「玩转腾讯云」API网关+云函数SCF开启OAuth2.0认证实战

如果在按照教程测试的时候遇到服务调用失败的情况，可以直接跳到第五步，查看以下避坑指北呦！

一、创建生成Json Web Token的云函数

按照https://cloud.tencent.com/document/product/628/38393文章的指导，在开启API网关的OAuth2.0认证之前必须新建OAuth认证服务器，下面我们用SCF云函数实现一个Golang版本的认证服务器

云函数代码如下

代码语言：go复制

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"github.com/dgrijalva/jwt-go"
	"github.com/google/uuid"
	"github.com/lestrrat-go/jwx/jwk"
	"github.com/tencentyun/scf-go-lib/cloudfunction"
	"log"
	"time"
)

// ssh-keygen -t rsa生成的私钥文件，可以根据需求替换成自己的私钥
var keyData = []byte("-----BEGIN RSA PRIVATE KEY-----nMIIEowIBAAKCAQEA4f5wg5l2hKsTeNem/V41fGnJm6gOdrj8ym3rFkEU/wT8RDtnnSgFEZOQpHEgQ7JL38xUfU0Y3g6aYw9QT0hJ7mCpz9Er5qLaMXJwZxzHzAahlfA0incqabvJOMvQtzD6uQv6wPEyZtDTWiQi9AXwBpHssPnpYGIn20ZZuNlX2BrClciHhCnPUIIZOQn/MmqTD31jSyjoQoV7MhhMTATKJx2XrHhR 1DcKJzQBSTAGnpYVaqpsARnap nwRipr3nUTuxyGohBTSmjJ2usSeQXHI3bODIRe1AuTyHceAbewn8b462yEWKAnRdpd9AjQW5SIVPfdsz5B6GlYQ5LdYKtznTuy7wIDAQABAoIBAQCwia1k7 2oZ2d3nn6agCAbqIE1QXfCmh41ZqJHbOY3oRQG3X1wpcGH4Gk O zDVTV2JszdcOt7E5dAynMaomETAhRxB7hlIOnEN7WKm dGNrKRvV0wDU5ReFMRHg31/Lnu8c 5BvGjZX ky9nPOIhFFYJqwCRlopGSUIxmVj5rSgtzk3iWOQXr ah1bjEXvlxDOWkHN6YfpV5ThdEnKdBIPGEVqa63r9n2h qazKrtiRqJqGnOrHzOECYbRFYhexsNFz7YT02xdfSHn7gMnIvabDDP/Qp0PjE1jdouiMaFHYnLBbgvlnZW9yuVf/rpXTUq/njxIXMmvmEyyvSDnnFcFikB8pAoGBAPF77hK4m3/rdGT7X8a/gwvZ2R121aBcdPwEaUhvj/36dx596zvYnmEOjrWfZhF083/nYWE2kVquj2wjs otCLfifEEgXcVPTnEOPO9Zg3uNSL0nNQghjnFuD3iGLTUBCtM66oTe0jLSslHe8gLGEQqyMzHOzYxNqibxcOZIe8Qt0NAoGBAO UnI5 XWjWEgDmvyC3TrOSf/KCGjtu0TSv30ipv27bDLMrpvPmD/5lpptTFwcxvVhCsn2b chCjlghFSWFbBULBrfci2FtliClOVMYrlNBdUSJhf3aYSG2Doe6Bgt1n2CpNnn/iu37Y3NfemZBJA7hNl4dYe f uzM87cdQ214 jrAoGAXA0XxX8ll2 ToOLJsaNTnOvNB9h9Uc5qK5X5w 7G7O998BN2PC/MWp8H 2fVqpXgNENpNXttkRm1hk1dych86nEunfdPuqsX as44oCyJGFHVBnWpm33eWQw9YqANRI pCJzP08I5WK3osnPiwshd nhR54yjgfYhBFNI7B95PmEQkCgYBzFSz7h1 s34Ycr8SvxsOBWxymG5zaCsUbPsL0n4aCgLScCHb9J E86aVbbVFdglYa5Id7DPTL61ixhl7WZjujspeXZGSbmq0KcnckbnmDgqkLECiOJW2NHP/j0McAkDLL4tysF8TLDO8gvuvzNC WQ6drO2ThrypLVZQ ryneBIPmwKBgEZxhqa0gVvHQG/7Od69KWj4eJP28kq13RhKay8JOoN0vPmspXJo1HY3nCKuHRG AP579dncdUnOMvfXOtkdM4vk0 hWASBQzM9xzVcztCa koAugjVaLS9A n9uQoqEeVNTckxx0S2bYevRy7hGQmUJTyQm3j1zEUR5jpdbL83Fbqn-----END RSA PRIVATE KEY-----")

func init()  {
	parsedKey, err := jwt.ParseRSAPrivateKeyFromPEM(keyData)
	if err != nil {
		log.Println(err)
	}
	publicKey, err := jwk.New(&parsedKey.PublicKey)

	if err != nil {
		log.Println(err)
	}

	jsonbuf, err := json.MarshalIndent(publicKey, "", "  ")
	if err != nil {
		log.Println(err)
	}
	fmt.Println("公钥：n", string(jsonbuf))
}

type Event struct {
	RequestContext struct {
		ServiceID  string `json:"serviceId"`
		Path       string `json:"path"`
		HTTPMethod string `json:"httpMethod"`
		RequestID  string `json:"requestId"`
		Identity   struct {
			SecretID string `json:"secretId"`
		} `json:"identity"`
		SourceIP string `json:"sourceIp"`
		Stage    string `json:"stage"`
	} `json:"requestContext"`
	Headers struct {
		AcceptLanguage string `json:"Accept-Language"`
		Accept         string `json:"Accept"`
		Host           string `json:"Host"`
		UserAgent      string `json:"User-Agent"`
		OAuthClientId string `json:"OAuth_Client_ID"`
		OAuthClientSecret string `json:"OAuth_Client_Secret"`
	} `json:"headers"`
	Body           string `json:"body"`
	PathParameters struct {
		Path string `json:"path"`
	} `json:"pathParameters"`
	QueryStringParameters struct {
		Code string `json:"code"`
		GrantType string `json:"grant_type"`
	} `json:"queryStringParameters"`
	HeaderParameters struct {
		Refer string `json:"Refer"`
	} `json:"headerParameters"`
	StageVariables struct {
		Stage string `json:"stage"`
	} `json:"stageVariables"`
	Path        string `json:"path"`
	QueryString struct {
		Foo string `json:"foo"`
		Bob string `json:"bob"`
	} `json:"queryString"`
	HTTPMethod string `json:"httpMethod"`
}

type Claims struct {
	Username string `json:"username"`
	jwt.StandardClaims
}

func integratedResponse(body map[string]interface{}) (map[string]interface{}, error) {
	response := make(map[string]interface{})
	response["isBase64Encoded"] = false
	response["statusCode"] = 200
	headers := make(map[string]string)
	headers["Content-Type"] = "application/json"
	response["headers"] = headers

	js, err := json.Marshal(body)
	if err != nil {
		log.Println("3333", err)
	}

	response["body"] = fmt.Sprintf("%s", js)
	return response, nil
}

func getToken(ctx context.Context, event Event) (map[string]interface{}, error) {
	result := make(map[string]interface{})
	if event.QueryStringParameters.Code != "cloud.tencent.com" || event.Headers.OAuthClientId != "cloud.tencent.com" || event.Headers.OAuthClientSecret != "cloud.tencent.com" {
		result["error"] = "error param!"
		result["error_code"] = 10021

		return integratedResponse(result)
	}

	expirationTime := time.Now().Add(5 * time.Minute)
	claims := &Claims{
		Username: "admin",
		StandardClaims: jwt.StandardClaims{
			ExpiresAt: expirationTime.Unix(),
		},
	}

	parsedKey, err := jwt.ParseRSAPrivateKeyFromPEM(keyData)
	if err != nil {
		log.Println("1111", err)
		result["error"] = "secret key parse error!"
		result["error_code"] = 10022
		return integratedResponse(result)
	}

	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
	tokenString, err := token.SignedString(parsedKey)
	if err != nil {
		log.Println("2222", err)
		result["error"] = "generate token error"
		return integratedResponse(result)
	}

	result["refresh_token"], _ = uuid.NewUUID()
	result["id_token"] = tokenString
	result["token_type"] = "Bearer"
	result["expires_in"] = 300
	return integratedResponse(result)
}

func main() {
	// Make the handler available for Remote Procedure Call by Cloud Function
	cloudfunction.Start(getToken)
}

1、执行以下命令将如上golang代码编译