<dependencies>
    <!-- spring boot -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <!-- eureka client -->
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
    </dependency>

    <!-- mysql -->
    <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
    </dependency>

    <!-- mybatis -->
    <dependency>
        <groupId>org.mybatis.spring.boot</groupId>
        <artifactId>mybatis-spring-boot-starter</artifactId>
    </dependency>

    <!-- spring cloud security security     注意:oauth2包中已包含 无需再引入 -->
    <!--        <dependency>-->
    <!--            <groupId>org.springframework.cloud</groupId>-->
    <!--            <artifactId>spring-cloud-starter-security</artifactId>-->
    <!--        </dependency>-->

    <!-- spring cloud security oauth2 -->
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-oauth2</artifactId>
    </dependency>

    <!-- jwt -->
    <dependency>
        <groupId>com.nimbusds</groupId>
        <artifactId>nimbus-jose-jwt</artifactId>
    </dependency>
</dependencies>

// UserDetailsServiceImpl.java
@Component
public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    private AuthUserHelper authUserHelper;

    /**
     * 获取用户信息
     *  - 密码
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return authUserHelper.getUserByAccount(username);
    }
}


// 其中由authUserHelper提取的方法为根据username获取user信息
// 获取的TravelSecurityUser类为实现了UserDetails类的自定义类，包含了项目中业务上需要用的一些额外信息
// 如果不需要自定义内容，使用Spring Security实现好的User类即可
// AuthUserHelper.java
@Component
public class AuthUserHelper {
    @Autowired
    private UserDAO userDAO;
    @Autowired
    private CorpDAO corpDAO;
    @Autowired
    private PasswordEncoder passwordEncoder;

    public UserDetails getUserByAccount(String userAccount) throws UsernameNotFoundException {
        // 1. 检查账号
        // 注意这里数据库里存的密码不是明文，是已经加密过的了
        // 如果密码不是加密后的，需要使用passwordEncoder加密一下（当然还是建议不存储用户的明文密码，存在严重安全隐患）
        UserParam userParam = new UserParam();
        userParam.createCriteria()
                .andUserAccountEqualTo(userAccount);
        List<UserDO> userDOS = userDAO.selectByParam(userParam);
        if (CollectionUtils.isEmpty(userDOS)) {
            // 用户名不存在
            throw new UsernameNotFoundException(AuthMessageErrorEnum.USER_NOT_EXIST.getMessage());
        }

        // 2. 校验权限
        UserDO userDO = userDOS.get(0);
        List<GrantedAuthority> authorities = new ArrayList<>();
        // 普通职工权限默认拥有
        authorities.add(AuthorityRoleEnum.CORP_EMPLOYEE.getGrantedAuthority());

        // 校验是否是企业主管理员
        CorpParam corpParam = new CorpParam();
        corpParam.createCriteria()
                .andManagerUserIdEqualTo(userDO.getUserId())
                .andCorpIdEqualToWhenPresent(userDO.getCorpId());
        List<CorpDO> corpDOS = corpDAO.selectByParam(corpParam);
        if (CollectionUtils.isNotEmpty(corpDOS)) {
            authorities.add(AuthorityRoleEnum.CORP_MAIN_ADMIN.getGrantedAuthority());
        }

        return new TravelSecurityUser(
                userDO.getCorpId(), userDO.getUserId(),
                userDO.getUserAccount(), userDO.getUserPassword(), authorities);
    }
}

// OAuth2AuthServerConfig
@Configuration
@EnableAuthorizationServer
public class OAuth2AuthServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private PasswordEncoder passwordEncoder;
    @Autowired
    private AuthenticationManager authenticationManager;
    @Autowired
    private JwtTokenEnhancer jwtTokenEnhancer;
    @Autowired
    private UserDetailsServiceImpl userDetailsService;


    //配置客户端应用的相关信息
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        super.configure(clients);

        // 将客户端的信息写入内存中
        clients.inMemory()
                .withClient("client-app")                       //客户端ID
                .secret(passwordEncoder.encode("123456"))   	//客户端密码
                .scopes("all")                                  //用户对该客户端可以申请的权限
                .accessTokenValiditySeconds(3600)               //令牌的有效期（单位为秒）
                .refreshTokenValiditySeconds(86400)             // refresh token有效期
                .authorizedGrantTypes("password", "refresh_token");     //用户要访问该客户端的时候采取的授权类型，本项目采用密码模式。
    }

    //配置令牌管理器和令牌的存储方式
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        super.configure(endpoints);
        TokenEnhancerChain enhancerChain = new TokenEnhancerChain();
        List<TokenEnhancer> delegates = new ArrayList<>();
        delegates.add(jwtTokenEnhancer);				//添加自定义信息的增强器（实现了TokenEnhancer接口）
        delegates.add(accessTokenConverter());			//jwt转换token的增强器
        enhancerChain.setTokenEnhancers(delegates); 	//配置token内容增强器
        endpoints.authenticationManager(authenticationManager)	// 由 authenticationManager 来管理
                .userDetailsService(userDetailsService) //配置加载用户信息的服务
                .accessTokenConverter(accessTokenConverter())
                .tokenEnhancer(enhancerChain);
    }

    //配置谁能来验 token （有一些请求连验 token 的资格都没有）
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        super.configure(security);
        security.allowFormAuthenticationForClients();	// 允许以form表单形式提交 走ClientCredentialsTokenEndpointFilter
        												// 通过body的form表单中的client_id和client_secret未加密字段来校验
        												// 如果不允许 走BasicAuthenticationFilter
        												// 一般来说通过basic auth，是通过解析在header的Authorization加上Basic+client_id+client_secret转换的加密串来校验
        												// basic auth（虽然这个加密也相当于是明文的）
        security.checkTokenAccess("isAuthenticated()");
    }

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
        jwtAccessTokenConverter.setKeyPair(keyPair());
        return jwtAccessTokenConverter;
    }

    @Bean
    public KeyPair keyPair() {
        //从classpath下的证书中获取秘钥对
        KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(new ClassPathResource("jwt.jks"), "W.w215.+".toCharArray());
        return keyStoreKeyFactory.getKeyPair("jwt", "生成rsa证书时的密码".toCharArray());
    }
}

@RestController
public class KeyPairController {
    @Autowired
    private KeyPair keyPair;

    @GetMapping("/rsa/publicKey")
    public Map<String, Object> getKey() {
        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
        RSAKey key = new RSAKey.Builder(publicKey).build();
        return new JWKSet(key).toJSONObject();
    }
}

@Configuration
@EnableWebSecurity  //支持 WebSecurity
public class OAuth2WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll()
                .antMatchers("/rsa/publicKey").permitAll()		// 允许访问公钥接口
                .anyRequest().authenticated();
    }

    //配置如何构建 AuthenticationManager
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .userDetailsService(userDetailsService)		//获取用户详细信息（用户名、权限等）
                .passwordEncoder(passwordEncoder);			//密码加密器
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

{
    "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoyLCJ1c2VyX25hbWUiOiJheWFuIiwic2NvcGUiOlsiYWxsIl0sImV4cCI6MTY0ODU0NDUwOCwiY29ycF9pZCI6MiwiYXV0aG9yaXRpZXMiOlsiQ09SUF9VU0VSIl0sImp0aSI6ImM0NDRiNzU3LTdhZmMtNGQ5OC1hNzEzLWJlYTkyYmQ1ZjVkNyIsImNsaWVudF9pZCI6ImNsaWVudC1hcHAifQ.ZIeEzyk25ix5SL1lMXQhe6jC76y2t3NND-mpwl9QTLvpPYkO6jdpsDikTOh75E-UhJvSTaxS3jB3JrBt3tL50IjXrxDhNvpGlvIpF-cEL6mxSXZhF3ZOOfj1BHJHOVk3ppNVNqJkt4s_4kjg_a8U1uZlHg7-5eub7RFIuAW01R4u1oxZ3EtftTmdGqHw3PiL0OpNUH9q-Y-DT56vTPGeNdBTMS1CoJQRev5FX8jhOXFJfFsmTwVa7U_Cy_glKNRftUNX6trDzOARwG0JI23BMB2iCe8K6DKQXxOIlo57tMAkZBIPVrDwmnuElPYfmagcUp-0ejzmMD2mqH-CKX6vmg",
    "token_type": "bearer",
    "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoyLCJ1c2VyX25hbWUiOiJheWFuIiwic2NvcGUiOlsiYWxsIl0sImF0aSI6ImM0NDRiNzU3LTdhZmMtNGQ5OC1hNzEzLWJlYTkyYmQ1ZjVkNyIsImV4cCI6MTY0ODYyNzMwOCwiY29ycF9pZCI6MiwiYXV0aG9yaXRpZXMiOlsiQ09SUF9VU0VSIl0sImp0aSI6IjVmYjVmNjRiLTU0YTEtNDk2Zi1hOTU3LWVmODY5Y2I1M2YyMiIsImNsaWVudF9pZCI6ImNsaWVudC1hcHAifQ.ippaehx2sKwqg2dvbjOELd_ab8pM-X8fki7DpvTsAoAHtAFBdsdm2r3A_lNbOCl9ZxwetzC6UFQA5tg0np8Y0cdwHkX_CuB2ldlPg_ro27cnPxEQJZ_eap8auWKxbT-IOA6-iaYW5Q0VPNCtNJdnAeeK6kXxTzctD82Dk_wJ3SBhBh7W6hwsoYQGmuqd89f_CiEgkLumXO2uQa3paC9v8eQEoiqRebRb7s1Mx3ZkzCWCkAto108Y7KEb40x4GT6HNQtuth30T9AcLSgHqO2--sYq14vL3A0YsO8Tx823C6T1Rp_-462OB0GF2HsIJiQpHidReB75TvDmAhiV4xB__Q",
    "expires_in": 3599,
    "scope": "all",
    "user_id": 2,
    "corp_id": 2,
    "jti": "c444b757-7afc-4d98-a713-bea92bd5f5d7"
}

<dependencies>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-gateway</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-webflux</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-oauth2-resource-server</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-oauth2-client</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-oauth2-jose</artifactId>
    </dependency>
    <dependency>
        <groupId>com.nimbusds</groupId>
        <artifactId>nimbus-jose-jwt</artifactId>
        <version>8.16</version>
    </dependency>

    <!-- eureka client -->
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
    </dependency>

    <!-- 自定义元数据 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-configuration-processor</artifactId>
        <optional>true</optional>
    </dependency>
</dependencies>

server:
  port: 10086 # 网关端口

spring:
  application:
    name: gateway # 服务名称
  cloud:
    gateway:
      globalcors:
        add-to-simple-url-handler-mapping: true
        cors-configurations:
          '[/**]':
            allowedOrigins: "*" # 允许哪些网站的跨域请求 allowedOrigins: “*” 允许所有网站
            allowedMethods: # 允许的跨域请求方式
              - "GET"
              - "POST"
              - "DELETE"
              - "PUT"
              - "OPTIONS"
            allowedHeaders: "*" # 允许在请求中携带的头信息
            allowCredentials: true # 是否允许携带cookie
            maxAge: 360000 # 这次跨域检测的有效期
      routes: # 网关路由配置
        - id: api-service        	# 路由id，自定义，只要唯一即可
          uri: lb://member-service  # 路由的目标地址 lb就是负载均衡，后面跟服务名称
          predicates:            	# 路由断言，也就是判断请求是否符合路由规则的条件
            - Path=/member/**       # 按照路径匹配，只要以/member开头就符合要求

        - id: auth-service
          uri: lb://auth-service
          predicates:
            - Path=/auth/**         # 按照路径匹配，只要以/auth开头就符合要求
          filters:
            - StripPrefix=1         # 在将请求发送到下游之前从请求中剥离的路径个数
      discovery:
        locator:
          enabled: true             # 开启从注册中心动态创建路由的功能
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: 'http://localhost:10110/rsa/publicKey' #配置RSA的公钥访问地址

# eureka 配置
eureka:
  client:
    service-url:
      defaultZone: http://127.0.0.1:10099/eureka

# 自定义配置
secure:
  ignore:
    urls: #配置白名单路径
      - "/actuator/**"
      - "/auth/oauth/token"

/**
 * 资源服务器配置
 *
 * @author github @TezaLeMon
 * @date 2022/3/21
 */
@EnableWebFluxSecurity
public class ResourceServerConfig {
    @Autowired
    private IgnoreUrlsConfig ignoreUrlsConfig;
    @Autowired
    private RestfulAccessDeniedHandler restfulAccessDeniedHandler;
    @Autowired
    private RestAuthenticationEntryPoint restAuthenticationEntryPoint;
    @Autowired
    private AuthorizationManager authorizationManager;
    @Autowired
    private IgnoreUrlsRemoveJwtFilter ignoreUrlsRemoveJwtFilter;

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http.oauth2ResourceServer().jwt()
                .jwtAuthenticationConverter(jwtAuthenticationConverter());
        //自定义处理JWT请求头过期或签名错误的结果
        http.oauth2ResourceServer().authenticationEntryPoint(restAuthenticationEntryPoint);
        //对白名单路径，直接移除JWT请求头
        http.addFilterBefore(ignoreUrlsRemoveJwtFilter, SecurityWebFiltersOrder.AUTHENTICATION);
        http.authorizeExchange()
                .pathMatchers(HttpMethod.OPTIONS).permitAll()
                .pathMatchers(ignoreUrlsConfig.getUrls().toArray(new String[]{})).permitAll()   //放行白名单配置
                .anyExchange().access(authorizationManager)     //鉴权管理器
                .and().exceptionHandling()
                .accessDeniedHandler(restfulAccessDeniedHandler)            //处理未授权
                .authenticationEntryPoint(restAuthenticationEntryPoint)     //处理未认证
                .and().csrf().disable();
        return http.build();
    }

    @Bean
    public Converter<Jwt, ? extends Mono<? extends AbstractAuthenticationToken>> jwtAuthenticationConverter() {
        JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
        jwtGrantedAuthoritiesConverter.setAuthorityPrefix(AuthConstant.AUTHORITY_PREFIX);
        jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName(AuthConstant.AUTHORITY_CLAIM_NAME);
        JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
        return new ReactiveJwtAuthenticationConverterAdapter(jwtAuthenticationConverter);
    }
}

/**
 * 鉴权管理器，用于判断是否有资源的访问权限
 *
 * @author github @TezaLeMon
 * @date 2022/3/22
 */
@Component
public class AuthorizationManager implements ReactiveAuthorizationManager<AuthorizationContext> {
    @Override
    public Mono<AuthorizationDecision> check(Mono<Authentication> mono, AuthorizationContext authorizationContext) {
        // 获取当前路径可访问角色列表 todo 目前配置为网关层允许所有role通过，在应用层进行权限校验
//        URI uri = authorizationContext.getExchange().getRequest().getURI();
        List<String> authorities = Arrays.stream(AuthorityRoleEnum.values()).map(a -> AuthConstant.AUTHORITY_PREFIX + a.getRoleCode()).collect(Collectors.toList());
        //认证通过且角色匹配的用户可访问当前路径
        return mono
                .filter(Authentication::isAuthenticated)
                .flatMapIterable(Authentication::getAuthorities)
                .map(GrantedAuthority::getAuthority)
                .any(authorities::contains)
                .map(AuthorizationDecision::new)
                .defaultIfEmpty(new AuthorizationDecision(false));
    }
}

@Slf4j
@Component
public class AuthGlobalFilter implements GlobalFilter, Ordered {

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String token = exchange.getRequest().getHeaders().getFirst("Authorization");
        if (StringUtils.isBlank(token)) {
            return chain.filter(exchange);
        }
        try {
            //从token中解析用户信息并设置到Header中去
            String realToken = token.replace("Bearer ", "");
            JWSObject jwsObject = JWSObject.parse(realToken);
            String userStr = jwsObject.getPayload().toString();
            log.info("ltd.teza.gateway.filter.AuthGlobalFilter.filter() user:{}", userStr);
            ServerHttpRequest request = exchange.getRequest().mutate().header("user", userStr).build();
            exchange = exchange.mutate().request(request).build();
        } catch (ParseException e) {
            log.error("ltd.teza.gateway.filter.AuthGlobalFilter JWSObject.parse exception", e);
        }
        return chain.filter(exchange);
    }

    @Override
    public int getOrder() {
        return 0;
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

@Component
public class UserSession {
    private static final ThreadLocal<Long> corpId = new ThreadLocal<>();
    private static final ThreadLocal<Long> userId = new ThreadLocal<>();

    public static void setUser(Long corpId, Long userId) {
        UserSession.corpId.set(corpId);
        UserSession.userId.set(userId);
    }

    public static void clear() {
        UserSession.corpId.remove();
        UserSession.userId.remove();
    }

    public static Long getCorpId() {
        return corpId.get();
    }

    public static Long getUserId() {
        return userId.get();
    }

}

@Slf4j
@Component
public class AuthFilter implements Filter {
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        //从Header中获取用户信息
        try {
            ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
            String userStr = null;
            if (servletRequestAttributes != null) {
                userStr = servletRequestAttributes.getRequest().getHeader("user");
            }
            JSONObject userJsonObject = JSONObject.parseObject(userStr);
            // 获取用户信息
            UserSession.setUser(userJsonObject.getLong("corp_id"), userJsonObject.getLong("user_id"));
        } catch (Exception e) {
            log.error("ltd.teza.member.filter.AuthFilter 获取用户信息异常，可能是未登陆导致。", e);
        } finally {
            filterChain.doFilter(servletRequest, servletResponse);
            // 清除用户信息
            UserSession.clear();
        }
    }
}

@RestController
@RequestMapping("/member")
@Slf4j
public class MemberHelloController implements MemberHelloClient {

    @GetMapping("hello")
    public ServiceResult<String> hello() {
        log.info("member-service --> ltd.teza.controller.HelloController.hello --> test log.info");
//        log.error("member-service --> ltd.teza.controller.HelloController.hello --> test log.error");
        ServiceResult<String> result = new ServiceResult<>(true);
        result.setModule("hello! this is member-service!~");
        return result;
    }

    @GetMapping("getUser")
    public String getUser() {
        Long userId = UserSession.getUserId();
        Long corpId = UserSession.getCorpId();
        return "corpId=" + corpId + "\nuserId=" + userId;
    }
}