AK/SK 签名生成规则

message = Http Method + "\n" + Content-md5 + "\n" + Content-Type + "\n" + Date+ "\n" + Host+ "\n" + x-ocp-headers + "\n" + uri + query 参数

POST
186974DB33A090A16D3E2CA35F547B56
application/json
Tue, 17 Jan 2023 03:36:01 GMT
ocp.alibaba.net:8080
x-ocp-data:1,2,A,J,Z
/api/v2/compute/idcs?userId=1001

AK：cqammmxBpfGjFlto
SK：2fc0c299cc94c6be266f2ceece765d4d

POST /api/v2/compute/idcs HTTP/1.1
Content-Type	application/json
x-ocp-data	A,1
Host	ocp.alibaba.net:8080

请求体：{"name":"test01","description":"test","regionId":1} 请求发起时间：Tue, 17 Jan 2023 09:13:57 GMT

POST\n + 186974DB33A090A16D3E2CA35F547B56\n + application/json\n + Tue, 17 Jan 2023 09:13:57 GMT\n + ocp.alibaba.net:8080\n + x-ocp-data:A,1\n + /api/v2/compute/idcs

XN8P+O+v3vUabB16ZCooq5wMJoY=

OCP-ACCESS-KEY-HMACSHA1 cqammmxBpfGjFlto:XN8P+O+v3vUabB16ZCooq5wMJoY=

POST /api/v2/compute/idcs HTTP/1.1
Content-Type	application/json
x-ocp-data	A,1
Authorization	OCP-ACCESS-KEY-HMACSHA1 cqammmxBpfGjFlto:XN8P+O+v3vUabB16ZCooq5wMJoY=
Date	Tue, 17 Jan 2023 09:13:57 GMT
Host	ocp.alibaba.net:8080

GET /api/v2/compute/idcs?size=100 HTTP/1.1
Content-Type	application/json;charset=utf-8
Host	ocp.alibaba.net:8080

请求发起时间：Tue, 17 Jan 2023 04:14:02 GMT

GET\n + \n + application/json;charset=utf-8\n + Tue, 17 Jan 2023 04:14:02 GMT\n + ocp.alibaba.net:8080\n + \n + /api/v2/compute/idcs?size=100

TsQD6HDOuZuJ409m0wdnZPmijlc=

OCP-ACCESS-KEY-HMACSHA1 cqammmxBpfGjFlto:TsQD6HDOuZuJ409m0wdnZPmijlc=

GET /api/v2/compute/idcs?size=100 HTTP/1.1
Content-Type	application/json;charset=utf-8
Authorization	OCP-ACCESS-KEY-HMACSHA1 cqammmxBpfGjFlto:TsQD6HDOuZuJ409m0wdnZPmijlc=
Date	Tue, 17 Jan 2023 04:14:02 GMT
Host	ocp.alibaba.net:8080
Connection	keep-alive

import com.google.common.collect.Lists;
import org.apache.commons.collections4.MapUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.Validate;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.math.BigInteger;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.Base64;
import java.util.BitSet;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.StringJoiner;
import java.util.stream.Collectors;

public class ExampleTest {
    public static void main(String[] args) {
        String sk = "2fc0c299cc94c6be266f2ceece765d4d";
        String httpMethod = "POST";
        byte[] bodyByte = "{\"name\":\"test01\",\"description\":\"test\",\"regionId\":1}".getBytes(StandardCharsets.UTF_8);
        String contentType = "application/json";
        String rfc1123Date = "Tue, 17 Jan 2023 09:13:57 GMT";
        String host = "ocp.alibaba.net:8080";
        Map<String, List<String>> xOcpHeaders = new HashMap<>();
        ArrayList<String> list = Lists.newArrayList("A", "1");
        xOcpHeaders.put("x-ocp-data", list);
        String path = "/api/v2/compute/idcs";
        Map<String, List<String>> queryParams = new HashMap<>();
        String generator = generator(sk, httpMethod, bodyByte, contentType, rfc1123Date, host, xOcpHeaders,
                path, queryParams);
        // XN8P+O+v3vUabB16ZCooq5wMJoY=
        System.out.println(generator);
    }

    /**
     *  生成签名
     */
    public static String generator(String accessKeySecret,
                                   String httpMethod,
                                   byte[] body,
                                   String contentType,
                                   String rfc1123Date,
                                   String host,
                                   Map<String, List<String>> headers,
                                   String path,
                                   Map<String, List<String>> queryParams) {
        String message = buildMessage(
                httpMethod,
                md5Crypt(body),
                contentType,
                rfc1123Date,
                host,
                buildXOcpHeader(headers),
                buildUrlAndParam(path, queryParams));
        System.out.println(message);
        // encode
        return Base64.getEncoder().encodeToString(
                hmacSha1(accessKeySecret, message.getBytes(StandardCharsets.UTF_8)));
    }

    /**
     * 对参数排序，构造新的请求 URL 用于签名
     *
     * @param requestUri 请求 URL
     * @param paramMap 请求参数
     * @return 待加签的 URL + param
     */
    public static String buildUrlAndParam(String requestUri, Map<String, List<String>> paramMap) {
        if (MapUtils.isEmpty(paramMap)) {
            return requestUri;
        }
        String urlParam = paramMap.entrySet().stream()
                .sorted(Map.Entry.comparingByKey())
                .map(e -> {
                    String value = e.getValue().stream()
                            .filter(StringUtils::isNotEmpty).sorted().collect(Collectors.joining(","));
                    return String.format("%s=%s", encoder(e.getKey()), encoder(value));
                })
                .collect(Collectors.joining("&"));
        urlParam = urlParam.replace("%2B", "%20");
        return requestUri + "?" + urlParam;
    }

    /**
     * 构建待加签的 header
     *
     * @param headers 请求 header
     * @return 待加签的 header
     */
    public static String buildXOcpHeader(Map<String, List<String>> headers) {
        return headers.entrySet().stream()
                .filter(e -> StringUtils.startsWithIgnoreCase(e.getKey(), "x-ocp"))
                .sorted(Map.Entry.comparingByKey())
                .map(e -> String.format("%s:%s", e.getKey(), String.join(",", e.getValue())))
                .collect(Collectors.joining("\n"));
    }

    /**
     * MD5 加密
     *
     * @param content 待 MD5 加密的 byte content
     * @return MD5 加密结果
     */
    private static String md5Crypt(byte[] content) {
        try {
            if (content == null || content.length == 0) {
                return null;
            }
            MessageDigest digest = MessageDigest.getInstance("MD5");
            digest.update(content);
            String hex = new BigInteger(1, digest.digest()).toString(16).toUpperCase();
            return StringUtils.leftPad(hex, 32, "0");
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("Not supported signature method MD5", e);
        }
    }

    /**
     * HMAC-SHA1 加密
     *
     * @param accessKeySecret accessKeySecret
     * @param content 待 HMAC-SHA1 加密的 byte 数组
     * @return 加密结果
     */
    private static byte[] hmacSha1(String accessKeySecret, byte[] content) {
        try {
            Validate.notEmpty(accessKeySecret, "cannot be null or empty.");
            Validate.notNull(content, "content");
            Validate.isTrue(content.length != 0, "content cannot be empty.");

            Mac mac = Mac.getInstance("HmacSHA1");
            mac.init(new SecretKeySpec(accessKeySecret.getBytes(StandardCharsets.UTF_8), "HmacSHA1"));
            return mac.doFinal(content);
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("Not supported signature method HmacSHA1", e);
        } catch (InvalidKeyException e) {
            throw new RuntimeException("Failed to calculate the signature", e);
        }
    }

    private static String buildMessage(String... contents) {
        StringJoiner joiner = new StringJoiner("\n");
        for (String content : contents) {
            if (StringUtils.isNotEmpty(content)) {
                joiner.add(content);
            } else {
                joiner.add("");
            }
        }
        return joiner.toString();
    }
    private static final BitSet URI_UNRESERVED_CHARACTERS = new BitSet();
    private static final String[] PERCENT_ENCODED_STRINGS = new String[256];
    static {
        for (int i = 'a'; i <= 'z'; i++) {
            URI_UNRESERVED_CHARACTERS.set(i);
        }
        for (int i = 'A'; i <= 'Z'; i++) {
            URI_UNRESERVED_CHARACTERS.set(i);
        }
        for (int i = '0'; i <= '9'; i++) {
            URI_UNRESERVED_CHARACTERS.set(i);
        }
        URI_UNRESERVED_CHARACTERS.set('-');
        URI_UNRESERVED_CHARACTERS.set('.');
        URI_UNRESERVED_CHARACTERS.set('_');
        URI_UNRESERVED_CHARACTERS.set('~');

        for (int i = 0; i < PERCENT_ENCODED_STRINGS.length; ++i) {
            PERCENT_ENCODED_STRINGS[i] = String.format("%%%02X", i);
        }
    }
    /**
     * URLEncoder 遵照 RFC3986规定。"URI 非保留字符" 包括以下字符：字母（A-Z，a-z）、数字（0-9）、连字号（-）、点号（.）、下划线（_)、波浪线（~），
     * 算法实现如下： 1.将字符串转换成UTF-8编码的字节。2.保留所有“URI 非保留字符”原样不变。3.对其余字节做一次 RFC3986 中规定的百分号编码（Percent-encoding）， 即一个“%”后面跟着两个表示该字节值的十六进制字母，字母一律采用大写形式。
     */
    public static String encoder(String value) {
        if (StringUtils.isEmpty(value)) {
            return StringUtils.EMPTY;
        }
        StringBuilder builder = new StringBuilder();
        for (byte b : value.getBytes(StandardCharsets.UTF_8)) {
            if (URI_UNRESERVED_CHARACTERS.get(b & 0xFF)) {
                builder.append((char) b);
            } else {
                builder.append(PERCENT_ENCODED_STRINGS[b & 0xFF]);
            }
        }
        return builder.toString();
    }
}