一、背景介绍
1.自动化的配置工具autoconfig介绍
项目开发过程中,有些配置会随着运行环境的变化而各不相同。如jdbc驱动的配置,在开发环境可能链接到开发本地的数据库,测试环境则有一套测试专用的数据库环境,如果一个应用要部署到多个idc中,那这些配置又有可能各不相同。如果每次上线时候人工的修改一下配置,比较容易出错,而且随着环境的增多成本会线性地增长。
Autoconfig提供了一种动态替换配置信息的手段。并且Maven的强大插件机制,可以和autoconfig机制结合起来,发挥巨大的威力。pom.xml中配置autoconfig方法如下:
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
<plugin> <groupId>com.alibaba.citrus.tool</groupId> <artifactId>autoconfig-maven-plugin</artifactId> <version>1.2</version> <configuration> <exploding>true</exploding> <includeDescriptorPatterns> <includeDescriptorPattern>autoconf/auto-config.xml</includeDescriptorPattern> <includeDescriptorPattern>autoconf/conf/auto-config.xml</includeDescriptorPattern> <includeDescriptorPattern>autoconf/conf/customize-autoconf/auto-config.xml</includeDescriptorPattern> </includeDescriptorPatterns> </configuration> <executions> <execution> <phase>package</phase> <goals> <goal>autoconfig</goal> </goals> </execution> </executions> </plugin>
Convention over Configuration(CoC),约定优于配置,上述配置文件中,充分体现了CoC原则。默认地插件会去扫描autoconf/auto-config.xml或者conf/META-INF/autoconf/auto-config.xml文件。autoconfig使用一套配置模板,为不同的环境生成相应的具体配置。它的核心思想是把一些可变的配置定义为一个模板,在autoconfig运行的时候从这些模板中生成具体的配置文件。
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
package test; import java.io.InputStream; import java.util.Properties; public class Testconfig { /** * 从classpath中读取配置文件component-beans.properties,然后输出到控制台 */ public static void main(String[] args) throws Exception { InputStream is = Testconfig.class.getClassLoader().getResourceAsStream("component-beans.properties"); if (is == null) { System.err.println("Can not load config resource component-beans.properties in classpath"); } else { Properties prop = new Properties(); prop.load(is); is.close(); for (String key : prop.stringPropertyNames()) { String value = prop.getProperty(key); if (value != null) { System.out.printf("%s = %s %n", key, value); } } } } }
在Testconfig.java文件中,模拟实现了从classpath中读取配置文件component-beans.properties,接下来创建antoconfig的描述文件auto-config.xml以及component-beans.properties.vm配置文件对应的模板文件(属性名中的点在autoconfig执行的时候会被替换成下划线)。
通常将配置集中管理,使用中央配置仓库,将可变内容存储在数据库中(文本,DB都可以),然后使用模版引擎(velocity,jsp等)生成最终的配置文件,并且提供http或者其他类型的接口给使用方在应用启动前调用。
2.Apache加密工具类DigestUtils.md5Hex(String str)
MD5算法是单向不可逆的,目前只可以通过暴力破解来破解。如果应用中需要采用可逆的加密方法,可以采用DES,3DES,AES,RSA 等。MD5常用于用户的登陆密码加密,每次把用户输入的密码用MD5加密后跟数据库中存储的密码进行比较。可逆加密常用于前端与后端参数交互,后端解密参数,查询数据返回给前端。
MD5加密原理是散列算法,散列算法也称哈希算法。比如10除以3余数为一,4除以3余数也为一,但余数为一的就不知道这个数是哪个了。所以md5不能解密。
二、鉴权配置和初始化
首先,在component-beans.xml.vm文件中配置了bean,并且在容器启动的时候,执行initial方法,将需要权限验证url添加到includeStr集合中。
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
<bean id="apiValve" class="com.alibaba.tboss.common.services.login.ApiAuthValve" init-method="initial"> <!-- 需要权限验证url --> <property name="includeStr"> <list> <value><![CDATA[^/tboss/web/api/.*\.json$]]></value> </list> </property> <!-- 需要验证模块中跳过的url--> <property name="excludeStr"> <list> </list> </property> </bean>
然后在pipeline-web.xml中配置了ApiAuthValue,保证对系统进行API调用请求的时候,执行ApiAuthValue.java中的invoke回调方法。(回调函数的理解:将函数的一部分功能外包给别人。)
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
<?xml version="1.0" encoding="UTF-8" ?> <beans:beans> <services:pipeline xmlns="http://www.alibaba.com/schema/services/pipeline/valves"> <!-- 初始化turbine rundata,并在pipelineContext中设置可能会用到的对象(如rundata、utils),以便valve取得。 --> <prepareForTurbine /> <!-- 设置日志系统的上下文,支持把当前请求的详情打印在日志中。 --> <setLoggingContext /> <!-- 分析URL,取得target。 --> <analyzeURL /> <valve class="com.alibaba.dragoon.patrol.webx3.DragoonStatValve" /> <!-- 配置ApiAuthValue API鉴权--> <valve class="com.alibaba.tboss.common.services.login.ApiAuthValve" /> <choose> <when> <!-- 判断当前的登录类型 --> <pl-conditions:condition class="com.alibaba.tboss.common.services.login.LoginTypeCondition" /> <valve class="com.alibaba.tboss.common.services.login.MobileAuthValve" /> </when> <otherwise> <valve class="com.alibaba.tboss.common.services.login.TbossAuthValve" /> </otherwise> </choose> <!-- 检查csrf token,防止csrf攻击和重复提交。假如request和session中的token不匹配,则出错,或显示expired页面。 --> <checkCsrfToken /> </services:pipeline> </beans:beans>
接着实现了ApiAuthValve.java中的回调方法
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
package com.alibaba.tboss.common.services.login; import static com.alibaba.tboss.common.auth.costants.ApiConstants.API_AUTH_NAME; import static com.alibaba.tboss.common.auth.costants.ApiConstants.API_AUTH_SIGNATURE; import static com.alibaba.tboss.common.auth.costants.ApiConstants.API_AUTH_TIEMSTAMP; import java.util.ArrayList; import java.util.List; import java.util.regex.Pattern; import javax.annotation.Resource; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; import com.alibaba.citrus.extension.rpc.impl.DefaultResultGenerator; import com.alibaba.citrus.extension.rpc.validation.DefaultErrorContext; import com.alibaba.citrus.extension.rpc.validation.ErrorContext; import com.alibaba.citrus.extension.rpc.validation.ErrorItem; import com.alibaba.citrus.service.pipeline.PipelineContext; import com.alibaba.citrus.service.pipeline.support.AbstractValve; import com.alibaba.fastjson.JSON; import com.alibaba.tboss.common.auth.bo.ApiUserBo; public class ApiAuthValve extends AbstractValve { private static Logger logger = LoggerFactory.getLogger(ApiAuthValve.class); @Resource ApiUserBo apiUserBo; @Autowired private HttpServletRequest request; @Autowired private HttpServletResponse response; // 必须定义成 protected static ,否则注入不进来 protected static String[] includeStr; protected static List<Pattern> includes = new ArrayList<Pattern>(); protected static String[] excludeStr; protected static List<Pattern> excludes = new ArrayList<Pattern>(); public void initial() { if (includeStr != null) { for (int i = 0; i < includeStr.length; i++) { includes.add(Pattern.compile(includeStr[i].toLowerCase())); } } if (excludeStr != null) { for (int i = 0; i < excludeStr.length; i++) { excludes.add(Pattern.compile(excludeStr[i].toLowerCase())); } } } @Override public void invoke(PipelineContext pipelineContext) throws Exception { String uri = request.getRequestURI(); try { // isInControl=true表示请求链接需要鉴权 if (isInControl(uri)) { // 外部调用,必须添加的三个参数:apiName、timestamp、signature String apiName = request.getParameter(API_AUTH_NAME); String timestamp = request.getParameter(API_AUTH_TIEMSTAMP); String signature = request.getParameter(API_AUTH_SIGNATURE); // 没有从api_user表匹配权限 apiUserBo.checkAuthorization(apiName, timestamp, signature, uri); } } catch (Exception e) { logger.error(uri + "fail - " + e.getMessage(), e); // 折衷方案,依赖rpc extention ErrorContext errorContext = new DefaultErrorContext(); errorContext.addError(ErrorItem.create("rpc_500", "500", String.format("API auth fail : " + e.getMessage(), request.getRequestURI()))); Object result = new DefaultResultGenerator.GenericWebRPCResult("API auth fail", null, errorContext); response.getWriter().print(JSON.toJSONString(result)); return; } pipelineContext.invokeNext(); } private boolean isInControl(String uri) { boolean control = false; for (Pattern pattern : includes) { if (pattern.matcher(uri.toLowerCase()).matches()) { control = true; break; } } if (control) { for (Pattern pattern : excludes) { if (pattern.matcher(uri.toLowerCase()).matches()) { control = false; break; } } } return control; } public void setRequest(HttpServletRequest request) { this.request = request; } public void setResponse(HttpServletResponse response) { this.response = response; } public String[] getIncludeStr() { return includeStr; } public void setIncludeStr(String[] includeStr) { this.includeStr = includeStr; } public String[] getExcludeStr() { return excludeStr; } public void setExcludeStr(String[] excludeStr) { this.excludeStr = excludeStr; } }
最后,在执行相应的业务逻辑。附鉴权方法的实现类如下:
import org.apache.commons.lang3.time.DateUtils; import com.alibaba.common.lang.MathUtil; import org.apache.commons.codec.digest.DigestUtils; public void checkAuthorization(String apiName, String timestamp, String signature, String uri) { if(StringUtils.isBlank(apiName) || StringUtils.isBlank(timestamp) || StringUtils.isBlank(signature)) { throw new ApiAuthException("apiName, timestamp, signature is missing"); } Date gmtRequest = null; try { gmtRequest = DateUtils.parseDate(timestamp, API_AUTH_TIMEFORMAT); } catch (ParseException e) { throw new ApiAuthException("Unsupported timestamp format, suggestting as " + API_AUTH_TIMEFORMAT); } if (MathUtil.abs(System.currentTimeMillis() - gmtRequest.getTime()) >= 15 * 60 * 1000) { throw new ApiAuthException("Request has been expired"); } ApiUser user = getApiUserByName(apiName); if(user == null) { throw new ApiAuthException("Api user is not exist"); } if(!isAuthorized(user, uri)) { throw new ApiAuthException(String.format("%s has no permission to access uri %s", apiName, uri)); } String realCode = decode(user.getCode()); String format = String.format("%s%s%s", apiName, timestamp, realCode); if(!signature.equals(DigestUtils.md5Hex(format))) { throw new ApiAuthException("Signature is not match"); } }
配合鉴权的表单提交测试Demo如下:首先需要md5.js和jquery-1.11.3.min.js两个js仓库。表单提交代码如下:
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
<!DOCTYPE html> <html lang="zh-cn"> <head> <title>测试Demo</title> <script src="jquery-1.11.3.min.js"></script> <script src="md5.js"></script> <script> function DateFormat(pattern, formatSymbols) { if(pattern == null || pattern == undefined) { pattern = "yyyy-MM-dd HH:mm:ss SSS"; } if(formatSymbols == null || formatSymbols == undefined) { formatSymbols = "yMdHmsS"; } this.pattern = pattern; this.formatSymbols = formatSymbols; } DateFormat.prototype.format = function(date) { var time = getTime(date); // 标记存入数组 var cs = this.formatSymbols.split(""); // 格式存入数组 var fs = this.pattern.split(""); // 构造数组 var ds = time.split(""); // 标志年月日的结束下标 var y = 3; var M = 6; var d = 9; var H = 12; var m = 15; var s = 18; var S = 22; // 逐位替换年月日时分秒和毫秒 for(var i = fs.length - 1; i > -1; i--) { switch (fs[i]) { case cs[0]: { fs[i] = ds[y--]; break; } case cs[1]: { fs[i] = ds[M--]; break; } case cs[2]: { fs[i] = ds[d--]; break; } case cs[3]: { fs[i] = ds[H--]; break; } case cs[4]: { fs[i] = ds[m--]; break; } case cs[5]: { fs[i] = ds[s--]; break; } case cs[6]: { fs[i] = ds[S--]; break; } } } return fs.join(""); } DateFormat.prototype.parse = function(date) { var y = ""; var M = ""; var d = ""; var H = ""; var m = ""; var s = ""; var S = ""; // 标记存入数组 var cs = this.formatSymbols.split(""); // 格式存入数组 var ds = this.pattern.split(""); // date = "2005-08-22 12:12:12 888"; // format = "yyyy-MM-dd HH:mm:ss SSS"; // sign = "yMdHmsS"; var size = Math.min(ds.length, date.length); for(var i=0; i<size; i++) { switch (ds[i]) { case cs[0]: { y += date.charAt(i); break; } case cs[1]: { M += date.charAt(i); break; } case cs[2]: { d += date.charAt(i); break; } case cs[3]: { H += date.charAt(i); break; } case cs[4]: { m += date.charAt(i); break; } case cs[5]: { s += date.charAt(i); break; } case cs[6]: { S += date.charAt(i); break; } } } if(y.length < 1) y = 0; else y = parseInt(y); if(M.length < 1) M = 0; else M = parseInt(M); if(d.length < 1) d = 0; else d = parseInt(d); if(H.length < 1) H = 0; else H = parseInt(H); if(m.length < 1) m = 0; else m = parseInt(m); if(s.length < 1) s = 0; else s = parseInt(s); if(S.length < 1) S = 0; else S = parseInt(S); var d = new Date(y, M - 1, d, H, m, s, S); return d; } // 返回当前时间 function getTime(date) { if(date == null) { date = new Date(); } var y = date.getFullYear(); var M = date.getMonth() + 1; var d = date.getDate(); var h = date.getHours(); var m = date.getMinutes(); var s = date.getSeconds(); var S = date.getTime()%1000; var html = y + "-"; if(M < 10) { html += "0"; } html += M + "-"; if(d < 10) { html += "0"; } html += d + " "; if(h < 10) { html += "0"; } html += h + ":"; if(m < 10) { html += "0"; } html += m + ":"; if(s < 10) { html += "0"; } html += s; html += " "; if(S < 100) { html += "0" } if(S < 10) { html += "0"; } html += S; return html; } </script> </head> <body> <br> <input id="url" style="width:100%" value=""/> <script type="text/javascript"> function getdate(){ var mydate = new Date().format("yyyyMMddhhmm"); return mydate; } function getsingname(){ //apiName 为:DiskTwistApi //code为:+r3UghilkTSfOFLfubg== //var str="test201511251000testcode"; //拼接字符串(按照`apiName+timestamp+code`顺序) var mydate = new Date().format("yyyyMMddhhmm"); var str="DiskTwistApi"+mydate+"+r3UghilkTSfOFLfubg=="; var signname=hex_md5(str); alert( signname); } function check(){ var timestamp = new DateFormat("yyyyMMddHHmm").format(new Date()); var str="DiskTwistApi"+timestamp+"+r3UghilkTSfOFLfubg=="; var signature=hex_md5(str); $("#timestamp").val(timestamp); $("#signature").val(signature); $("#forminfo").submit(); } </script> <form id="forminfo" action="http://idcm.alitest.com/tboss/web/api/workorder/diskDegauss/saveSnapshot.xhtml" method="post" enctype="multipart/form-data" > apiName:<input id="apiName" name="apiName" value="DiskTwistApi"> <br> code:<input id="code" name="code" value="+r3UghilkTSfOFLfubg=="> <br> timestamp:<input id="timestamp" name="timestamp" value=""> <br> signature<input id="signature" name="signature" value=""> <br> sn:<input id="sn" name="sn" style="width:500px" value="AUGUST281"/> <br> orderId:<input id="orderId" name="orderId" style="width:500px" value="8136"/> <br> img:<input id="img" name="fileInput" type="file"/> <br> <button type="button" onclick="check()">保存</button> </form> </body> </html>