单点登录解决方案

  
   单点登录主要问题在于多台服务器集群时，用户登录身份信息在每台服务器上是否能够保证都存在或者进行身份识别。
常用一下三种方式解决：
1、tomcat session 复制（服务器集群数量很多时，服务器之间相互复制，性能开销很大）

2、spring session session共享（有状态服务）

<!-- spring session的过滤器配置，注意此过滤器必须放在其他过滤器之前 -->
	<filter>
		<filter-name>springSessionRepositoryFilter</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>springSessionRepositoryFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

<bean class="org.springframework.scheduling.concurrent.ConcurrentTaskScheduler"></bean>
	<bean id="jedisPoolConfig" class="redis.clients.jedis.JedisPoolConfig">
		<property name="maxIdle" value="10" />
		<property name="maxTotal" value="20" />
		<property name="blockWhenExhausted" value="true" />
		<property name="maxWaitMillis" value="1000" />
		<property name="testOnBorrow" value="true" />
	</bean>
	<bean id="jedisConnectionFactory"
		class="org.springframework.data.redis.connection.jedis.JedisConnectionFactory"
		p:host-name="192.168.126.11" p:port="6379" p:password="" p:usePool="true"
		p:pool-config-ref="jedisPoolConfig">
	</bean>
	<bean
		class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration">
		<property name="maxInactiveIntervalInSeconds" value="30"></property>
	</bean>

<dependency>
			<groupId>redis.clients</groupId>
			<artifactId>jedis</artifactId>
			<version>2.9.0</version>
		</dependency>

		<dependency>
			<groupId>org.springframework.session</groupId>
			<artifactId>spring-session-data-redis</artifactId>
			<version>2.0.1.RELEASE</version>
		</dependency>
		<dependency>
			<groupId>org.apache.commons</groupId>
			<artifactId>commons-pool2</artifactId>
			<version>2.4.2</version>
		</dependency>

import javax.servlet.http.HttpServletRequest;

import org.springframework.data.repository.query.Param;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;

@Controller
public class IndexController {
	
	@RequestMapping("/index")
	@ResponseBody
	public String index(HttpServletRequest request,@Param(value = "name") String name,@Param(value = "password") String password) {
		request.getSession().setAttribute(name, password);
		return "success";
	}
	
	@GetMapping("/getPassword")
	@ResponseBody
	public String getPassword(HttpServletRequest request,@Param(value = "name") String name) {
		return String.valueOf(request.getSession().getAttribute(name));
	}
}

3、jwt （JSON Web Token）（无状态服务，分布式系统中常用方案）

<dependency>
			<groupId>com.auth0</groupId>
			<artifactId>java-jwt</artifactId>
			<version>3.4.0</version>
		</dependency>

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.gupao.model.User;

public class JwtTokenUtils {
	public static String getToken(User user) {
		String token=JWT.create().withAudience(user.getId()+"").sign(Algorithm.HMAC256(user.getPassword()));
		return token;
	}
	
	
}

import java.lang.reflect.Method;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.gupao.controller.BaseController;
import com.gupao.jwt.PassToken;
import com.gupao.jwt.UserLoginToken;
import com.gupao.model.User;
import com.gupao.service.UserService;

public class TokenInterceptor implements HandlerInterceptor {
	
	@Autowired
	UserService userService;

	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
			throws Exception {
		String token = request.getHeader("token");
		
		if (!(handler instanceof HandlerMethod)) {
			return true;
		}
		
		HandlerMethod handlerMethod = (HandlerMethod) handler;
		Method method = handlerMethod.getMethod();
		
		if (method.isAnnotationPresent(PassToken.class)) {
			PassToken passToken = method.getAnnotation(PassToken.class);
			if (passToken.required()) {
				return true;
			}
		}
		
//		if(method.isAnnotationPresent(UserLoginToken.class)) {
//			UserLoginToken userLoginToken=method.getAnnotation(UserLoginToken.class);
//			if(userLoginToken.required()) {
				if(token==null) {
					throw new RuntimeException("无token,请重新登录！");
				}
				String uid=JWT.decode(token).getAudience().get(0);
				Integer userId=Integer.valueOf(uid);
				User user=userService.findUserById(userId);
				
				if(user==null) {
					throw new RuntimeException("用户不存在！");
				}
				
				JWTVerifier verifier=JWT.require(Algorithm.HMAC256(user.getPassword())).build();
				
				try {
					verifier.verify(token);
					Object bean=handlerMethod.getBean();
					if(bean instanceof BaseController) {
						BaseController baseController=(BaseController) bean;
						baseController.setUid(user.getId()+"");
					}
				} catch (Exception e) {
					throw new RuntimeException("401");
				}
				return true;
//			}
//		}
		
//		return true;
	}

	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
			ModelAndView modelAndView) throws Exception {
	}

	public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
			throws Exception {
	}

}

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;


@Target({ElementType.METHOD,ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface PassToken {
	boolean required() default true; 
}