授权和微服务的相互认证

一授权

1课程服务是一个资源服务

在其某个controller中加preauthorize注解，

2同时配置文件中开启

3.jwt令牌中包含对应权限信息才可以操作

XcUserExt userext = userClient.findUserInfo(username);

/*
        //获取当前用户的权限信息
        List<XcMenu> menuList = xcMenuMapper.findMenuList(xcUser.getId());
        xcUserExt.setPermissions(menuList);*/

 

select * from xc_menu where id in (select menu_id from xc_permission where role_id in(select role_id from xc_user_role where user_id ='49') )

 存到jwt令牌中

 

 

权限五张表阿帕奇的shrio和springsecurity都是基于

权限，权限角色roleid，resourceID，角色，用户角色userid roleid，用户，

查询主表为权限，根据用户id查roleid 查中间表

4.权限不足友好提示

import com.google.common.collect.ImmutableMap;
import com.xuecheng.filesystem.framework.model.response.CommonCode;
import com.xuecheng.filesystem.framework.model.response.ResponseResult;
import com.xuecheng.filesystem.framework.model.response.ResultCode;
import lombok.extern.slf4j.Slf4j;
import org.springframework.http.converter.HttpMessageNotReadableException;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseBody;

//全局异常抓取类
@ControllerAdvice //增强controller
@Slf4j
public class ExceptionCatch {

    //ImmutableMap 线程安全，声明之后内容不可变
    private static ImmutableMap<Class<? extends Throwable>,ResultCode> EXCEPTIONS;

    protected static ImmutableMap.Builder<Class<? extends Throwable>,ResultCode> builder = ImmutableMap.builder();

    //抓取自定义异常（可预知异常）
    @ExceptionHandler(CustomerException.class)
    @ResponseBody
    public ResponseResult customerException(CustomerException customerException){
        //给用户返回友好信息
        ResultCode resultCode = customerException.getResultCode();

        ResponseResult responseResult = new ResponseResult(resultCode);
        return responseResult;
    }

    //抓取不可预知异常
    @ExceptionHandler(Exception.class)
    @ResponseBody
    public ResponseResult exception(Exception exception){

        log.error(exception.getMessage());

        if (EXCEPTIONS == null){
            EXCEPTIONS = builder.build();
        }
        ResultCode resultCode = EXCEPTIONS.get(exception.getClass());
        if (resultCode == null){
            return new ResponseResult(CommonCode.SERVER_ERROR);
        }else{
            return new ResponseResult(resultCode);
        }

    }

    static {
        builder.put(HttpMessageNotReadableException.class, CommonCode.INVALIDATE_PARAMS);
    }
}

权限不足，无权操作。

 

点击“”管理课程“”没信息回显，发出查询课程基础信息请求，被拦截，