decryptKey) throws Exception {

        KeyGenerator kgen = KeyGenerator.getInstance("AES");

        SecureRandom random;
        if (System.getProperty("os.name").toLowerCase().contains("linux")) {
            random = SecureRandom.getInstance("SHA1PRNG");
        } else {
            random = new SecureRandom();
        }
        random.setSeed(decryptKey.getBytes());

        kgen.init(128, random);


        Cipher cipher = Cipher.getInstance("AES");

        cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(kgen.generateKey().getEncoded(), "AES"));

        byte[] decryptBytes = cipher.doFinal(encryptBytes);


        return new String(decryptBytes);

    }

    /**
     * base 64 解密
     *
     * @param base64Code 待解码的base 64 code
     * @return 解码后的byte[]
     * @throws Exception
     */

    private static byte[] base64Decode(String base64Code) throws Exception {

        return Strings.isNullOrEmpty(base64Code) ? null : new BASE64Decoder().decodeBuffer(base64Code);

    }
}

4、这里获取的token很关键，每次登录都要生成新的token,token是根据userId和当前时间戳加密的

@Override
    public String getToken(String userId) throws Exception {
        String token = AESUtil.encryptByDefaultKey(Joiner.on("_").join(userId, System.currentTimeMillis()));
        logger.debugv("token= {0}", token);
        redisService.set(UserKey.userAccessKey, userId, token);
        return token;
    }

2、这里获取的token很关键，每次登录都要生成新的token,token是根据userId和当前时间戳加密的

@Override
 public String getToken(String userId) throws Exception {
 String token = AESUtil.encryptByDefaultKey(Joiner.on("_").join(userId, System.currentTimeMillis()));
 logger.debugv("token= {0}", token);
 redisService.set(UserKey.userAccessKey, userId, token);
 return token;
 }

3、写一个解密的方法，解密把用户id拿出来，然后从拦截器里拿出token和当前登录token做对比

 @Override
    public String checkToken(String token) throws Exception {
        String userId = AESUtil.decryptByDefaultKey(token).split("_")[0];
        String currentToken = redisService.get(UserKey.userAccessKey, userId, String.class);
        logger.debugv("currentToken={0}", currentToken);
        if (StringUtils.isEmpty(currentToken)) {
            return null;
        }
        if (!token.equals(currentToken)) {
            return null;
        }
        return userId;
    }

4、拦截器里具体处理，这里采用注解拦截，当controller有@Secured拦截器才拦截

	@Autowired
    AuthTokenService authTokenService;
	@Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        if (handler instanceof HandlerMethod) {
            HandlerMethod hm = (HandlerMethod) handler;
            Secured secured = hm.getMethodAnnotation(Secured.class);
            if (secured != null) {
                String authToken = request.getHeader(UserConstant.USER_TOKEN);
                if (StringUtils.isEmpty(authToken)) {
                    render(response, CodeMsg.REQUEST_ILLEGAL);
                    return false;
                }
                String userId = authTokenService.checkToken(authToken);
                if (StringUtils.isEmpty(userId)) {
                    render(response, CodeMsg.LOGIN_FAILURE);
                    return false;
                }
            }
            return true;
        }
        return true;
    }



private void render(HttpServletResponse response, CodeMsg cm) throws Exception {
        response.setContentType("application/json;charset=UTF-8");
        OutputStream out = response.getOutputStream();
        String str = JSON.toJSONString(Result.error(cm));
        out.write(str.getBytes("UTF-8"));
        out.flush();
        out.close();
    }

5、写一个测试登录接口和一个测试单点登录接口

 /** 
    * @Description: 模拟登录 
    * @Param:  
    * @returns: com.example.demo.result.Result 
    * @Author: zhuenbang
    * @Date: 2018/12/3 12:05
    */
    @GetMapping("/login")
    public Result login() throws Exception {
        return authTokenService.login();
    }
    
    
    /** 
    * @Description: 模拟单点登录 @Secured这个方法拦截器会拦截
    * @Param:  
    * @returns: com.example.demo.result.Result 
    * @Author: zhuenbang
    * @Date: 2018/12/3 12:35
    */
    @Secured
    @GetMapping("/testSSO")
    public Result testSSO() {
        return authTokenService.testSSO();
    }

	具体的实现
	@Override
    public Result login() throws Exception {
        String userId = "123456";
        return Result.success(this.getToken(userId));
    }

    @Override
    public Result testSSO() {
        return Result.success("登录状态正常");
    }

postman 测试

单点登录测试

再次请求登录接口，然后不改变token接口如图

这个方式实现单点登录的关键就是根据userId的加密和解密的实现。
github地址：https://github.com/zhuenbang/demo.git