堡垒机集成

// Web 页面内 JavaScript 调用跳转到 ODC
window.open('xxx.xxx.x.x:2883/#/gateway/' + param)  

// chrome 唤起
chrome.exe --new-window xxx.xxx.x.x:2883/#/gateway/param

{
 action: string, // 类型
  data: any, // 调用参数(加密情况下，需要先序列化成一个字符串，非加密情况，直接传递下方表格对应的参数类型)
  encrypt: boolean // 参数是否加密
}

-- 启用堡垒机集成
update `config_system_configuration` set `value` = 'true' where `key` = 'odc.integration.bastion.enabled';

-- 加密配置：这里是模拟服务，配置为不加密
update `config_system_configuration` set `value` = 'false' where `key` = 'odc.integration.bastion.encryption.enabled';
update `config_system_configuration` set `value` = 'RAW' where `key` = 'odc.integration.bastion.encryption.algorithm';
update `config_system_configuration` set `value` = '' where `key` = 'odc.integration.bastion.encryption.secret';

-- 账号配置：启用自动登录
update `config_system_configuration` set `value` = 'true' where `key` = 'odc.integration.bastion.account.auto-login-enabled';

-- 查询堡垒机账号 API 配置，这里使用 3.2 节模拟的服务。注意 API 配置要与模拟服务相对应
update `config_system_configuration` set `value` = 'POST' where `key` = 'odc.integration.bastion.account.query.request-method';
update `config_system_configuration` set `value` = 'http://xx.xx.xx.xx:*****/api/queryUser' where `key` = 'odc.integration.bastion.account.query.request-url';
update `config_system_configuration` set `value` = 'Content-Type=application/json;charset=UTF-8,Accept=application/json' where `key` = 'odc.integration.bastion.account.query.request-headers';
update `config_system_configuration` set `value` = '{"accountVerifyToken":"${account_verify_token}"}' where `key` = 'odc.integration.bastion.account.query.request-body';
update `config_system_configuration` set `value` = 'false' where `key` = 'odc.integration.bastion.account.query.request-encrypted';
update `config_system_configuration` set `value` = '[''resultCode''] == 0' where `key` = 'odc.integration.bastion.account.query.response-body-valid-expression';
update `config_system_configuration` set `value` = '[''userCode'']' where `key` = 'odc.integration.bastion.account.query.response-body-username-extract-expression';
update `config_system_configuration` set `value` = '[''userName'']' where `key` = 'odc.integration.bastion.account.query.response-body-nickname-extract-expression';
update `config_system_configuration` set `value` = 'false' where `key` = 'odc.integration.bastion.account.query.response-encrypted';

-- HTTP 连接配置
update `config_system_configuration` set `value` = '5' where `key` = 'odc.integration.bastion.account.http.connect-timeout-seconds';
update `config_system_configuration` set `value` = '20' where `key` = 'odc.integration.bastion.account.query.read-timeout-seconds';

-- GET 连接配置
update `config_system_configuration` set `value` = 'http://xx.xx.xx.xx:*****/api/queryUser2?accountVerifyToken=${account_verify_token}' where `key` = 'odc.integration.bastion.account.query.request-url';
update `config_system_configuration` set `value` = '' where `key` = 'odc.integration.bastion.account.query.request-body';

// 构造 data 参数
const data = {
 accountVerifyToken: 'token_value'
}

// 构造 ODC 调用参数
const ODCData = {
 action: 'start',
  data: encrypt(JSON.stringify(data)), // 加密数据
  encrypt: true
}

// 把 json 类型转成base64字符串
const param = base64(JSON.stringify(ODCData)); 

// Web 方式调用 Web 版本 ODC
window.open('xxx.xxx.x.x:2883/#/gateway/' + param)  

//chrome 唤起
chrome.exe --new-window xxx.xxx.x.x:2883/#/gateway/param

// 构造 data 参数
// 注意 properties 内具体的字段和含义 ODC 并不理解，需要和集成的审批、审计系统确认
const data = {
  accountVerifyToken: 'token_value',
  type: 'OB_ORACLE',
  host: 'xxx.xxx.x.x',
  port: 2883, 

  username: 'username',
  password: '****',
  tenantName: 'oracle',
  defaultSchema: 'default',
  properties: {
    accountName: '****',
    dbInstance: '****',
    instanceType: 2,
    ipAddress: '****',
    operateSessionId: '****',
    serviceName: '****',
    userCode: '****',
  }  
}

// 构造 ODC 调用参数
const ODCData = {
 action: 'newTempSession',
  data: encrypt(JSON.stringify(data)), // 加密数据
  encrypt: true
}

// 把 json 类型转成 base64 字符串
const param = base64(JSON.stringify(ODCData)); 

// Web 方式调用 Web 版本 ODC
window.open('xxx.xxx.x.x:2883/#/gateway/' + param)  

//chrome 唤起
chrome.exe --new-window xxx.xxx.x.x:2883/#/gateway/param

package com.oceanbase.odc.example;

import java.nio.charset.StandardCharsets;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.KeySpec;
import java.util.Arrays;
import java.util.Base64;
import java.util.Objects;

import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.KeyGenerator;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;

/**
 * AES Base64 文本格式加解密
 */
public class AesBase64TextEncryptor {
    private final AesBytesEncryptor encryptDecrypt;

    /**
     * @param key 加密密钥串
     * @param salt 计算密钥使用功能的盐，可选；如果 为空，则不使用 salt
     */
    public AesBase64TextEncryptor(String key, String salt) {
        this.encryptDecrypt = new AesBytesEncryptor(key, salt);
    }

    /**
     * @param key 加密密钥串
     * @param salt 计算密钥使用功能的盐，可选
     * @param keyLength 密钥长度
     */
    public AesBase64TextEncryptor(String key, String salt, int keyLength) {
        this.encryptDecrypt = new AesBytesEncryptor(key, salt, keyLength);
    }

    /**
     * 加密
     */
    public synchronized String encrypt(String plainText) {
        if (plainText == null) {
            return null;
        }
        byte[] bytes = plainText.getBytes(StandardCharsets.UTF_8);
        byte[] encrypted = encryptDecrypt.encrypt(bytes);
        return base64Encode(encrypted);
    }

    /**
     * 解密
     */
    public synchronized String decrypt(String encryptedText) {
        if (encryptedText == null) {
            return null;
        }
        byte[] encrypted = base64Decode(encryptedText);
        byte[] decrypt = encryptDecrypt.decrypt(encrypted);
        return new String(decrypt, StandardCharsets.UTF_8);
    }

    private byte[] base64Decode(String right) {
        byte[] bytes = right.getBytes(StandardCharsets.UTF_8);
        return Base64.getDecoder().decode(bytes);
    }

    private String base64Encode(byte[] left) {
        byte[] encoded = Base64.getEncoder().encode(left);
        if (Objects.isNull(encoded)) {
            return null;
        }
        return new String(encoded, StandardCharsets.UTF_8);
    }

    public static class AesBytesEncryptor {

        private static final String FACTORY_INSTANCE = "PBKDF2WithHmacSHA256";
        private static final String CIPHER_INSTANCE = "AES/CBC/PKCS5PADDING";
        private static final String SECRET_KEY_TYPE = "AES";
        private static final String NO_SALT_SECURE_RANDOM_INSTANCE = "SHA1PRNG";

        /**
         * 默认 KEY 长度
         */
        private static final int DEFAULT_KEY_LENGTH = 256;

        /**
         * IV 指的是 initialization vector，<br>
         * 在 CBC 模式中使用随机的初始化向量，可以使得同一个源每次加密得到的值是不一样的
         */
        private static final int IV_LENGTH = 16;

        /**
         * 迭代次数，越大则加解密成本越大，暴力破解耗时越久，一般不少于 1000
         */
        private static final int ITERATION_COUNT = 1024;

        /**
         * 秘钥长度
         */
        private final int keyLength;

        private final SecretKeySpec secretKey;
        private final Cipher encryptor;
        private final Cipher decryptor;

        public AesBytesEncryptor(String key, String salt, int keyLength) {
            Validate.notEmpty(key, "parameter 'key' must not be empty");
            Validate.validState(keyLength > 0, "parameter 'keyLength' must greater than 0");
            this.keyLength = keyLength;
            this.secretKey = newSecretKey(key, salt);
            this.encryptor = createCipher();
            this.decryptor = createCipher();
        }

        public AesBytesEncryptor(String key, String salt) {
            this(key, salt, DEFAULT_KEY_LENGTH);
        }

        public byte[] encrypt(byte[] origin) {
            Validate.notNull(origin, "parameter 'origin' may not be null");
            // Generating random IV
            SecureRandom random = new SecureRandom();
            byte[] iv = new byte[IV_LENGTH];
            random.nextBytes(iv);
            initCipher(encryptor, Cipher.ENCRYPT_MODE, iv);
            byte[] encrypted = doFinal(encryptor, origin);
            return addIVToCipher(encrypted, iv);
        }

        public byte[] decrypt(byte[] encrypted) {
            Validate.notNull(encrypted, "parameter 'encrypted' may not be null");
            Validate.isTrue(encrypted.length >= IV_LENGTH,
                    "length of parameter 'encrypted' may not less than IV length " + IV_LENGTH);
            byte[] iv = new byte[IV_LENGTH];
            System.arraycopy(encrypted, 0, iv, 0, IV_LENGTH);
            initCipher(decryptor, Cipher.DECRYPT_MODE, iv);
            byte[] original = doFinal(decryptor, encrypted);
            return Arrays.copyOfRange(original, IV_LENGTH, original.length);
        }

        private byte[] doFinal(Cipher cipher, byte[] input) {
            try {
                return cipher.doFinal(input);
            } catch (IllegalBlockSizeException e) {
                throw new IllegalStateException(
                        "Unable to invoke Cipher due to illegal block size", e);
            } catch (BadPaddingException e) {
                throw new IllegalStateException("Unable to invoke Cipher due to bad padding",
                        e);
            }
        }

        private SecretKeySpec newSecretKey(String key, String salt) {
            try {
                if (Objects.isNull(salt) || salt.isEmpty()) {
                    SecureRandom random = SecureRandom.getInstance(NO_SALT_SECURE_RANDOM_INSTANCE);
                    random.setSeed(key.getBytes());

                    KeyGenerator keyGenerator = KeyGenerator.getInstance(SECRET_KEY_TYPE);
                    keyGenerator.init(keyLength, random);

                    SecretKey secretKey = keyGenerator.generateKey();
                    return new SecretKeySpec(secretKey.getEncoded(), SECRET_KEY_TYPE);
                } else {
                    SecretKeyFactory factory = SecretKeyFactory.getInstance(FACTORY_INSTANCE);
                    KeySpec keySpec = new PBEKeySpec(key.toCharArray(), salt.getBytes(), ITERATION_COUNT, keyLength);
                    SecretKey secretKey = factory.generateSecret(keySpec);
                    return new SecretKeySpec(secretKey.getEncoded(), SECRET_KEY_TYPE);
                }
            } catch (

            NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Not a valid encryption algorithm", e);
            } catch (InvalidKeySpecException e) {
                throw new IllegalArgumentException("Not a valid secret key", e);
            }
        }

        private void initCipher(Cipher cipher, int mode, byte[] iv) {
            try {
                cipher.init(mode, secretKey, new IvParameterSpec(iv));
            } catch (InvalidKeyException e) {
                throw new IllegalArgumentException("Not a valid secret key", e);
            } catch (InvalidAlgorithmParameterException e) {
                throw new IllegalArgumentException("Not a valid encryption algorithm", e);
            }
        }

        private Cipher createCipher() {
            try {
                return Cipher.getInstance(CIPHER_INSTANCE);
            } catch (NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Not a valid encryption algorithm", e);
            } catch (NoSuchPaddingException e) {
                throw new IllegalStateException("Should not happen", e);
            }
        }

        private byte[] addIVToCipher(byte[] encrypted, byte[] iv) {
            byte[] cipherWithIv = new byte[iv.length + encrypted.length];
            System.arraycopy(iv, 0, cipherWithIv, 0, iv.length);
            System.arraycopy(encrypted, 0, cipherWithIv, iv.length, encrypted.length);
            return cipherWithIv;
        }
    }

    public static class Validate {
        public static <T extends CharSequence> T notEmpty(final T chars, final String message, final Object... values) {
            Objects.requireNonNull(chars, () -> String.format(message, values));
            if (chars.length() == 0) {
                throw new IllegalArgumentException(String.format(message, values));
            }
            return chars;
        }

        public static void validState(final boolean expression, final String message, final Object... values) {
            if (!expression) {
                throw new IllegalStateException(String.format(message, values));
            }
        }

        public static <T> T notNull(final T object, final String message, final Object... values) {
            return Objects.requireNonNull(object, () -> String.format(message, values));
        }

        public static void isTrue(final boolean expression, final String message, final Object... values) {
            if (!expression) {
                throw new IllegalArgumentException(String.format(message, values));
            }
        }
    }
}

package com.oceanbase.odc.example;

import org.junit.Assert;
import org.junit.Test;

public class AesBase64TextEncryptorTest {

    @Test
    public void encryptDecrypt_NoSalt() {
        AesBase64TextEncryptor encryptor = new AesBase64TextEncryptor("1234567890123456_1", null);

        String origin = "abcd1234";
        String encrypt = encryptor.encrypt(origin);
        String decrypt = encryptor.decrypt(encrypt);
        Assert.assertEquals(origin, decrypt);
    }

    @Test
    public void sameKeyTwice_Different() {
        AesBase64TextEncryptor encryptor = new AesBase64TextEncryptor("1234567890123456_1", null);

        String encrypted1 = encryptor.encrypt("123654");
        String encrypted2 = encryptor.encrypt("123654");
        Assert.assertNotEquals(encrypted1, encrypted2);
    }

}