我之前做过类似的权限系统集成，给你几个靠谱的Java实现思路，帮你高效解析Policy Server的响应并拿到用户的授权资源列表：

首先你需要在用户登录后，带着有效的认证信息（比如登录后拿到的Session ID、JWT Token或者Basic Auth凭证）去请求Policy Server的接口，获取该用户的授权数据。这里推荐两种常用的HTTP客户端实现：

方案A：用Apache HttpClient（原生Java场景） #

import org.apache.http.HttpResponse;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.util.EntityUtils;

public class PolicyServerClient {
    public String fetchAuthorizedResources(String userId, String authToken) throws Exception {
        HttpClient client = HttpClients.createDefault();
        // 替换为你的Policy Server实际接口地址
        HttpGet request = new HttpGet("http://your-policy-server/api/user/" + userId + "/authorized-resources");
        // 携带认证信息，比如Token放在Header里
        request.addHeader("Authorization", "Bearer " + authToken);
        
        HttpResponse response = client.execute(request);
        // 读取响应体字符串
        return EntityUtils.toString(response.getEntity());
    }
}

方案B：用Spring RestTemplate（Spring项目场景） #

如果是Spring Boot项目，RestTemplate会更简洁：

import org.springframework.web.client.RestTemplate;

@Service
public class PolicyServerService {
    private final RestTemplate restTemplate;

    public PolicyServerService(RestTemplate restTemplate) {
        this.restTemplate = restTemplate;
    }

    public String getAuthorizedResources(String userId, String authToken) {
        String url = "http://your-policy-server/api/user/" + userId + "/authorized-resources";
        return restTemplate.getForObject(url, String.class, authToken);
    }
}

Policy Server的响应一般是JSON或者XML格式，下面针对这两种情况给出解析方案：

解析JSON响应（用Jackson） #

假设Policy Server返回的JSON结构如下：

{
"username": "testUser",
"assignedRoles": ["Google:CHN:User"],
"authorizedResources": ["button1", "Submit", "table2"]
}

你可以先定义对应的Java实体类：

import java.util.List;

public class UserAuthorization {
    private String username;
    private List<String> assignedRoles;
    private List<String> authorizedResources;

    // Getter & Setter
    public String getUsername() { return username; }
    public void setUsername(String username) { this.username = username; }
    public List<String> getAssignedRoles() { return assignedRoles; }
    public void setAssignedRoles(List<String> assignedRoles) { this.assignedRoles = assignedRoles; }
    public List<String> getAuthorizedResources() { return authorizedResources; }
    public void setAuthorizedResources(List<String> authorizedResources) { this.authorizedResources = authorizedResources; }
}

然后用Jackson解析：

import com.fasterxml.jackson.databind.ObjectMapper;

public class JsonParser {
    private final ObjectMapper objectMapper = new ObjectMapper();

    public UserAuthorization parseAuthorization(String jsonResponse) throws Exception {
        return objectMapper.readValue(jsonResponse, UserAuthorization.class);
    }
}

解析XML响应（用JAXB） #

如果响应是XML格式，比如：

return (<UserAuthorization>
  <username>testUser</username>
  <assignedRoles>
    <role>Google:CHN:User</role>
  </assignedRoles>
  <authorizedResources>
    <resource>button1</resource>
    <resource>Submit</resource>
  </authorizedResources>
</UserAuthorization>
)

给实体类加上JAXB注解：

import javax.xml.bind.annotation.XmlElement;
import javax.xml.bind.annotation.XmlRootElement;
import java.util.List;

@XmlRootElement(name = "UserAuthorization")
public class UserAuthorization {
    private String username;
    private List<String> assignedRoles;
    private List<String> authorizedResources;

    @XmlElement
    public String getUsername() { return username; }
    public void setUsername(String username) { this.username = username; }

    @XmlElement(name = "role")
    public List<String> getAssignedRoles() { return assignedRoles; }
    public void setAssignedRoles(List<String> assignedRoles) { this.assignedRoles = assignedRoles; }

    @XmlElement(name = "resource")
    public List<String> getAuthorizedResources() { return authorizedResources; }
    public void setAuthorizedResources(List<String> authorizedResources) { this.authorizedResources = authorizedResources; }
}

然后用JAXB解析：

import javax.xml.bind.JAXBContext;
import javax.xml.bind.Unmarshaller;
import java.io.StringReader;

public class XmlParser {
    public UserAuthorization parseAuthorization(String xmlResponse) throws Exception {
        JAXBContext context = JAXBContext.newInstance(UserAuthorization.class);
        Unmarshaller unmarshaller = context.createUnmarshaller();
        return (UserAuthorization) unmarshaller.unmarshal(new StringReader(xmlResponse));
    }
}

如果用户频繁请求权限信息，每次都调用Policy Server会影响性能，建议用本地缓存来存储用户的授权资源列表，比如用Guava Cache或者Spring Cache：

Guava Cache示例 #

import com.google.common.cache.Cache;
import com.google.common.cache.CacheBuilder;
import java.util.concurrent.TimeUnit;

public class AuthorizationCache {
    private final Cache<String, List<String>> resourceCache;

    public AuthorizationCache() {
        resourceCache = CacheBuilder.newBuilder()
                .expireAfterWrite(30, TimeUnit.MINUTES) // 30分钟过期
                .maximumSize(1000) // 最多缓存1000个用户的权限
                .build();
    }

    public List<String> getCachedResources(String userId) {
        return resourceCache.getIfPresent(userId);
    }

    public void cacheResources(String userId, List<String> resources) {
        resourceCache.put(userId, resources);
    }
}

• 务必携带正确的认证信息：Policy Server肯定会校验用户身份，所以请求时要带上登录后拿到的有效凭证（比如Session ID、Token），避免401/403错误。
• 提前确认响应格式：和Policy Server的维护方确认好响应的具体字段结构，避免解析时出现字段不匹配的问题。
• 处理角色层级/继承：如果你的角色有层级关系（比如Alphabet:EU:Admin包含Google:EU:*的所有权限），需要额外编写逻辑来处理这种角色的权限继承，确保拿到完整的授权资源。
• 异常处理：要处理HTTP请求失败、响应格式错误、网络超时等异常情况，必要时添加重试机制（比如用Spring Retry）。

内容的提问来源于stack exchange，提问作者Mr.Green