文档首页/ 云客服/ API参考/ 知识库管理/ 鉴权方式/ 知识库类接口鉴权方式
更新时间:2023-09-27 GMT+08:00

知识库类接口鉴权方式

AK/SK获取方式

AK/SK认证

AK/SK认证就是使用AK/SK对请求进行签名,在请求时将签名信息添加到消息头,从而通过身份认证。

  • AK(Access Key ID):访问密钥ID。与私有访问密钥关联的唯一标识符;访问密钥ID和私有访问密钥一起使用,对请求进行加密签名。

  • SK(Secret Access Key):与访问密钥ID结合使用的密钥,对请求进行加密签名,可标识发送方,并防止请求被修改。

使用AK/SK认证时,您可以基于签名算法使用AK/SK对请求进行签名。

私有AK、SK获取方式

  • 集成环境:请联系运营人员获取。

接口鉴权如果通过 ,则http响应码为200;如果不通过,则http的响应码为401。

鉴权算法

下面以CC-CMS接口为例介绍鉴权算法,其余容器化网元CC-iKBS、虚拟化网元CC-FS、CC-iSales的鉴权算法可直接参考。

所有接口服务器端都会对客户端的请求数据做鉴权签名验证,鉴权流程如下:

调用者生成Authorization的生成规则内容如下:

各内容的算法和规则

  • SignInfo

    该类主要包含一些固定HEAD的定义,以及一些用于构造CanonicalRequest和Signature的基本函数。

package com.huawei.client.rest.v2.demo.sign;

import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.HashMap;
import java.util.Locale;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Set;
import java.util.TimeZone;
import java.util.TreeSet;

@Setter
@Getter
public class SignInfo
{
	public static final String HEAD_AUTHORIZATION = "authorization";
	public static final String HEAD_HOST = "host";
	public static final String HEAD_CONTENT_LENGTH = "Content-Length";
	public static final String HEAD_CONTENT_TYPE = "Content-Type";
	public static final String TIMESTAMP_FORMAT = "yyyy-MM-dd'T'HH:mm:ss'Z'";

	// 默认值,不用设置
	private String authVersion = "auth-v2";

	private String httpMethod;
	private String uri;

	// 当前服务侧暂无GET支持
	private Map<String, String> queryParameters;

	private Map<String, String> signedHeaders;
	private String payload;
	private String accessKey;
	private String secretKey;
	private Date timestamp;

	public String authString() throws NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException
	{
		String authStringPrefix = this.authStringPrefix();
		String signingKey = SignerUtils.sha256Hex(this.getSecretKey(), authStringPrefix);
		String canonicalRequest = this.canonicalRequest();
		String signature = SignerUtils.sha256Hex(signingKey, canonicalRequest);
		String authString = authStringPrefix + '/' + signature;

		return authString;
	}

	public String authStringPrefix()
	{
		StringBuilder buffer = new StringBuilder();
		buffer.append(this.authVersion);
		buffer.append('/').append(this.accessKey);
		buffer.append('/').append(this.formatTimestamp());
		buffer.append('/');
		this.appendSignedHeaders(buffer);

		return buffer.toString();
	}

	public String canonicalRequest()
	{
		StringBuilder buffer = new StringBuilder();
		buffer.append(this.httpMethod).append('\n');
		buffer.append(this.uri).append('\n');

		if (this.isNotEmpty(this.queryParameters))
		{
			this.appendCanonicalQueryString(buffer);
			buffer.append('\n');
		}

		this.appendSignedHeaders(buffer);
		buffer.append('\n');

		this.appendCanonicalHeaders(buffer);
		buffer.append('\n');

		if (this.isNotEmpty(this.payload))
		{
			buffer.append(PathUtils.normalize(this.payload));
		}

		return buffer.toString();
	}

	private String appendSignedHeaders(StringBuilder buffer)
	{
		int start = buffer.length();

		Set<String> headerNames = new TreeSet<>(this.signedHeaders.keySet());
		for (String name : headerNames)
		{
			buffer.append(name.toLowerCase(Locale.ENGLISH)).append(';');
		}
		buffer.deleteCharAt(buffer.length() - 1);

		int end = buffer.length();
		String signedHeadersStr = buffer.substring(start, end);
		return signedHeadersStr;
	}

	private String appendCanonicalHeaders(StringBuilder buffer)
	{
		int start = buffer.length();

		Set<String> headers = new TreeSet<>();
		for (Map.Entry<String, String> entry : this.signedHeaders.entrySet())
		{
			String header = PathUtils.normalize(entry.getKey()) + ':' 
                        + PathUtils.normalize(entry.getValue());
			headers.add(header);
		}
		for (String header : headers)
		{
			buffer.append(header).append('\n');
		}
		buffer.deleteCharAt(buffer.length() - 1);

		int end = buffer.length();
		String canonicalHeadersStr = buffer.substring(start, end);
		return canonicalHeadersStr;
	}

	private void appendCanonicalQueryString(StringBuilder buffer)
	{
		// 编码并排序
		Set<String> sortedSet = new TreeSet<>();
		for (Map.Entry<String, String> e : this.queryParameters.entrySet())
		{
			String uriEncodeKey = PathUtils.normalize(e.getKey());
			String uriEncodeValue = this.isNotEmpty(e.getValue()) ? PathUtils.normalize(e.getValue()) : "";
			sortedSet.add(uriEncodeKey + "=" + uriEncodeValue);
		}

		for (String e : sortedSet)
		{
			buffer.append(e).append('&');
		}
		buffer.deleteCharAt(buffer.length() - 1);
	}

	private String formatTimestamp()
	{
		SimpleDateFormat format = new SimpleDateFormat(SignInfo.TIMESTAMP_FORMAT);
		format.setTimeZone(TimeZone.getTimeZone("UTC"));
		return format.format(this.timestamp);
	}

	private boolean isNotEmpty(String str)
	{
		if ((null == str) || str.isEmpty())
		{
			return false;
		}
		return true;
	}

	private <K, V> boolean isNotEmpty(Map<K, V> map)
	{
		if ((null == map) || map.isEmpty())
		{
			return false;
		}
		return true;
	}
}

其中,SignInfo类用到的PathUtils工具类如下:

package com.huawei.client.rest.v2.demo.utils;

import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URLDecoder;
import java.util.BitSet;

public class PathUtils {

	private static final String CHARSET = "UTF-8";

	private static BitSet URI_UNRESERVED_CHARACTERS = new BitSet();

	private static String[] PERCENT_ENCODED_STRINGS = new String[256];

	static {
		for (int i = 97; i <= 122; i++) {
			PathUtils.URI_UNRESERVED_CHARACTERS.set(i);
		}
		for (int i = 65; i <= 90; i++) {
			PathUtils.URI_UNRESERVED_CHARACTERS.set(i);
		}
		for (int i = 48; i <= 57; i++) {
			PathUtils.URI_UNRESERVED_CHARACTERS.set(i);
		}
		PathUtils.URI_UNRESERVED_CHARACTERS.set(45);
		PathUtils.URI_UNRESERVED_CHARACTERS.set(46);
		PathUtils.URI_UNRESERVED_CHARACTERS.set(95);
		PathUtils.URI_UNRESERVED_CHARACTERS.set(126);

		for (int i = 0; i < PathUtils.PERCENT_ENCODED_STRINGS.length; i++) {
			PathUtils.PERCENT_ENCODED_STRINGS[i] = String.format("%%%02X", new Object[] {Integer.valueOf(i)});
		}
	}

	public static String normalizePath(String path) {
		return PathUtils.normalize(path).replace("%2F", "/");
	}

	public static String normalize(String value) {
		try {
			StringBuilder builder = new StringBuilder();
			for (byte b : value.getBytes(PathUtils.CHARSET)) {
				if (PathUtils.URI_UNRESERVED_CHARACTERS.get(b & 0xFF)) {
					builder.append((char) b);
				} else {
					builder.append(PathUtils.PERCENT_ENCODED_STRINGS[(b & 0xFF)]);
				}
			}
			return builder.toString();
		} catch (UnsupportedEncodingException e) {
			throw new RuntimeException(e);
		}
	}

	/**
	 * URL 归一化处理
	 *
	 * @param url
	 * @return
	 */
	public static String normalizeURL(String url) {
		try {
			return URLDecoder.decode(new URI(url).normalize().toString(), PathUtils.CHARSET);
		} catch (URISyntaxException | UnsupportedEncodingException e) {
			return url;
		}
	}

	public static void main(String[] args)
	{
		System.out.println(PathUtils.normalize("123%456"));
	}

}
  • SignedHeaders

    调用者对HTTP请求中的Header部分进行选择性编码,也可以自行决定哪些Header参与编码,唯一要求是Host域必须被编码,但headname=“Authorization”的head不能参与编码计算,因为Authorization是最终鉴权head域。

    备注:Host的值为对应服务的https地址中的ip:port 。

    大多数情况下,我们推荐对以下Header进行编码:

    Host="10.22.26.181:28080"  
    Content-Length="22"
    Content-Type="application/json;charset=UTF-8"
    • 内容计算规则:

      遍历参与编码的HttpHead里面的Header name

      1. 把Header name都改为小写,即调用lowerCase()函数
      2. 把上面Header name转换后的字符后面追加分割符";",生成一条记录,注意最后一个字段不追加";";
      3. 把上面所有记录按照字典排序,然后按照顺序连接成一个大字符串。
    • 代码实现:
      1. 构建signedHeaders的Map,填充所需字段信息,然后调用lowerCaseSignedHeaders函数进行字符处理:
        // 参与签名鉴权的head字段,host字段是必须的
        Map<String, String> signedHeaders = new HashMap<>();
        signedHeaders.put(SignInfo.HEAD_HOST, CmsParameters.host);
        signedHeaders.put(SignInfo.HEAD_CONTENT_LENGTH, String.valueOf(bodyJson.getBytes("UTF-8").length));
        signedHeaders.put(SignInfo.HEAD_CONTENT_TYPE, "application/json;charset=UTF-8");
        
        // 鉴权数据接口设置
        SignInfo signInfo = new SignInfo();
        signInfo.setAccessKey(CmsParameters.accessKey);
        signInfo.setSecretKey(CmsParameters.secretKey);
        signInfo.setPayload(bodyJson);
        signInfo.setTimestamp(new Date());
        signInfo.setHttpMethod(HttpProxyHelper.HTTP_METHOD_POST);
        signInfo.setUri(httpPath);
        signInfo.setSignedHeaders(lowerCaseSignedHeaders(signedHeaders));
        

        以上函数的完整代码参见:1.如何调通第一个接口:

      2. 函数:lowerCaseSignedHeaders的具体实现:
        /**
         * 参与计算的signedHeaders进行转换
         * @param
         * @return Map<String, String>
         */
        private Map<String, String> lowerCaseSignedHeaders(Map<String, String> signedHeaders)
        {
        	if ((null == signedHeaders) || signedHeaders.isEmpty())
        	{
        		throw new IllegalArgumentException("signedHeaders cann't be null.");
        	}
        	Map<String, String> headers = new HashMap<>();
        	for (Entry<String, String> e : signedHeaders.entrySet())
        	{
        		String name = e.getKey();
        		String value = e.getValue();
        		headers.put(name.toLowerCase(Locale.ENGLISH), value.trim());
        	}
        	if (!signedHeaders.containsKey(SignInfo.HEAD_HOST))
        	{
        		throw new IllegalArgumentException("signedHeaders must has host.");
        	}
        	return headers;
        }	
    • 具体例子:
      例子:参与编码的HttpHead如下:
      Host="10.22.26.181:28080"  
      Content-Length="22"
      Content-Type="application/json;charset=UTF-8"
      经过上述规则处理后为:
      SignedHeaders=content-length;content-type;host
  • CanonicalHeaders

    其要求计算的编码规则与SignedHeaders一致,但增加了head value的编码。

    • 内容计算规则:

      遍历参与编码的HttpHead里面的head name

      1. 把Header name都改为小写,即调用lowerCase()函数
      2. 调用NormalizePath函数,对刚才转换后的小写字符串进行格式化;
      3. 格式化后的字符串+":"+NormalizePath((Header value).trim()),生成一条记录字符串;
      4. 把上面的记录按照字典排序,进行排序;
      5. 遍历排序后的记录,中间追加字符串"\n"连接成一个大的字符串:

      最后一条记录不追加"\n"。

      例子:参与编码的HttpHead如下:
      Host="10.22.26.181:28080"  
      Content-Length="22"
      Content-Type="application/json;charset=UTF-8"
      经过上述规则处理后CanonicalHeaders为:
      content-length:22\n
      content-type:application%2Fjson%3Bcharset%3DUTF-8\n
      host:10.22.26.181%3A28080
  • CanonicalRequest
    • 内容计算规则:
      CanonicalRequest = $HttpMethod + "\n" + $HttpURI+ "\n" + $HttpParameters + "\n" + SignedHeaders($HttpHeaders) + "\n" + CanonicalHeaders ($HttpHeaders) + "\n" + NormalizePath($HttpBody)

      参数描述:

      1. $HttpMethod,指HTTP协议中定义的GET、PUT、POST等请求,必须使用全大写的形式。所涉及的HTTP Method有:GET、POST、PUT、DELETE、HEAD,但当前CC-CMS服务仅支持POST这1种;
      2. $HttpURI,指接口请求的http URI,比如完整url为https://10.22.26.181:28080/rest/cmsapp/v1/ping那么HttpURI就为/rest/cmsapp/v1/ping ,必须以“/”开头,不以“/”开头的需要补充上,空路径为“/”;
      3. $HttpParameters, 指接口请求URI后面的请求参数,比如https://10.22.26.181:28080/rest/cmsapp/v1/ping?id=123&name=test,那么HttpParameters就为id=123&name=test,CC-CMS接口目前没有该参数。
      4. $HttpBody:是通过HTTP BODY体提交到服务器端的字符串,该字符串的形式为标准JSON串,具体字段见各接口的定义。
    • 代码实现:

      参见•SignInfo中的canonicalRequest()函数。

  • 生成认证字符串Authorization
    • 内容计算规则:
      1. 首先生成authStringPrefix和SigningKey
        1. 关于authStringPrefix和SigningKey的生成规则:
          authStringPrefix="auth-v2/{accessKey}/{timestamp}/{SignedHeaders}";
          SigningKey = sha256Hex(secretKey, authStringPrefix);

          说明:

          auth-v2:鉴权版本号,当期版本为固定字符串“auth-v2”;

          accessKey:调用者的鉴权ID,即AK;

          secretKey:调用者的鉴权密钥,即SK;

          timestamp:调用者端生成的UTC时间,时间字符串格式化为"yyyy-MM-dd'T'HH:mm:ss'Z'";

        2. 代码实现:authStringPrefix

          生成authStringPrefix的函数在SignInfo类的如下两个函数中实现

          authStringPrefix()
          appendSignedHeaders(StringBuilder buffer)

        3. 代码实现:SigningKey:

          参见SignInfo类的authString()中,

          String signingKey = SignerUtils.sha256Hex(this.getSecretKey(), authStringPrefix);
          其中的sha256Hex()加密算法:参见如下工具类
          package com.huawei.client.rest.v2.demo.utils;
          
          import java.io.UnsupportedEncodingException;
          import java.security.InvalidKeyException;
          import java.security.NoSuchAlgorithmException;
          
          import javax.crypto.Mac;
          import javax.crypto.spec.SecretKeySpec;
          
          /**
           * Rest接口认证摘要算法工具类
           */
          public class SignerUtils {
          	
          	private static final String CHARSET = "UTF-8";	
          	private static final char[] DIGITS_LOWER = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
          	
          	/**
          	 * 摘要算法
          	 * @param key
          	 * @param toSigned
          	 * @return String
          	 * @throws NoSuchAlgorithmException
          	 * @throws InvalidKeyException
          	 * @throws UnsupportedEncodingException
          	 */
          	public static String sha256Hex(String key, String toSigned) throws NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException {
          		Mac mac = Mac.getInstance("HmacSHA256");
          		mac.init(new SecretKeySpec(key.getBytes(SignerUtils.CHARSET), "HmacSHA256"));
          		
          		String digit = new String(SignerUtils.encodeHex(mac.doFinal(toSigned.getBytes(SignerUtils.CHARSET))));
          		return digit;
          	}
          	
          	private static char[] encodeHex(final byte[] data) {
          		final int l = data.length;
          		final char[] out = new char[l << 1];
          		for (int i = 0, j = 0; i < l; i++) {
          			out[j++] = SignerUtils.DIGITS_LOWER[(0xF0 & data[i]) >>> 4];
          			out[j++] = SignerUtils.DIGITS_LOWER[0x0F & data[i]];
          		}
          		return out;
          	}	
          }

      1. 生成签名Signature
        1. 签名的生成规则:
          Signature = sha256Hex(SigningKey, CanonicalRequest)
        2. 代码实现:包含加密函数:sha256Hex

          参见上述:c.代码实现:SigningKey:SigningKey中的sha256Hex()实现方法。

      2. 认证字符串
        1. 认证字符串的生成规则:
          Authorization:$authStringPrefix/$Signature
        2. 代码实现:其中,signedHeaders为上述signedHeaders模块中构建的Map。
          // 生成签名
          String signature = signInfo.authString();
          Map<String, String> httpHeads = new HashMap<>(signedHeaders);
          // 追加到HTTPHEAD,发送到服务器端
          httpHeads.put(SignInfo.HEAD_AUTHORIZATION, signature);

  • 完整例子
    1. 如何调通第一个接口:

      调通一个接口,鉴权是必要的一环。

      在该项目中,鉴权入口在于buildSignHttpHead()函数,该函数构造了signedHeaders的Map,并将改Map传入SignInfo中;

      SignInfo类中的函数authString() ,揭示了构造认证字符串的主要过程,生成signature签名;

      而认证字符串的关键组成部分,则为签名。其余的信息拼接函数,也在SignInfo类中体现。

      定义请求的BaseRequest:

      package com.huawei.client.rest.v2.demo.base;
      
      @Setter
      @Getter
      public class BaseRequest
      {
      	private RequestHeader request;
      
      	private Object msgBody;
      
      	public BaseRequest(Object body)
      	{
      		this.request = new RequestHeader();
      		this.msgBody = body;
      	}
      
      	public BaseRequest(RequestHeader head, Object body)
      	{
      		this.request = head;
      		this.msgBody = body;
      	}
      
      	public RequestHeader getRequest()
      	{
      		return this.request;
      	}
      
      	public void setRequest(RequestHeader request)
      	{
      		this.request = request;
      	}
      
      	public Object getMsgBody()
      	{
      		return this.msgBody;
      	}
      
      	public void setMsgBody(Object msgBody)
      	{
      		this.msgBody = msgBody;
      	}
      
      }

      其中,RequestHeader如下:

      package com.huawei.client.rest.v2.demo.base;
      
      public class RequestHeader
      {
      	/**
      	 * 版本号
      	 */
      	private String version = "2.0";
      	
      	public String getVersion()
      	{
      		return this.version;
      	}
      	
      	public void setVersion(String version)
      	{
      		this.version = version;
      	}
      
      }

      定义请求的BaseResponse:

      package com.huawei.client.rest.v2.demo.base;
      
      @Setter
      @Getter
      public class BaseResponse
      {
      
      	final static int SUCCESS = 0;
      
      	private ResponseHead resultHead;
      
      	private Object resultData;
      
      	public BaseResponse()
      	{
      
      	}
      
      	public BaseResponse(String resultCode, String resultMsg, Object resultData)
      	{
      		this.resultHead = new ResponseHead(resultCode, resultMsg);
      		this.resultData = resultData;
      	}
      
      	public BaseResponse(ResponseHead resultHead, Object resultData)
      	{
      		this.resultHead = resultHead;
      		this.resultData = resultData;
      	}
      }

      其中,ResponseHead如下:

      package com.huawei.client.rest.v2.demo.base;
      
      public class ResponseHead
      {
      	private String resultCode;
      
      	/**
      	 * 响应结果
      	 */
      	private String resultMsg;
      
      	public ResponseHead()
      	{
      	}
      
      	public ResponseHead(String resultCode, String resultMsg)
      	{
      		this.resultCode = resultCode;
      		this.resultMsg = resultMsg;
      	}
      
      	public String getResultCode()
      	{
      		return this.resultCode;
      	}
      
      	public void setResultCode(String resultCode)
      	{
      		this.resultCode = resultCode;
      	}
      
      	public String getResultMsg()
      	{
      		return this.resultMsg;
      	}
      
      	public void setResultMsg(String resultMsg)
      	{
      		this.resultMsg = resultMsg;
      	}
      
      }

      buildSignHttpHead()函数的具体实现参见ToolUtils:

      package com.huawei.client.rest.v2.demo.utils;
      
      import java.io.BufferedReader;
      import java.io.File;
      import java.io.FileOutputStream;
      import java.io.FileReader;
      import java.io.InputStream;
      import java.io.UnsupportedEncodingException;
      import java.security.InvalidKeyException;
      import java.security.NoSuchAlgorithmException;
      import java.text.SimpleDateFormat;
      import java.util.ArrayList;
      import java.util.Date;
      import java.util.HashMap;
      import java.util.List;
      import java.util.Locale;
      import java.util.Map;
      import com.alibaba.fastjson.JSONObject;
      
      import com.huawei.client.rest.v2.demo.HttpProxyHelper;
      import com.huawei.client.rest.v2.demo.base.BaseRequest;
      import com.huawei.client.rest.v2.demo.config.CmsParameters;
      import com.huawei.client.rest.v2.demo.sign.SignInfo;
      
      /**
       * Rest接口认证摘要算法工具类
       */
      public class ToolUtils {
      	/**
      	 * 由字符串转换成文件工具
      	 * @param in
      	 * @param filePath
      	 * @param fileName
      	 * @return
      	 */
      	public static boolean saveToFileByStr(InputStream in, String filePath, String fileName){
      		boolean flag = true;
      		if(in != null){
      			try {
      				// 将上面生成的文件格式字符串 fileStr,还原成文件显示
      
      				File file=new File(filePath,fileName);
      				FileOutputStream fos=new FileOutputStream(file);
      				try{
      					byte[] buffer = new byte[1024];
      					int reader = 0;
      					while ((reader = in.read(buffer)) != -1) {
      						fos.write(buffer, 0, reader);
      					}
      					fos.flush();
      				}
      				finally {
      					fos.close();
      					in.close();
      				}
      
      			} catch (Exception e) {
      				flag = false;
      				e.printStackTrace();
      			}
      		}
      		return flag;
      	}
      
      	/**
      	 * 传入.csv文件路径
      	 * 返回读取到的原始录音文件地址工具
      	 * @param filePath
      	 * @return
      	 */
      	public static List<String> readFile(String filePath){
      		List<String> originalFileList = new ArrayList<String>();
      		try {
      			BufferedReader reader = new BufferedReader(new FileReader(filePath));
      			//第一行为表头信息
      			reader.readLine();
      
      			String line = null;
      			while((line=reader.readLine())!=null){
      				String item[] = line.split(",");//CSV格式文件为逗号分隔符文件,这里根据逗号切分
      				originalFileList.add(item[item.length-4]);
      			}
      		} catch (Exception e) {
      			e.printStackTrace();
      		}
      
      		return originalFileList;
      	}
      
      	/**
      	 * 实际客户端开发根据JSON框架直接转换BaseRequest为Json串
      	 * @param request
      	 * @return String
      	 * @throws Exception
      	 */
      	public static String toJsonString(BaseRequest request) throws Exception
      	{
      		JSONObject jsonObject = new JSONObject();
      		StringBuilder buffer = new StringBuilder();
      		buffer.append("{");
      		buffer.append("\"request\":");
      		buffer.append(jsonObject.toJSONString(request.getRequest()));
      		buffer.append(",");
      		buffer.append("\"msgBody\":");
      		buffer.append(jsonObject.toJSONString(request.getMsgBody()));
      		buffer.append("}");
      
      		return buffer.toString();
      	}
      
      	/**
      	 * 构造鉴权字段信息
      	 * @param httpPath
      	 * @param bodyJson
      	 * @return
      	 * @throws InvalidKeyException
      	 * @throws NoSuchAlgorithmException
      	 * @throws UnsupportedEncodingException
      	 */
      	public Map<String, String> buildSignHttpHead(String httpPath, String bodyJson)
      			throws InvalidKeyException, NoSuchAlgorithmException, UnsupportedEncodingException
      	{
      		// 参与签名鉴权的head字段,host字段是必须的
      		Map<String, String> signedHeaders = new HashMap<>();
      		signedHeaders.put(SignInfo.HEAD_HOST, CmsParameters.host);
      		signedHeaders.put(SignInfo.HEAD_CONTENT_LENGTH, String.valueOf(bodyJson.getBytes("UTF-8").length));
      		signedHeaders.put(SignInfo.HEAD_CONTENT_TYPE, "application/json;charset=UTF-8");
      
      		// 鉴权数据接口设置
      		SignInfo signInfo = new SignInfo();
      		signInfo.setAccessKey(CmsParameters.accessKey);
      		signInfo.setSecretKey(CmsParameters.secretKey);
      		signInfo.setPayload(bodyJson);
      		signInfo.setTimestamp(new Date());
      		signInfo.setHttpMethod(HttpProxyHelper.HTTP_METHOD_POST);
      		signInfo.setUri(httpPath);
      		signInfo.setSignedHeaders(this.lowerCaseSignedHeaders(signedHeaders));
      
      		// 生成签名
      		String signature = signInfo.authString();
      		Map<String, String> httpHeads = new HashMap<>(signedHeaders);
      		// 追加到HTTPHEAD,发送到服务器端
      		httpHeads.put(SignInfo.HEAD_AUTHORIZATION, signature);
      
      		return httpHeads;
      	}	
      
      	/**
      	 * 参与计算的signedHeaders进行转换
      	 * @param
      	 * @return Map<String, String>
      	 */
      	private Map<String, String> lowerCaseSignedHeaders(Map<String, String> signedHeaders)
      	{
      		if ((null == signedHeaders) || signedHeaders.isEmpty())
      		{
      			throw new IllegalArgumentException("signedHeaders cann't be null.");
      		}
      		Map<String, String> headers = new HashMap<>();
      		for (Entry<String, String> e : signedHeaders.entrySet())
      		{
      			String name = e.getKey();
      			String value = e.getValue();
      			headers.put(name.toLowerCase(Locale.ENGLISH), value.trim());
      		}
      		if (!signedHeaders.containsKey(SignInfo.HEAD_HOST))
      		{
      			throw new IllegalArgumentException("signedHeaders must has host.");
      		}
      		return headers;
      	}
      }
    2. 代码实现:
      • 建立工程的main函数:
        public static void main(String[] args)
        	{
        		HttpClientMain demo = new HttpClientMain();
        		
        		try
        		{
        			demo.cmsPingTest();
        		}
        		catch (Exception e)
        		{
        			e.printStackTrace();
        		}
        	}
      • 实现接口(包含鉴权)的post请求的主函数如下:
        public void cmsPingTest() throws Exception
        {
                HttpProxyHelper httpProxy = new HttpProxyHelper();
                //请求接口的URL
                final String httpPath = "/rest/cmsapp/v1/ping";
                final String postUrl = CmsParameters.url + httpPath;
                //构造请求接口中的bodyJson
                JSONObject jsonBody = new JSONObject();
                jsonBody.put("say", "Hello world!");
                String jsonBodyStr = JSONObject.toJSONString(jsonBody);
        
                // 构造鉴权信息
                Map<String, String> httpHeads = ToolUtils.buildSignHttpHead(httpPath, jsonBodyStr);
                // 执行HTTP请求,获取返回JSON字符串
                String response = httpProxy.doPost(postUrl, httpHeads, jsonBodyStr);
                //调用成功后,会返回包含responseId的信息
                System.out.println(response);
        }
      • 实现接口(包含鉴权)的get请求的主函数如下(对比post请求,get请求的其他代码不变):
        public void cmsPingTest() throws Exception
        {
                HttpProxyHelper httpProxy = new HttpProxyHelper();
                //请求接口的URL
                final String httpPath = "/rest/cmsapp/v1/ping";
                final String postUrl = CmsParameters.url + httpPath;
                // GET请求参数
                Map<String, String> queryParameters = new HashMap<>();
                // GET请求构造鉴权信息
                Map<String, String> httpHeads = ToolUtils.buildSignHttpHead(httpPath, null, queryParameters, HttpProxyHelper.HTTP_METHOD_GET);
                System.out.println("httpHeads:" + httpHeads);
                // 执行HTTP请求,获取返回JSON字符串
                String response = httpProxy.doGet(postUrl, httpHeads, queryParameters);
                //调用成功后,会返回包含responseId的信息
                System.out.println(response);
        }
      • 函数ToolUtils.toJsonString()的实现,实际的调用者开发应根据JSON框架直接转换BaseRequest为JSON串,此处仅作为样例:
        /**
         * 实际客户端开发根据JSON框架直接转换BaseRequest为Json串
         * @param request
         * @return String
         * @throws Exception
         */
        public static String toJsonString(BaseRequest request) throws Exception
        {
        	JSONObject jsonObject = new JSONObject();
        	StringBuilder buffer = new StringBuilder();
        	buffer.append("{");
        	buffer.append("\"request\":");
        	buffer.append(jsonObject.toJSONString(request.getRequest()));
        	buffer.append(",");
        	buffer.append("\"msgBody\":");
        	buffer.append(jsonObject.toJSONString(request.getMsgBody()));
        	buffer.append("}");
        
        	return buffer.toString();
        }
      • Http请求POST方法的实现,实际的调用者也可自有选择框架,使用其自带的POST方法:
        package com.huawei.client.rest.v2.demo;
        
        import java.io.BufferedInputStream;
        import java.io.ByteArrayOutputStream;
        import java.io.Closeable;
        import java.io.IOException;
        import java.io.InputStream;
        import java.io.OutputStream;
        import java.net.HttpURLConnection;
        import java.net.URL;
        import java.security.KeyManagementException;
        import java.security.NoSuchAlgorithmException;
        import java.security.cert.CertificateException;
        import java.security.cert.X509Certificate;
        import java.util.Map;
        import java.util.Map.Entry;
        
        import javax.net.ssl.HostnameVerifier;
        import javax.net.ssl.HttpsURLConnection;
        import javax.net.ssl.SSLContext;
        import javax.net.ssl.SSLSession;
        import javax.net.ssl.TrustManager;
        import javax.net.ssl.X509TrustManager;
        
        
        public class HttpProxyHelper
        {
        	public static final String HTTP_METHOD_POST = "POST";
        
        	public String doPost(String urlAddress, Map<String, String> httpHeads, String bodyJson) throws IOException, NoSuchAlgorithmException, KeyManagementException
        	{
        		byte[] byteData = bodyJson.getBytes("UTF-8");
        		OutputStream out = null;
        		InputStream in = null;
        
        		// 建立连接
        		this.initHttpsURLConnection();
        		URL url = new URL(urlAddress);
        		HttpURLConnection httpConn = (HttpURLConnection) url.openConnection();
        
        		// 设置参数
        		httpConn.setRequestMethod(HttpProxyHelper.HTTP_METHOD_POST);
        		httpConn.setRequestProperty("Charset", "UTF-8");
        		//httpConn.setRequestProperty("Content-Type", "application/json; charset=UTF-8");
        		httpConn.setRequestProperty("accept", "application/json");
        		//httpConn.setRequestProperty("Content-Length", String.valueOf(byteData.length));
        		httpConn.setDoOutput(true);
        		httpConn.setDoInput(true);
        		httpConn.setUseCaches(false);
        		httpConn.setConnectTimeout(20 * 1000);
        		httpConn.setReadTimeout(30 * 1000);
        		// 设置业务携带参数
        		if ((null != httpHeads) && !httpHeads.isEmpty())
        		{
        			for (Entry<String, String> e : httpHeads.entrySet())
        			{
        				httpConn.setRequestProperty(e.getKey(), e.getValue());
        			}
        		}
        
        		try
        		{
        			// 发送数据
        			out = httpConn.getOutputStream();
        			out.write(byteData);
        			out.flush();
        
        			// 接收数据
        			int responseCode = httpConn.getResponseCode();
        			if (responseCode != HttpURLConnection.HTTP_OK)
        			{
        				throw new RuntimeException("Failed responseCode " + responseCode);
        			}
        
        			in = httpConn.getInputStream();
        			String reponseJson = this.getStreamAsString(in, "UTF-8");
        			return reponseJson;
        		}
        		finally
        		{
        			this.closeStream(out);
        			this.closeStream(in);
        		}
        	}
        
        	/**
        	 * 从流获取字符串
        	 * @param in
        	 * @param charset
        	 * @return String
        	 * @throws IOException
        	 */
        	private String getStreamAsString(InputStream in, String charset) throws IOException
        	{
        		BufferedInputStream buffer = new BufferedInputStream(in);
        		ByteArrayOutputStream out = new ByteArrayOutputStream();
        		try
        		{
        			byte[] cache = new byte[512];
        			int count = 0;
        			while ((count = buffer.read(cache)) > 0)
        			{
        				out.write(cache, 0, count);
        			}
        		}
        		finally
        		{
        			if (buffer != null)
        			{
        				buffer.close();
        			}
        		}
        
        		return new String(out.toByteArray(), charset);
        	}
        
        	/**
        	 * 关闭流
        	 * @param stream
        	 */
        	private void closeStream(Closeable stream)
        	{
        		if (null != stream)
        		{
        			try
        			{
        				stream.close();
        			}
        			catch (Exception e)
        			{
        				e.printStackTrace();
        			}
        		}
        	}
        
        	private void initHttpsURLConnection() throws NoSuchAlgorithmException, KeyManagementException
        	{
        		SSLContext sslcontext = SSLContext.getInstance("SSL");
        		HostnameVerifier hnv = new HttpsHostnameVerifier();
        		sslcontext.init(null, new TrustManager[] { new HttpsTrustAnyTrustManager() }, new java.security.SecureRandom());
        
        		HttpsURLConnection.setDefaultSSLSocketFactory(sslcontext.getSocketFactory());
        		HttpsURLConnection.setDefaultHostnameVerifier(hnv);
        	}
        
        	private class HttpsTrustAnyTrustManager implements X509TrustManager
        	{
        		@Override
        		public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException
        		{
        		}
        
        		@Override
        		public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException
        		{
        		}
        
        		@Override
        		public X509Certificate[] getAcceptedIssuers()
        		{
        			return new X509Certificate[] {};
        		}
        	}
        
        	private class HttpsHostnameVerifier implements HostnameVerifier
        	{
        		@Override
        		public boolean verify(String hostname, SSLSession session)
        		{
        			return true;
        		}
        	}
        }
    3. 变量参数展示表:

      变量

      HttpHead

      Host="10.22.26.181:28080"

      Content-Length="22"

      Content-Type="application/json;charset=UTF-8"

      accessKey

      globalaktest

      secretKey

      1qaz**********************************20

      HttpURI

      /rest/cmsapp/v1/ping

      HttpMethod

      POST

      timestamp

      2018-10-17T11:48:24Z

      HttpBody

      {"say": "Hello world!"}

      SignedHeaders

      content-length;content-type;host

      CanonicalHeaders

      content-length:22\n

      content-type:application%2Fjson%3Bcharset%3DUTF-8\n

      host:10.22.26.181%3A28080

      CanonicalRequest

      POST\n

      /rest/cmsapp/v1/ping\n

      content-length;content-type;host\n

      content-length:22\n

      content-type:application%2Fjson%3Bcharset%3DUTF-8\n

      host:10.22.26.181%3A28080\n

      %7B%22request%22%3A%7B%22version%22%3A%222.0%22%7D%2C%22msgBody%22%3A%7B%22accountId%22%3A%22%22%2C%22beginTime%22%3A%222018-06-29%2010%3A42%3A49%22%2C%22endTime%22%3A%222018-07-02%2010%3A42%3A49%22%2C%22agentId%22%3A%22%22%2C%22callId%22%3A%22%22%2C%22dataType%22%3A%22call_record%22%2C%22callBackURL%22%3A%22http%3A%2F%2F10.57.118.171%3A8080%22%7D%7D

      SigningKey

      b25b************************************************40

      Signature

      d5a8************************************************2f

      Authorization

      auth-v2/globalak/2018-10-17T11:48:24Z/content-length;content-type;host/d5a8************************************************2f