spring security oauth2實現多端登錄互不影響

在項目中使用spring security oauth2做了統一登錄授權，在實際開發過程中，發現不同終端同一賬號登錄，返回的token是一樣的。我們使用的是redis存儲token，於是查了資料，發現是因為生成token key的算法的原因，導致了多端登錄返回一個token的問題，原因如圖：

調用代碼：

 

 

生成key使用的是DefaultAuthenticationKeyGenerator，代碼：

public class DefaultAuthenticationKeyGenerator implements AuthenticationKeyGenerator {

    private static final String CLIENT_ID = "client_id";

    private static final String SCOPE = "scope";

    private static final String USERNAME = "username";

    public String extractKey(OAuth2Authentication authentication) {
        Map<String, String> values = new LinkedHashMap<String, String>();
        OAuth2Request authorizationRequest = authentication.getOAuth2Request();
        if (!authentication.isClientOnly()) {
            values.put(USERNAME, authentication.getName());
        }
        values.put(CLIENT_ID, authorizationRequest.getClientId());
        if (authorizationRequest.getScope() != null) {
            values.put(SCOPE, OAuth2Utils.formatParameterList(new TreeSet<String>(authorizationRequest.getScope())));
        }
        return generateKey(values);
    }

    protected String generateKey(Map<String, String> values) {
        MessageDigest digest;
        try {
            digest = MessageDigest.getInstance("MD5");
            byte[] bytes = digest.digest(values.toString().getBytes("UTF-8"));
            return String.format("%032x", new BigInteger(1, bytes));
        } catch (NoSuchAlgorithmException nsae) {
            throw new IllegalStateException("MD5 algorithm not available.  Fatal (should be in the JDK).", nsae);
        } catch (UnsupportedEncodingException uee) {
            throw new IllegalStateException("UTF-8 encoding not available.  Fatal (should be in the JDK).", uee);
        }
    }
}

從代碼里面看，生成key使用的是 client_id、scope、username三個字段，由於這三個字段同一用戶在同一子系統中是不變的，所以導致多端登錄時，生成的token key是一樣的，就會造成返回的token一樣，這樣的后果就是，其中一個終端退出登錄，所有已登錄設備就失效了，於是就重寫這extractKey方法，繼承這個類，增加了一個device_id字段，從而解決多端登錄需要互不干擾的需求：

public class CustomAuthenticationKeyGenerator extends DefaultAuthenticationKeyGenerator {
    private static final String CLIENT_ID = "client_id";

    private static final String SCOPE = "scope";

    private static final String USERNAME = "username";

    private static final String DEVICE_ID = "device_id";

    @Override
    public String extractKey(OAuth2Authentication authentication) {
        Map<String, String> values = new LinkedHashMap<String, String>();
        OAuth2Request authorizationRequest = authentication.getOAuth2Request();
        if (!authentication.isClientOnly()) {
            values.put(USERNAME, authentication.getName());
        }
        values.put(CLIENT_ID, authorizationRequest.getClientId());
        if (authorizationRequest.getScope() != null) {
            values.put(SCOPE, OAuth2Utils.formatParameterList(new TreeSet<String>(authorizationRequest.getScope())));
        }

        String deviceId = authorizationRequest.getRequestParameters().get(DEVICE_ID);
        values.put(DEVICE_ID, deviceId);

        return generateKey(values);
    }
}