Java 中基于角色的静谧端点的身份验证

Question

我正在尝试实现某种基于角色的身份验证。我正在使用 JWT 令牌。我一直在看指南，但都提到了“弹簧靴”的使用。如何在 Java 中对我的宁静端点设置基于角色的身份验证？最好通过某种过滤器。

我正在寻找一种简单地添加的方法：在端点之前。@Role(Role.ADMIN)

我已经设置了以下类：

枚举角色：

public enum Role {

    User,

    Admin

}

简单的智威汤逊令牌：

{

 "sub": "users/TzMUocMF4p",

 "exp": 1554646441,

 "username": "[e-mail]",

 "ID": 6,

 "Role": "Admin",

 "iat": 1554641041

}

简单 CRUD 端点

@Path("User")

public class UserResource {

   @EJB

   private UserDAO userappDAO;

   @GET

   @JWTTokenNeeded

   @Produces("application/json")

   public List<Userapp> all() {

       return userappDAO.getAll();

   }

}

JWT 验证 （） 类如下：@JWTTokenNeeded

@javax.ws.rs.NameBinding

@Retention(RUNTIME)

@Target({TYPE, METHOD})

public @interface JWTTokenNeeded {

}

实际过滤器：

@Provider

@JWTTokenNeeded

@Priority(Priorities.AUTHENTICATION)

public class JWTTokenNeededFilter implements ContainerRequestFilter {

    @Override

    public void filter(ContainerRequestContext requestContext) throws IOException {

// Get the HTTP Authorization header from the request

String authorizationHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);

try {

    // Extract the token from the HTTP Authorization header

    String token = authorizationHeader.substring("Bearer".length()).trim();

    // Validate the token

    Jwts.parser().setSigningKey("MYSECRET".getBytes("UTF-8")).parseClaimsJws(token);

}

catch (Exception e) {

    requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());

}

}

}

如果用户未获得授权，我想通过以下方式退出：requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());

如果用户已获得授权，则端点必须执行该操作。

Answer 1

我找到了一个可行的解决方案。它包括向接口和类添加几行。@JWTTokenNeededJWTTokenNeededFilter我最终得到了以下代码：JWTTokenNeedFilter：@Provider@JWTTokenNeeded@Priority(Priorities.AUTHENTICATION)public class JWTTokenNeededFilter implements ContainerRequestFilter {&nbsp; &nbsp; @Context&nbsp; &nbsp; private ResourceInfo resourceInfo;&nbsp; &nbsp; @Override&nbsp; &nbsp; public void filter(ContainerRequestContext requestContext) throws IOException {&nbsp; &nbsp; &nbsp; &nbsp; // Get the HTTP Authorization header from the request&nbsp; &nbsp; &nbsp; &nbsp; String authorizationHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);&nbsp; &nbsp; &nbsp; &nbsp; try {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Extract the token from the HTTP Authorization header&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String token = authorizationHeader.substring("Bearer".length()).trim();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Validate the token&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Claims claims =&nbsp; Jwts.parser().setSigningKey("MYSECRET".getBytes("UTF-8")).parseClaimsJws(token).getBody();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Method method =resourceInfo.getResourceMethod();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if( method != null){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Get allowed permission on method&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JWTTokenNeeded JWTContext = method.getAnnotation(JWTTokenNeeded.class);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Role permission =&nbsp; JWTContext.Permissions();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(permission != Role.NoRights ) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Get Role from jwt&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String roles = claims.get("Role", String.class);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Role roleUser = Role.valueOf(roles);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // if role allowed != role jwt -> UNAUTHORIZED&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (!permission.equals(roleUser)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw new Exception("no roles");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; catch (Exception e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; e.printStackTrace();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}@JWTTokenNeeded接口：@javax.ws.rs.NameBinding@Retention(RUNTIME)@Target({TYPE, METHOD})public @interface JWTTokenNeeded {&nbsp; &nbsp; Role Permissions() default Role.NoRights;}允许角色访问终端节点就像添加@JWTTokenNeeded(Permissions = Role.Admin)下面是一个示例：@Path("User")public class UserResource {&nbsp; &nbsp; @EJB&nbsp; &nbsp; private UserappDAO userDAO;&nbsp; &nbsp; @GET&nbsp; &nbsp; @JWTTokenNeeded(Permissions = Role.Admin)&nbsp; &nbsp; @Produces("application/json")&nbsp; &nbsp; public List<Userapp> all() {&nbsp; &nbsp; &nbsp; &nbsp; return userDAO.getAll();&nbsp; &nbsp; }}