4.0.0
 minibox
 an
 0.0.1-SNAPSHOT
  
  
    org.springframework.boot
    spring-boot-starter-parent
    1.5.1.RELEASE
  
  
  
    
    
      org.springframework.boot
      spring-boot-starter-web
    
    
     
      org.springframework.boot 
      spring-boot-starter-test 
      test 
     
    
    
      org.springframework.boot
      spring-boot-starter-hateoas
    
    
    
      org.springframework.boot
      spring-boot-devtools
      true
    
    
    
      io.jsonwebtoken
      jjwt
      0.7.0
    
    
    
      org.springframework.ldap
      spring-ldap-core
      2.3.1.RELEASE
    
    
    
      com.alibaba
      fastjson
      1.2.24
    
  
  
  
    
      
        org.springframework.boot
        spring-boot-maven-plugin
      
      
      
        org.springframework.boot
        spring-boot-maven-plugin
        
          
            org.springframework
            springloaded
            1.2.0.RELEASE
          
        
      
    
  

#Logging_config
logging.level.root=INFO
logging.level.org.springframework.web=WARN
logging.file=minibox.log

#server_config
#使用了SSL，并且在ldap配置中使用了ldaps，這里同時也需要把AD的證書導(dǎo)入到server.keystore中。具體的可以查看java的keytool工具
server.port=8443
server.ssl.key-store=classpath:server.keystore
server.ssl.key-store-password=minibox
server.ssl.key-password=minibox

#jwt
#jwt加解密時使用的key
jwt.key=minibox

#ldap_config
#ldap配置信息，注意這里的userDn一定要寫這種形式。referral設(shè)置為follow，說不清用途，似乎只有連接AD時才需要配置
ldap.url=ldaps://192.168.227.128:636
ldap.base=ou=Employees,dc=minibox,dc=com
ldap.userDn=cn=Administrator,cn=Users,dc=minibox,dc=com
ldap.userPwd=qqq111!!!!
ldap.referral=follow
ldap.domainName=@minibox.com

package an;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.ldap.core.LdapTemplate;
import org.springframework.ldap.core.support.LdapContextSource;
@SpringBootApplication//相當(dāng)于@Configuration，@EnableAutoConfiguration，@ComponentScan
public class Application {

  /*
  * SpringLdap配置。通過@Value注解讀取之前配置文件中的值
  */
  @Value("${ldap.url}")
  private String ldapUrl;

  @Value("${ldap.base}")
  private String ldapBase;

  @Value("${ldap.userDn}")
  private String ldapUserDn;

  @Value("${ldap.userPwd}")
  private String ldapUserPwd;

  @Value("${ldap.referral}")
  private String ldapReferral;

  /*
  *SpringLdap的javaConfig注入方式
  */
  @Bean
  public LdapTemplate ldapTemplate() {
    return new LdapTemplate(contextSourceTarget());
  }

  @Bean
  public LdapContextSource contextSourceTarget() {
    LdapContextSource ldapContextSource = new LdapContextSource();
    ldapContextSource.setUrl(ldapUrl);
    ldapContextSource.setBase(ldapBase);
    ldapContextSource.setUserDn(ldapUserDn);
    ldapContextSource.setPassword(ldapUserPwd);
    ldapContextSource.setReferral(ldapReferral);
    return ldapContextSource;
  }

  public static void main(String[] args) throws Exception {
    SpringApplication.run(Application.class, args);
  }
}

package an.auth;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.ldap.NamingException;
import org.springframework.ldap.core.AttributesMapper;
import org.springframework.ldap.core.LdapTemplate;
import org.springframework.ldap.support.LdapUtils;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.serializer.SerializerFeature;
import static org.springframework.ldap.query.LdapQueryBuilder.query;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import an.entity.Employee;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
@RestController
@RequestMapping("/auth")
public class JwtAuth {

  //jwt加密密匙
  @Value("${jwt.key}")
  private String jwtKey;

  //域名后綴
  @Value("${ldap.domainName}")
  private String ldapDomainName;

  //ldap模板
  @Autowired
  private LdapTemplate ldapTemplate;

  /**
   * 將域用戶屬性通過EmployeeAttributesMapper填充到Employee類中，返回一個填充信息的Employee實(shí)例
   */
  private class EmployeeAttributesMapper implements AttributesMapper {
    public Employee mapFromAttributes(Attributes attrs) throws NamingException, javax.naming.NamingException {
      Employee employee = new Employee();
      employee.setName((String) attrs.get("sAMAccountName").get());
      employee.setDisplayName((String) attrs.get("displayName").get());
      employee.setRole((String) attrs.get("memberOf").toString());
      return employee;
    }
  }

  /**
   * @param username 用戶提交的名稱
   * @param password 用戶提交的密碼
   * @return 成功返回加密后的token信息，失敗返回錯誤HTTP狀態(tài)碼
   */
  @CrossOrigin//因為需要跨域訪問，所以要加這個注解
  @RequestMapping(method = RequestMethod.POST)
  public ResponseEntity authByAd(
      @RequestParam(value = "username") String username,
      @RequestParam(value = "password") String password) {
    //這里注意用戶名加域名后綴 userDn格式：anwx@minibox.com
    String userDn = username + ldapDomainName;
    //token過期時間 4小時
    Date tokenExpired = new Date(new Date().getTime() + 60*60*4*1000);
    DirContext ctx = null;
    try {
      //使用用戶名、密碼驗證域用戶
      ctx = ldapTemplate.getContextSource().getContext(userDn, password);
      //如果驗證成功根據(jù)sAMAccountName屬性查詢用戶名和用戶所屬的組
      Employee employee = ldapTemplate                            .search(query().where("objectclass").is("person").and("sAMAccountName").is(username),
              new EmployeeAttributesMapper())
          .get(0);
      //使用Jwt加密用戶名和用戶所屬組信息
      String compactJws = Jwts.builder()
          .setSubject(employee.getName())
          .setAudience(employee.getRole())
          .setExpiration(tokenExpired)
          .signWith(SignatureAlgorithm.HS512, jwtKey).compact();
      //登錄成功，返回客戶端token信息。這里只加密了用戶名和用戶角色，而displayName和tokenExpired沒有加密
      Map userInfo = new HashMap();
      userInfo.put("token", compactJws);
      userInfo.put("displayName", employee.getDisplayName());
      userInfo.put("tokenExpired", tokenExpired.getTime());
      return new ResponseEntity(JSON.toJSONString(userInfo , SerializerFeature.DisableCircularReferenceDetect) , HttpStatus.OK);
    } catch (Exception e) {
      //登錄失敗，返回失敗HTTP狀態(tài)碼
      return new ResponseEntity(HttpStatus.UNAUTHORIZED);
    } finally {
      //關(guān)閉ldap連接
      LdapUtils.closeContext(ctx);
    }
  }

}

// The Vue build version to load with the `import` command
// (runtime-only or standalone) has been set in webpack.base.conf with an alias.
import Vue from 'vue'
import VueRouter from 'vue-router'
import VueResource from 'vue-resource'
import store from './store/store'
import 'bootstrap/dist/css/bootstrap.css'
import App from './App'
import Login from './components/login'
import Hello from './components/hello'

Vue.use(VueRouter)
Vue.use(VueResource)
//Vue-resource默認(rèn)以payload方式提交數(shù)據(jù)，這樣設(shè)置之后以formData方式提交
Vue.http.options.emulateJSON = true;

const routes = [
 {
  path: '/login',
  component : Login
 },{
  path: '/hello',
  component: Hello
 }
]

const router = new VueRouter({
 routes
})

//默認(rèn)導(dǎo)航到登錄頁
router.push('/login')

/*
全局路由鉤子
訪問資源時需要驗證localStorage中是否存在token
以及token是否過期
驗證成功可以繼續(xù)跳轉(zhuǎn)
失敗返回登錄頁重新登錄
 */
router.beforeEach((to, from, next) => {
 if(localStorage.token && new Date().getTime() < localStorage.tokenExpired){
  next()
 }
 else{
  next('/login')
 }
})

new Vue({
 el: '#app',
 template: '',
 components: { App },
 router,
 store
})