Public/cf_imes_server
6
0
Fork 0
mirror of http://192.168.1.205:9980/cf_devdept2/cf_imes_server.git synced 2026-08-12 21:02:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

es账号密码加解密和是否开启账号密码解耦，支持不需要加解密也可以用账号密码连接、新增支持证书从外部读取

Browse Source
This commit is contained in:
gaoqr
2024-11-01 16:33:23 +08:00
parent df4dfd2b58
commit d7c4fc1df3
4 changed files with 70 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cf-framework/cf-spring-boot-starter-elasticsearch/src/main/java/com/cf/imes/framework/es/config/ChenfengElasticsearchAutoConfiguration.java
+52 -35
View File
@@ -1,5 +1,8 @@
package com.cf.imes.framework.es.config;
import cn.hutool.core.io.FileUtil;
import cn.hutool.core.text.CharSequenceUtil;
import cn.hutool.core.util.ObjectUtil;
import co.elastic.clients.elasticsearch.ElasticsearchAsyncClient;
import co.elastic.clients.elasticsearch.ElasticsearchClient;
import co.elastic.clients.json.jackson.JacksonJsonpMapper;
@@ -26,12 +29,13 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.core.io.ClassPathResource;
import org.springframework.util.StringUtils;
import javax.net.ssl.SSLContext;
import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
@@ -95,25 +99,7 @@ public class ChenfengElasticsearchAutoConfiguration {
@Bean
@ConditionalOnProperty(name = "chenfeng.encrypt.enable", havingValue = "true")
public RestClient getAuthRestClient(EsProperties properties) {
// 配置账号密码
final CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
credentialsProvider.setCredentials(AuthScope.ANY,
new UsernamePasswordCredentials(AesUtils.decrypt(properties.getUsername(), publicKey), AesUtils.decrypt(properties.getPassword(), publicKey)));
RestClientBuilder.HttpClientConfigCallback httpClientConfigCallback = httpClientBuilder -> {
// 设置账号密码、连接信息
HttpAsyncClientBuilder httpAsyncClientBuilder = httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider)
.setDefaultRequestConfig(RequestConfig.custom()
.setConnectTimeout(properties.getConnectionTimeout().toSecondsPart())
.setSocketTimeout(properties.getSocketTimeout().toSecondsPart())
.setConnectionRequestTimeout(properties.getConnectionRequestTimeout().toSecondsPart())
.build());
if (properties.isSecurityHttpSslEnable()) {
// 开启ssl配置连接证书
httpAsyncClientBuilder.setSSLContext(buildSSLContext()).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
}
return httpAsyncClientBuilder;
};
return RestClient.builder(toHttpHost(properties.getUris(), properties.isSecurityHttpSslEnable())).setHttpClientConfigCallback(httpClientConfigCallback).build();
return getRestClient(properties, true);
}
/**
@@ -125,31 +111,62 @@ public class ChenfengElasticsearchAutoConfiguration {
@Bean
@ConditionalOnProperty(name = "chenfeng.encrypt.enable", havingValue = "false", matchIfMissing = true)
public RestClient getRestClient(EsProperties properties) {
return RestClient.builder(toHttpHost(properties.getUris(), properties.isSecurityHttpSslEnable())).setRequestConfigCallback(requestConfigBuilder -> {
requestConfigBuilder.setConnectTimeout(properties.getConnectionTimeout().toSecondsPart());
requestConfigBuilder.setSocketTimeout(properties.getSocketTimeout().toSecondsPart());
requestConfigBuilder.setConnectionRequestTimeout(properties.getConnectionRequestTimeout().toSecondsPart());
return requestConfigBuilder;
}).build();
return getRestClient(properties, false);
}
/**
* 动态获取es client连接
*
* @param properties 配置
* @param needDecrypt 敏感信息是否需要解密
* @return
*/
private RestClient getRestClient(EsProperties properties, boolean needDecrypt) {
// 配置账号密码
CredentialsProvider credentialsProvider;
String username = properties.getUsername();
String password = properties.getPassword();
if (CharSequenceUtil.isAllNotEmpty(username, password)) {
credentialsProvider = new BasicCredentialsProvider();
credentialsProvider.setCredentials(AuthScope.ANY,
new UsernamePasswordCredentials(needDecrypt ? AesUtils.decrypt(username, publicKey) : username, needDecrypt ? AesUtils.decrypt(password, publicKey) : password));
} else {
credentialsProvider = null;
}
RestClientBuilder.HttpClientConfigCallback httpClientConfigCallback = httpClientBuilder -> {
// 设置账号密码、连接信息
HttpAsyncClientBuilder httpAsyncClientBuilder = httpClientBuilder
.setDefaultRequestConfig(RequestConfig.custom()
.setConnectTimeout(properties.getConnectionTimeout().toSecondsPart())
.setSocketTimeout(properties.getSocketTimeout().toSecondsPart())
.setConnectionRequestTimeout(properties.getConnectionRequestTimeout().toSecondsPart())
.build());
if (ObjectUtil.isNotNull(credentialsProvider)) {
httpAsyncClientBuilder.setDefaultCredentialsProvider(credentialsProvider);
}
if (properties.isSecurityHttpSslEnable()) {
// 开启ssl配置连接证书
httpAsyncClientBuilder.setSSLContext(buildSSLContext(properties.getCertificatePath())).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
}
return httpAsyncClientBuilder;
};
return RestClient.builder(toHttpHost(properties.getUris(), properties.isSecurityHttpSslEnable())).setHttpClientConfigCallback(httpClientConfigCallback).build();
}
/**
* 构建ssl请求信息
*
* @param certificatePath 证书地址
* @return
*/
private SSLContext buildSSLContext() {
private SSLContext buildSSLContext(String certificatePath) {
SSLContext sslContext = null;
try {
ClassPathResource resource = new ClassPathResource("http_ca.crt");
CertificateFactory factory = CertificateFactory.getInstance("X.509");
Certificate trustedCa;
try (InputStream is = resource.getInputStream()) {
trustedCa = factory.generateCertificate(is);
}
Path trustStorePath = Paths.get(certificatePath);
KeyStore trustStore = KeyStore.getInstance("pkcs12");
trustStore.load(null, null);
trustStore.setCertificateEntry("ca", trustedCa);
try (InputStream is = FileUtil.getInputStream(trustStorePath)) {
trustStore.load(is, "elastic".toCharArray());
}
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, null);
sslContext = sslContextBuilder.build();
cf-framework/cf-spring-boot-starter-elasticsearch/src/main/java/com/cf/imes/framework/es/config/EsProperties.java
+10
View File
@@ -42,6 +42,8 @@ public class EsProperties {
private boolean securityHttpSslEnable = false;
private String certificatePath;
public String getUris() {
return uris;
}
@@ -105,4 +107,12 @@ public class EsProperties {
public void setConnectionRequestTimeout(Duration connectionRequestTimeout) {
this.connectionRequestTimeout = connectionRequestTimeout;
}
public String getCertificatePath() {
return certificatePath;
}
public void setCertificatePath(String certificatePath) {
this.certificatePath = certificatePath;
}
}
cf-module-prod-executor/cf-module-prod-executor-biz/src/main/resources/application-dev.yaml
+4
View File
@@ -70,6 +70,10 @@ spring:
bootstrap-servers: 127.0.0.1:9092 # 指定 Kafka Broker 地址，可以设置多个，以逗号分隔
elasticsearch:
uris: 192.168.1.205:9200
security-http-ssl-enable: false
username: elastic
password: admin.
--- #################### 定时任务相关配置 ####################
xxl:
job:
cf-module-system/cf-module-system-biz/src/main/resources/application-dev.yaml
+4
View File
@@ -70,6 +70,10 @@ spring:
bootstrap-servers: 127.0.0.1:9092 # 指定 Kafka Broker 地址，可以设置多个，以逗号分隔
elasticsearch:
uris: 192.168.1.205:9200
security-http-ssl-enable: false
username: elastic
password: admin.
--- #################### 定时任务相关配置 ####################
xxl:
job: