如何基于JHipster实现租户独立数据库隔离的多租户架构？

针对每个租户使用独立数据库实例的完全隔离方案，可按以下步骤在JHipster项目中落地：

1. 租户识别与上下文传递 #

首先需要在请求生命周期内明确当前租户ID，用于后续数据源切换：

• 扩展Spring Security的UserDetails，添加tenantId字段，登录时从共享租户注册表（或用户所属租户信息）获取该值并注入安全上下文
• 若为API接口，可同时支持从请求头X-Tenant-ID传递租户ID，作为 fallback 方案

// 自定义用户详情类
public class TenantUserDetails extends org.springframework.security.core.userdetails.User {
    private final String tenantId;

    public TenantUserDetails(String username, String password, Collection<? extends GrantedAuthority> authorities, String tenantId) {
        super(username, password, authorities);
        this.tenantId = tenantId;
    }

    public String getTenantId() {
        return tenantId;
    }
}

// 自定义UserDetailsService实现
@Service
public class TenantUserDetailsService implements UserDetailsService {
    private final UserRepository userRepository;

    public TenantUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findOneByLogin(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found: " + username));
        return new TenantUserDetails(user.getLogin(), user.getPassword(), getAuthorities(user), user.getTenantId());
    }

    private Collection<? extends GrantedAuthority> getAuthorities(User user) {
        return user.getAuthorities().stream()
                .map(authority -> new SimpleGrantedAuthority(authority.getName()))
                .collect(Collectors.toList());
    }
}

2. 动态数据源路由实现 #

禁用JHipster默认的数据源自动配置，实现基于租户ID的动态数据源切换：

• 实现AbstractRoutingDataSource，重写determineCurrentLookupKey方法从安全上下文或请求头获取租户ID
• 编写数据源管理器，按需创建并缓存租户对应的数据库连接

// 动态路由数据源
public class TenantRoutingDataSource extends AbstractRoutingDataSource {
    @Override
    protected Object determineCurrentLookupKey() {
        // 优先从安全上下文获取租户ID
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null && auth.getPrincipal() instanceof TenantUserDetails) {
            return ((TenantUserDetails) auth.getPrincipal()).getTenantId();
        }
        // 从请求头获取（API场景）
        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
        return request.getHeader("X-Tenant-ID");
    }
}

// 租户数据源管理器
@Component
public class TenantDataSourceManager {
    private final Map<String, DataSource> dataSourceCache = new ConcurrentHashMap<>();
    private final Environment env;

    public TenantDataSourceManager(Environment env) {
        this.env = env;
    }

    public DataSource getOrCreateDataSource(String tenantId) {
        return dataSourceCache.computeIfAbsent(tenantId, this::buildTenantDataSource);
    }

    private DataSource buildTenantDataSource(String tenantId) {
        // 从配置文件读取模板，替换租户ID生成专属连接配置
        String url = env.getProperty("spring.datasource.url-template").replace("{tenantId}", tenantId);
        String username = env.getProperty("spring.datasource.username-template").replace("{tenantId}", tenantId);
        String password = env.getProperty("spring.datasource.password-template").replace("{tenantId}", tenantId);

        return DataSourceBuilder.create()
                .url(url)
                .username(username)
                .password(password)
                .driverClassName(env.getProperty("spring.datasource.driver-class-name"))
                .build();
    }
}

// 数据源配置类
@Configuration
@EnableTransactionManagement
public class TenantDataSourceConfig {
    private final TenantDataSourceManager dataSourceManager;
    private final TenantRepository tenantRepository;

    public TenantDataSourceConfig(TenantDataSourceManager dataSourceManager, TenantRepository tenantRepository) {
        this.dataSourceManager = dataSourceManager;
        this.tenantRepository = tenantRepository;
    }

    @Bean
    public DataSource dataSource() {
        TenantRoutingDataSource routingDataSource = new TenantRoutingDataSource();
        // 设置系统默认数据源（用于租户注册等公共操作）
        routingDataSource.setDefaultTargetDataSource(dataSourceManager.getOrCreateDataSource("system"));
        // 预加载所有已注册租户的数据源
        Map<Object, Object> targetDataSources = new HashMap<>();
        tenantRepository.findAll().forEach(tenant -> targetDataSources.put(tenant.getId(), dataSourceManager.getOrCreateDataSource(tenant.getId())));
        routingDataSource.setTargetDataSources(targetDataSources);
        routingDataSource.afterPropertiesSet();
        return routingDataSource;
    }
}

在application.yml中添加数据源模板配置：

spring:
  datasource:
    url-template: jdbc:mysql://localhost:3306/{tenantId}?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=UTC
    username-template: db_{tenantId}_user
    password-template: db_{tenantId}_pass
    driver-class-name: com.mysql.cj.jdbc.Driver
    admin-url: jdbc:mysql://localhost:3306/
    admin-username: root
    admin-password: your-root-pass

3. 租户数据库自动初始化 #

实现租户注册时的数据库自动创建与Schema初始化：

• 编写初始化组件，使用管理员账号创建租户数据库
• 执行JHipster生成的Liquibase脚本初始化Schema与基础数据

@Component
public class TenantInitializer {
    private final Environment env;
    private final TenantDataSourceManager dataSourceManager;

    public TenantInitializer(Environment env, TenantDataSourceManager dataSourceManager) {
        this.env = env;
        this.dataSourceManager = dataSourceManager;
    }

    public void initializeTenant(String tenantId) throws SQLException, LiquibaseException {
        // 1. 创建租户数据库
        try (Connection adminConn = DriverManager.getConnection(
                env.getProperty("spring.datasource.admin-url"),
                env.getProperty("spring.datasource.admin-username"),
                env.getProperty("spring.datasource.admin-password"))) {
            String createDbSql = String.format("CREATE DATABASE IF NOT EXISTS %s CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci", tenantId);
            try (Statement stmt = adminConn.createStatement()) {
                stmt.execute(createDbSql);
            }
        }

        // 2. 执行Liquibase Schema初始化
        DataSource tenantDs = dataSourceManager.getOrCreateDataSource(tenantId);
        Liquibase liquibase = new Liquibase(
                "classpath:config/liquibase/master.xml",
                new ClassLoaderResourceAccessor(),
                new JdbcConnection(tenantDs.getConnection())
        );
        liquibase.update(new Contexts(), new LabelExpression());

        // 3. 初始化基础权限数据
        JdbcTemplate jdbcTemplate = new JdbcTemplate(tenantDs);
        jdbcTemplate.update("INSERT INTO jhi_authority (name) VALUES ('ROLE_USER'), ('ROLE_ADMIN') ON DUPLICATE KEY UPDATE name=name");
    }
}

4. JHipster专属适配 #

• JPA/Hibernate配置：无需启用Hibernate多租户模式，动态数据源切换后Hibernate会自动使用当前租户的数据库连接
• 安全权限控制：确保用户仅能访问所属租户的数据，可在Repository层添加租户ID过滤（若用户表在共享DB），或直接在租户DB内管理用户（完全隔离）
• 缓存隔离：若使用Redis/Ehcache，需在缓存Key中加入租户ID前缀，避免跨租户数据污染
• Liquibase维护：确保所有Schema变更脚本可复用，每个租户独立执行变更

5. 验证方案 #

• 创建两个测试租户tenant1和tenant2，触发自动初始化流程
• 分别登录两个租户的用户，插入测试数据，验证数据仅存在于对应租户的数据库中
• 测试跨租户访问场景，确认数据完全隔离

内容的提问来源于stack exchange，提问作者Djiby Thiaw