Spring Security原始碼分析四:Spring Social實現微信社交登入
阿新 • • 發佈:2019-01-11
社交登入又稱作社會化登入(Social Login),是指網站的使用者可以使用騰訊QQ、人人網、開心網、新浪微博、搜狐微博、騰訊微博、淘寶、豆瓣、MSN、Google等社會化媒體賬號登入該網站。
前言
在上一章Spring-Security原始碼分析三-Spring-Social社交登入過程中,我們已經實現了使用Spring Social
+Security
的QQ社交登入。本章我們將實現微信的社交登入。(微信和QQ登入的大體流程相同,但存在一些細節上的差異,下面我們來簡單實現一下)
準備工作
為了方便大家測試,博主在某寶租用了一個月的appid和appSecret
appid | wxfd6965ab1fc6adb2 |
---|---|
appsecret | 66bb4566de776ac699ec1dbed0cc3dd1 |
目錄結構
api
定義api繫結的公共介面config
微信的一些配置資訊connect
與服務提供商建立連線所需的一些類。
定義返回使用者資訊介面
public interface Weixin {
WeixinUserInfo getUserInfo(String openId);
}
這裡我們看到相對於QQ的getUserInfo
微信多了一個引數openId
。這是因為微信文件中在OAuth2.0的認證流程示意圖
openid
同access_token
一起返回。而Spring Social
獲取access_token
的類AccessGrant.java
中沒有openid
。因此我們自己需要擴充套件一下Spring Social
獲取令牌的類(AccessGrant.java
);
處理微信返回的access_token類(新增openid)
@Data
public class WeixinAccessGrant extends AccessGrant{
private String openId;
public WeixinAccessGrant() {
super ("");
}
public WeixinAccessGrant(String accessToken, String scope, String refreshToken, Long expiresIn) {
super(accessToken, scope, refreshToken, expiresIn);
}
}
實現返回使用者資訊介面
public class WeiXinImpl extends AbstractOAuth2ApiBinding implements Weixin {
/**
* 獲取使用者資訊的url
*/
private static final String WEIXIN_URL_GET_USER_INFO = "https://api.weixin.qq.com/sns/userinfo?openid=";
private ObjectMapper objectMapper = new ObjectMapper();
public WeiXinImpl(String accessToken) {
super(accessToken, TokenStrategy.ACCESS_TOKEN_PARAMETER);
}
/**
* 獲取使用者資訊
*
* @param openId
* @return
*/
@Override
public WeixinUserInfo getUserInfo(String openId) {
String url = WEIXIN_URL_GET_USER_INFO + openId;
String result = getRestTemplate().getForObject(url, String.class);
if(StringUtils.contains(result, "errcode")) {
return null;
}
WeixinUserInfo userInfo = null;
try{
userInfo = objectMapper.readValue(result,WeixinUserInfo.class);
}catch (Exception e){
e.printStackTrace();
}
return userInfo;
}
/**
* 使用utf-8 替換預設的ISO-8859-1編碼
* @return
*/
@Override
protected List<HttpMessageConverter<?>> getMessageConverters() {
List<HttpMessageConverter<?>> messageConverters = super.getMessageConverters();
messageConverters.remove(0);
messageConverters.add(new StringHttpMessageConverter(Charset.forName("UTF-8")));
return messageConverters;
}
}
與QQ
獲取使用者資訊相比,微信
的實現類中少了一步通過access_token
獲取openid
的請求。openid
由自己定義的擴充套件類WeixinAccessGrant
中獲取;
WeixinOAuth2Template處理微信返回的令牌資訊
@Slf4j
public class WeixinOAuth2Template extends OAuth2Template {
private String clientId;
private String clientSecret;
private String accessTokenUrl;
private static final String REFRESH_TOKEN_URL = "https://api.weixin.qq.com/sns/oauth2/refresh_token";
public WeixinOAuth2Template(String clientId, String clientSecret, String authorizeUrl, String accessTokenUrl) {
super(clientId, clientSecret, authorizeUrl, accessTokenUrl);
setUseParametersForClientAuthentication(true);
this.clientId = clientId;
this.clientSecret = clientSecret;
this.accessTokenUrl = accessTokenUrl;
}
/* (non-Javadoc)
* @see org.springframework.social.oauth2.OAuth2Template#exchangeForAccess(java.lang.String, java.lang.String, org.springframework.util.MultiValueMap)
*/
@Override
public AccessGrant exchangeForAccess(String authorizationCode, String redirectUri,
MultiValueMap<String, String> parameters) {
StringBuilder accessTokenRequestUrl = new StringBuilder(accessTokenUrl);
accessTokenRequestUrl.append("?appid="+clientId);
accessTokenRequestUrl.append("&secret="+clientSecret);
accessTokenRequestUrl.append("&code="+authorizationCode);
accessTokenRequestUrl.append("&grant_type=authorization_code");
accessTokenRequestUrl.append("&redirect_uri="+redirectUri);
return getAccessToken(accessTokenRequestUrl);
}
public AccessGrant refreshAccess(String refreshToken, MultiValueMap<String, String> additionalParameters) {
StringBuilder refreshTokenUrl = new StringBuilder(REFRESH_TOKEN_URL);
refreshTokenUrl.append("?appid="+clientId);
refreshTokenUrl.append("&grant_type=refresh_token");
refreshTokenUrl.append("&refresh_token="+refreshToken);
return getAccessToken(refreshTokenUrl);
}
@SuppressWarnings("unchecked")
private AccessGrant getAccessToken(StringBuilder accessTokenRequestUrl) {
log.info("獲取access_token, 請求URL: "+accessTokenRequestUrl.toString());
String response = getRestTemplate().getForObject(accessTokenRequestUrl.toString(), String.class);
log.info("獲取access_token, 響應內容: "+response);
Map<String, Object> result = null;
try {
result = new ObjectMapper().readValue(response, Map.class);
} catch (Exception e) {
e.printStackTrace();
}
//返回錯誤碼時直接返回空
if(StringUtils.isNotBlank(MapUtils.getString(result, "errcode"))){
String errcode = MapUtils.getString(result, "errcode");
String errmsg = MapUtils.getString(result, "errmsg");
throw new RuntimeException("獲取access token失敗, errcode:"+errcode+", errmsg:"+errmsg);
}
WeixinAccessGrant accessToken = new WeixinAccessGrant(
MapUtils.getString(result, "access_token"),
MapUtils.getString(result, "scope"),
MapUtils.getString(result, "refresh_token"),
MapUtils.getLong(result, "expires_in"));
accessToken.setOpenId(MapUtils.getString(result, "openid"));
return accessToken;
}
/**
* 構建獲取授權碼的請求。也就是引導使用者跳轉到微信的地址。
*/
public String buildAuthenticateUrl(OAuth2Parameters parameters) {
String url = super.buildAuthenticateUrl(parameters);
url = url + "&appid="+clientId+"&scope=snsapi_login";
return url;
}
public String buildAuthorizeUrl(OAuth2Parameters parameters) {
return buildAuthenticateUrl(parameters);
}
/**
* 微信返回的contentType是html/text,新增相應的HttpMessageConverter來處理。
*/
protected RestTemplate createRestTemplate() {
RestTemplate restTemplate = super.createRestTemplate();
restTemplate.getMessageConverters().add(new StringHttpMessageConverter(Charset.forName("UTF-8")));
return restTemplate;
}
}
與QQ
處理令牌類相比多了三個全域性變數並且複寫了exchangeForAccess
方法。這是因為微信
在通過code
獲取access_token
是傳遞的引數是appid
和secret
而不是標準的client_id
和client_secret
。
WeixinServiceProvider連線服務提供商
public class WeixinServiceProvider extends AbstractOAuth2ServiceProvider<Weixin> {
/**
* 微信獲取授權碼的url
*/
private static final String WEIXIN_URL_AUTHORIZE = "https://open.weixin.qq.com/connect/qrconnect";
/**
* 微信獲取accessToken的url(微信在獲取accessToken時也已經返回openId)
*/
private static final String WEIXIN_URL_ACCESS_TOKEN = "https://api.weixin.qq.com/sns/oauth2/access_token";
public WeixinServiceProvider(String appId, String appSecret) {
super(new WeixinOAuth2Template(appId, appSecret, WEIXIN_URL_AUTHORIZE, WEIXIN_URL_ACCESS_TOKEN));
}
@Override
public Weixin getApi(String accessToken) {
return new WeiXinImpl(accessToken);
}
}
WeixinConnectionFactory連線服務提供商的工廠類
public class WeixinConnectionFactory extends OAuth2ConnectionFactory<Weixin> {
/**
* @param appId
* @param appSecret
*/
public WeixinConnectionFactory(String providerId, String appId, String appSecret) {
super(providerId, new WeixinServiceProvider(appId, appSecret), new WeixinAdapter());
}
/**
* 由於微信的openId是和accessToken一起返回的,所以在這裡直接根據accessToken設定providerUserId即可,不用像QQ那樣通過QQAdapter來獲取
*/
@Override
protected String extractProviderUserId(AccessGrant accessGrant) {
if(accessGrant instanceof WeixinAccessGrant) {
return ((WeixinAccessGrant)accessGrant).getOpenId();
}
return null;
}
/* (non-Javadoc)
* @see org.springframework.social.connect.support.OAuth2ConnectionFactory#createConnection(org.springframework.social.oauth2.AccessGrant)
*/
public Connection<Weixin> createConnection(AccessGrant accessGrant) {
return new OAuth2Connection<Weixin>(getProviderId(), extractProviderUserId(accessGrant), accessGrant.getAccessToken(),
accessGrant.getRefreshToken(), accessGrant.getExpireTime(), getOAuth2ServiceProvider(), getApiAdapter(extractProviderUserId(accessGrant)));
}
/* (non-Javadoc)
* @see org.springframework.social.connect.support.OAuth2ConnectionFactory#createConnection(org.springframework.social.connect.ConnectionData)
*/
public Connection<Weixin> createConnection(ConnectionData data) {
return new OAuth2Connection<Weixin>(data, getOAuth2ServiceProvider(), getApiAdapter(data.getProviderUserId()));
}
private ApiAdapter<Weixin> getApiAdapter(String providerUserId) {
return new WeixinAdapter(providerUserId);
}
private OAuth2ServiceProvider<Weixin> getOAuth2ServiceProvider() {
return (OAuth2ServiceProvider<Weixin>) getServiceProvider();
}
}
WeixinAdapter將微信api返回的資料模型適配Spring Social的標準模型
public class WeixinAdapter implements ApiAdapter<Weixin> {
private String openId;
public WeixinAdapter() {
}
public WeixinAdapter(String openId) {
this.openId = openId;
}
@Override
public boolean test(Weixin api) {
return true;
}
@Override
public void setConnectionValues(Weixin api, ConnectionValues values) {
WeixinUserInfo userInfo = api.getUserInfo(openId);
values.setProviderUserId(userInfo.getOpenid());
values.setDisplayName(userInfo.getNickname());
values.setImageUrl(userInfo.getHeadimgurl());
}
@Override
public UserProfile fetchUserProfile(Weixin api) {
return null;
}
@Override
public void updateStatus(Weixin api, String message) {
}
}
WeixinAuthConfig建立工廠和設定資料來源
@Configuration
public class WeixinAuthConfig extends SocialAutoConfigurerAdapter {
@Autowired
private DataSource dataSource;
@Autowired
private ConnectionSignUp myConnectionSignUp;
@Override
protected ConnectionFactory<?> createConnectionFactory() {
return new WeixinConnectionFactory(DEFAULT_SOCIAL_WEIXIN_PROVIDER_ID, SecurityConstants.DEFAULT_SOCIAL_WEIXIN_APP_ID,
SecurityConstants.DEFAULT_SOCIAL_WEIXIN_APP_SECRET);
}
@Override
public UsersConnectionRepository getUsersConnectionRepository(ConnectionFactoryLocator connectionFactoryLocator) {
JdbcUsersConnectionRepository repository = new JdbcUsersConnectionRepository(dataSource,
connectionFactoryLocator, Encryptors.noOpText());
if (myConnectionSignUp != null) {
repository.setConnectionSignUp(myConnectionSignUp);
}
return repository;
}
/**
* /connect/weixin POST請求,繫結微信返回connect/weixinConnected檢視
* /connect/weixin DELETE請求,解綁返回connect/weixinConnect檢視
* @return
*/
@Bean({"connect/weixinConnect", "connect/weixinConnected"})
@ConditionalOnMissingBean(name = "weixinConnectedView")
public View weixinConnectedView() {
return new SocialConnectView();
}
}
社交登入配置類
由於社交登入都是通過SocialAuthenticationFilter
過濾器攔截的,如果 上一章 已經配置過,則本章不需要配置。
效果如下: