Method for realizing resource service based on OAuth2 and gateway

Abstract

The invention discloses a method for realizing resource service based on OAuth2 and a gateway, and relates to the technical field of information systems. Comprising the steps of 1, creating a resource manager component on a resource server based on an OAuth 2.0 Resource Server component and creating an API gateway component on the basis of SpringCloud Gateway, and 2, receiving an access token carried by a client through the API gateway component, verifying the validity of the access token, checking the permission range of the access token passing verification, determining whether the client has the right to access corresponding resources or not, and if the client has the right to access corresponding resources, executing the step 3, and if the client has the right to access corresponding resources, executing the step 4. Step 3, receiving an access token carried by the client through the resource manager component, verifying the validity of the access token, checking the permission range of the access token passing the verification, determining whether the client has the right to access the corresponding resource or not, if yes, forwarding the request to the correct resource server, and enabling the request to access the resource server; and if the check is passed, providing the requested corresponding resources through the resource manager component.

Description

Technical Field

[0001] The present invention discloses a method for realizing resource services based on OAuth2 and a gateway, and relates to the technical field of information systems. Background Art

[0002] In a complex distributed environment, the microservice architecture needs to effectively manage API access resources while ensuring the security of data resources. However, there is currently no perfect method to effectively manage API access resources and manage resources efficiently and securely. Summary of the invention

[0003] In view of the problems of the prior art, the present invention provides a method for realizing resource services based on OAuth2 and gateway, which can realize an efficient and secure resource service end. By combining OAuth 2.0 Resource Server with API gateway, authentication, authorization, load balancing and other operations are performed on all API requests entering the system, and the requests are efficiently and securely routed to the protected resource service.

[0004] The specific scheme proposed by the present invention is:

[0005] The present invention provides a method for implementing resource services based on OAuth2 and a gateway, comprising:

[0006] Step 1: On the resource server side, create a resource manager component based on the OAuth 2.0 Resource Server component and create an API gateway component based on Spring Cloud Gateway.

[0007] Step 2: Receive the access token carried by the client through the API gateway component, verify the validity of the access token, check the permission scope of the verified access token, and determine whether the client has the right to access the corresponding resources. If the check passes, forward the request to the correct resource server so that the request can access the resource server.

[0008] Step 3: Receive the access token carried by the client through the resource manager component, verify the validity of the access token, check the permission scope of the verified access token, determine whether the client has the right to access the corresponding resources, and provide the requested corresponding resources through the resource manager component if the check passes.

[0009] Furthermore, in step 2 of the method for implementing resource services based on OAuth2 and gateway, a customized current limiting strategy is started as needed through the API gateway component to control the access rate of requests to access the resource server, and encryption and decryption operations are performed to protect communication security.

[0010] Furthermore, in step 3 of the method for implementing resource services based on OAuth2 and gateway, verifying the validity of the access token includes: verifying whether the access token is valid and whether it is expired. If the access token is invalid or expired, the request is rejected by the resource manager component, and an appropriate HTTP status code and error message are returned.

[0011] Furthermore, in step 3 of the method for implementing resource services based on OAuth2 and gateway, the resource manager component uses the Custom Reactive Authorization Manager to uniformly perform access token verification and permission scope check, and uses the authorization manager to set the validity period and transmission protocol of the access token.

[0012] The resource manager component uses the TokenTransferFilter filter to parse the access token and pass the parsed user information to the downstream service.

[0013] The present invention also provides a device for implementing resource services based on OAuth2 and a gateway, including an API gateway component and a resource manager component.

[0014] On the resource server side, create a resource manager component based on the OAuth 2.0 Resource Server component, and create an API gateway component based on Spring Cloud Gateway.

[0015] The API gateway component receives the access token carried by the client, verifies the validity of the access token, checks the permission scope of the verified access token, and determines whether the client has the right to access the corresponding resources. If the check passes, it forwards the request to the correct resource server, allowing the request to access the resource server.

[0016] The resource manager component receives the access token carried by the client, verifies the validity of the access token, checks the permission scope of the verified access token, and determines whether the client has the right to access the corresponding resources. If the check passes, the resource manager component provides the requested corresponding resources.

[0017] Furthermore, the API gateway component in the device for implementing resource services based on OAuth2 and gateway starts a customized current limiting strategy as needed, controls the access rate of requests to access the resource server, and performs encryption and decryption operations to protect communication security.

[0018] Furthermore, in the device for implementing resource services based on OAuth2 and a gateway, the resource manager component verifies the validity of an access token, including: verifying whether the access token is valid and whether it has expired. If the access token is invalid or has expired, the resource manager component rejects the request and returns an appropriate HTTP status code and error message.

[0019] Furthermore, in the device for implementing resource services based on OAuth2 and a gateway, the resource manager component uses the Custom Reactive Authorization Manager to uniformly perform access token verification and permission scope check, and uses the authorization manager to set the validity period and transmission protocol of the access token.

[0020] The resource manager component uses the TokenTransferFilter filter to parse the access token and pass the parsed user information to the downstream service.

[0021] The benefits of the present invention are:

[0022] (1) The resource manager component can safely protect resources from unauthorized access.

[0023] (ii) The authorization manager CustomReactiveAuthorizationManager in the resource manager component can be used to centrally and uniformly perform access token verification and permission checks, reducing the complexity of the architecture.

[0024] (3) The TokenTransferFilter in the resource manager component can parse the access token and pass the parsed user information to the downstream service.

[0025] (iv) The resource manager component can be designed to be scalable to support a large number of concurrent requests and use caching mechanisms, load balancing and other technologies to improve the overall performance of the service.

[0026] (V) Using the API gateway component as the unified front-end entrance, combined with the resource manager component, all request accesses can be authenticated and authorized, allowing for more flexible and effective management of API access.

[0027] (VI) The API Gateway component allows you to flexibly create routing rules and forward requests to the corresponding services.

[0028] (VII) Through the API gateway component, the current limiting strategy can be initiated as needed to enhance the availability of the system.

[0029] (8) Through the API gateway component, you can define unified security mechanisms such as encryption and decryption, signature addition and verification, and enhance the communication security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a schematic diagram of the application framework of the method of the present invention. DETAILED DESCRIPTION

[0031] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0032] Example 1

[0033] The present invention provides a method for implementing resource services based on OAuth2 and a gateway, comprising:

[0034] Step 1: On the resource server side, create a resource manager component based on the OAuth 2.0 Resource Server component and an API gateway component based on Spring Cloud Gateway. The resource manager component is responsible for protecting resources from unauthorized access and ensuring that only clients with valid access tokens can access protected resources. The API gateway component performs authentication, authorization, load balancing, and other functions to process all API requests entering the system.

[0035] Step 2: Receive the access token carried by the client through the API gateway component, verify the validity of the access token, check the permission scope of the verified access token, determine whether the client has the right to access the corresponding resources, and forward the request to the correct resource server if the check passes, so that the request can access the resource server.

[0036] The API gateway component can be used to start a custom current limiting strategy as needed to control the access rate of requests to the resource server, and perform encryption and decryption operations to protect communication security.

[0037] Step 3: Receive the access token carried by the client through the resource manager component, use the Custom Reactive Authorization Manager through the resource manager component to uniformly verify the access token and check the scope of authority, and use the authorization manager to set the validity period and transmission protocol of the access token. Use the TokenTransferFilter through the resource manager component to parse the access token and pass the user information obtained through the parsing to the downstream service.

[0038] Verify the validity of the access token. Verifying the validity of the access token may include: verifying whether the access token is valid and whether it has expired. If the access token is invalid or expired, the request is rejected through the resource manager component. The resource manager component handles various error situations, such as invalid access tokens, insufficient permissions, etc., and returns an appropriate HTTP status code and error message; if the verification passes, check the permission scope of the verified access token to determine whether the client has the right to access the corresponding resources. If the check passes, the corresponding resources requested are provided through the resource manager component.

[0039] The method of the present invention builds a secure and flexible microservice architecture by combining the use of an API gateway component and a resource manager component, and the architecture can effectively manage API access and ensure the security of data.

[0040] Example 2

[0041] The present invention also provides a device for implementing resource services based on OAuth2 and a gateway, including an API gateway component and a resource manager component.

[0042] On the resource server side, create a resource manager component based on the OAuth 2.0 Resource Server component, and create an API gateway component based on Spring Cloud Gateway.

[0043] The API gateway component receives the access token carried by the client, verifies the validity of the access token, checks the permission scope of the verified access token, and determines whether the client has the right to access the corresponding resources. If the check passes, it forwards the request to the correct resource server, allowing the request to access the resource server.

[0044] The resource manager component receives the access token carried by the client, verifies the validity of the access token, checks the permission scope of the verified access token, and determines whether the client has the right to access the corresponding resources. If the check passes, the resource manager component provides the requested corresponding resources.

[0045] As the information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention, the specific contents can be found in the description of the embodiment of the method of the present invention and will not be repeated here.

[0046] Likewise, the benefits of the device of the present invention are:

[0047] (1) The resource manager component can safely protect resources from unauthorized access.

[0048] (ii) The authorization manager CustomReactiveAuthorizationManager in the resource manager component can be used to centrally and uniformly perform access token verification and permission checks, reducing the complexity of the architecture.

[0049] (3) The TokenTransferFilter in the resource manager component can parse the access token and pass the parsed user information to the downstream service.

[0050] (iv) The resource manager component can be designed to be scalable to support a large number of concurrent requests and use caching mechanisms, load balancing and other technologies to improve the overall performance of the service.

[0051] (V) Using the API gateway component as the unified front-end entrance, combined with the resource manager component, all request access can be authenticated and authorized, which can manage API access more flexibly and effectively.

[0052] (VI) The API Gateway component allows you to flexibly create routing rules and forward requests to the corresponding services.

[0053] (VII) Through the API gateway component, the current limiting strategy can be initiated as needed to enhance the availability of the system.

[0054] (8) Through the API gateway component, you can define unified security mechanisms such as encryption and decryption, signature addition and verification, and enhance the communication security of the system.

[0055] It should be noted that not all steps and modules in the above-mentioned processes and device structures are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

[0056] The above-described embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Equivalent substitutions or changes made by those skilled in the art based on the present invention are within the protection scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A method for implementing resource services based on OAuth2 and gateway, characterized in that include: Step 1: On the resource server side, create a resource manager component based on the OAuth 2.0 Resource Server component and create an API gateway component based on Spring Cloud Gateway. Step 2: Receive the access token carried by the client through the API gateway component, verify the validity of the access token, check the permission scope of the verified access token, and determine whether the client has the right to access the corresponding resources. If the check passes, forward the request to the correct resource server so that the request can access the resource server. Step 3: Receive the access token carried by the client through the resource manager component, verify the validity of the access token, check the permission scope of the verified access token, determine whether the client has the right to access the corresponding resources, and provide the requested corresponding resources through the resource manager component if the check passes.

2. A method for implementing resource services based on OAuth2 and gateway according to claim 1, characterized in that In step 2, the API gateway component starts a custom current limiting strategy as needed to control the access rate of requests to the resource server, and performs encryption and decryption operations to protect communication security.

3. A method for implementing resource services based on OAuth2 and gateway according to claim 1, characterized in that Verifying the validity of the access token in step 3 includes: verifying whether the access token is valid and whether it has expired. If the access token is invalid or expired, the request is rejected through the resource manager component and an appropriate HTTP status code and error message are returned.

4. A method for implementing resource services based on OAuth2 and gateway according to claim 1, characterized in that In step 3, the resource manager component uses the Custom Reactive Authorization Manager to uniformly verify the access token and check the scope of authority, and uses the authorization manager to set the validity period and transmission protocol of the access token. The resource manager component uses the TokenTransferFilter filter to parse the access token and pass the parsed user information to the downstream service.

5. A device for implementing resource services based on OAuth2 and gateway, characterized in that Including API gateway components and resource manager components, On the resource server side, create a resource manager component based on the OAuth 2.0 Resource Server component, and create an API gateway component based on Spring Cloud Gateway. The API gateway component receives the access token carried by the client, verifies the validity of the access token, checks the permission scope of the verified access token, and determines whether the client has the right to access the corresponding resources. If the check passes, it forwards the request to the correct resource server, allowing the request to access the resource server. The resource manager component receives the access token carried by the client, verifies the validity of the access token, checks the permission scope of the verified access token, and determines whether the client has the right to access the corresponding resources. If the check passes, the resource manager component provides the requested corresponding resources.

6. The device for implementing resource services based on OAuth2 and gateway according to claim 5, characterized in that The API gateway component starts a customized current limiting strategy as needed to control the access rate of requests to the resource server, and performs encryption and decryption operations to protect communication security.

7. A method for implementing resource services based on OAuth2 and gateway according to claim 5, characterized in that The resource manager component verifies the validity of the access token, including: verifying whether the access token is valid and whether it has expired. If the access token is invalid or expired, the resource manager component rejects the request and returns an appropriate HTTP status code and error message.

8. The method for implementing resource services based on OAuth2 and gateway according to claim 5, characterized in that The resource manager component uses the Custom Reactive Authorization Manager to uniformly perform access token verification and permission scope checks, and uses the authorization manager to set the validity period and transmission protocol of the access token. The resource manager component uses the TokenTransferFilter filter to parse the access token and pass the parsed user information to the downstream service.

Images