Redis realizes single sign on -- system framework construction (I)

Environmental requirements ：redis3.8.2+maven+springBoot+jdk1.8+freemarker Templates

1、 Demand background

At home on weekends , Last colleague suddenly contacted , Let me do a single sign on function for his website , So I sort out the logic first , Realize the function and record .

Single sign in (Single sign on) seeing the name of a thing one thinks of its function , After a website logs in , Other websites do not need users to continue to enter account passwords , And can login without secret , This technology is used very frequently in large websites , For example, Alibaba , When users log in to their system , Each subsystem can log in automatically , If you log in to a treasure , Log in to a monument , You also need a password , You also need to re-enter your password to log in to Taobao , This will definitely result in a very poor user experience , And the authentication logic of the system will also be troublesome , At this time, single sign on appears .

2、 Code instance

This article demonstrates two systems

@Slf4j
@RestController
@RequestMapping("/redis/single")
public class RedisSingleController {

    private static final String NAME = "name";
    private static final String PASSWORD = "password";

    @Resource
    private RedisTemplate redisTemplate;

    @GetMapping("/login_page")
    public ModelAndView loginPage(){
        ModelAndView mv  = new ModelAndView();
        mv.setViewName("loginPage");
        return mv;
    }

    /**
     *  System 1
     * @return
     */
    @GetMapping("/system1")
    public ModelAndView system1(HttpServletRequest request){
        ModelAndView mv  = new ModelAndView();
        if(redisTemplate.hasKey("name")){
            mv.setViewName("systemOnePage");
            return mv;
        }
        request.getSession().setAttribute("goUrl","indexSystem1");
        mv.setViewName("loginPage");
        return mv;
    }

    /**
     *  System 2
     * @return
     */
    @GetMapping("/system2")
    public ModelAndView system2(HttpServletRequest request){
        ModelAndView mv  = new ModelAndView();
        if(redisTemplate.hasKey("name")){
            mv.setViewName("systemTwoPage");
            return mv;
        }
        request.getSession().setAttribute("goUrl","indexSystem2");
        mv.setViewName("loginPage");
        return mv;
    }

    /**
     *  Verify whether the account and password are normal 
     * @param name
     * @param password
     * @return
     */
    @PostMapping("/detection")
    @ResponseBody
    public Map<String, Object> index( String name, String password, String gotoUrl){
        Map<String, Object> map = new HashMap<>();
        if(!ObjectUtil.equals(name,NAME) || !ObjectUtil.equals(password,PASSWORD)){
            map.put("flag",false);
            map.put("data"," Account password does not match !");
            return map;
        }
        map.put("flag",true);
        map.put("data"," Correct account password !");
        //redis cache 20s invalid 
        redisTemplate.opsForValue().set("name",name,10, TimeUnit.SECONDS);
        return map;
    }

    /**
     *  Login successful , As soon as the system enters the home page 
     * @return
     */
    @GetMapping("/indexSystem1")
    @ResponseBody
    public ModelAndView index(){
        ModelAndView mv  = new ModelAndView();
        mv.setViewName("systemOnePage");
        return mv;
    }

    /**
     *  Login successful , System 2 enters the home page 
     * @return
     */
    @GetMapping("/indexSystem2")
    @ResponseBody
    public ModelAndView indexSystem2(){
        ModelAndView mv  = new ModelAndView();
        mv.setViewName("systemTwoPage");
        return mv;
    }

Copy

1、 Ensure that when accessing the login page of the system , Enter the first homepage of the system , When visiting the login page of system 2 , Enter the homepage of system 2 .

2、 When accessing system one or system two , We need to judge redis Whether there is a current user in , If it exists, login without secret .

3、 Logical processing , Before logging in, first judge whether the account and password in the database are correct , If the user logs in correctly on the page , Then it returns login success , And put in redis, Set an expiration time for him .

4、 Guaranteed at redis Other subsystems can log in without secret within the expiration time .