BlogJava-xwgong-文章分类-支付

java服务器端移动银联支付的流程

龚小伟 — Tue, 24 Sep 2013 06:47:00 GMT

一,银联支付的整体流程

客户端提供服务器给服务器订单信息----服务器端拿到数据推送给银联指定的地址----银联给服务器端返回一个流水账号----服务器将流水账号返给客户端
----客户端由于集成了银联控件,根据流水账号调用银联支付界面进行支付----支付完成之后银联会回调服务器端提供的回调地址----服务器端根据回调参数处理业务逻辑

二,服务器端主要代码解析.

upmp.properties

security.key=******//银联技术给我们提供的商户密钥
mer.id=88000000000***** //商户的银联账号

mer.back.end.url=/servlet/unionpaycallback//支付成功后银联的回调地址
mer.front.end.url=http://www.yourdomain.com/your_path/yourFrontEndUrl//支付成功后银联回调的前段地址,可不填

# message info
version=1.0.0//版本号
charset=UTF-8//编码
sign.method=MD5//加密方法

# server url
upmp.trade.url=http://222.66.233.198:8080/gateway/merchant/trade//处理交易请求的银联地址
upmp.query.url=http://222.66.233.198:8080/gateway/merchant/query//查询交易的银联地址

card=6226440123456785//银联提供的测试账户
password=111101//银联提供的测试密码

下面是给银联推送订单的代码.
/**
* 银联支付推送给银联
*/
public String executeUnionPayMoney(String auth, String info, String basePath) {
  //returnMap--返回的Map
  //returnParams--定义的参数返回类型
  Map returnMap = new HashMap();
  String result ="";
  try{
   //把info中的信息解析成map
   @SuppressWarnings("unchecked")
   Map map = JSON.parseObject(info, Map.class);
   OrderDao orderDao = (OrderDao) ac.getBean("orderDao");
   if(map.get("order_id")!=null&&!map.get("order_id").equals("")&&
     map.get("user_id")!=null&&!map.get("user_id").equals("")&&
     map.get("payMoney")!=null&&!map.get("payMoney").equals("")){
    //把订单数据推给银联(订单推送接口),根据返回结果是否为true
    Order order = orderDao.getById(Long.valueOf(map.get("order_id").toString()));
    Map req = new HashMap();
    Map reqReservedMap = new HashMap();
       reqReservedMap.put("user_id", map.get("user_id").toString());
       reqReservedMap.put("order_id", map.get("order_id").toString());
       reqReservedMap.put("opt", "0");//自己自定义的参数,把Map转换成json字符串,通过请求方保留域reqReserved传递给银联,方便银联回调服务器时,服务器处理业务逻辑使用
    req.put("version", UpmpConfig.VERSION);// 版本号
    req.put("charset", UpmpConfig.CHARSET);// 字符编码
    req.put("transType", "01");// 交易类型
    req.put("merId", UpmpConfig.MER_ID);// 商户代码
    //req.put("backEndUrl",basePath.substring(0, basePath.length()-1) + UpmpConfig.MER_BACK_END_URL);// 通知URL
    req.put("backEndUrl",basePath.substring(0, basePath.length()-1) + UpmpConfig.MER_BACK_END_URL);// 通知URL 我自己提供给银联支付成功后的回调地址
    req.put("frontEndUrl", UpmpConfig.MER_FRONT_END_URL);// 前台通知URL(可选)
    req.put("orderDescription", "航空机票付款");// 订单描述(可选)
    req.put("orderTime", new SimpleDateFormat("yyyyMMddHHmmss").format(new Date()));// 交易开始日期时间yyyyMMddHHmmss
    req.put("orderTimeout", "");// 订单超时时间yyyyMMddHHmmss(可选);默认的是一小时
    req.put("orderNumber", orderDao.getById(Long.valueOf(map.get("order_id").toString())).getOrderNum());//订单号(商户根据自己需要生成订单号)
    req.put("orderAmount", Integer.valueOf(map.get("payMoney").toString())*100+"");// 订单金额;因为这里默认的单位是分,而通常客户端传过来的单位是元,所以需要再此
//处进行*100的操作,防止因为单位换算导致支付出现问题,需要注意的是:银联回调时你如果从回调的参数中拿settleAmount,记得进行除100的操作
          req.put("orderCurrency", "156");// 交易币种(可选) 156代表人民币
          req.put("reqReserved", new Gson().toJson(reqReservedMap));// 请求方保留域(可选，用于透传商户信息)//此处用于传递咱们自己的参数,可以再银联回调时使用,
//此处我是以json字符串的方式传递参数的,之后解析json字符串即可获取相关参数.
    Map resp = new HashMap();
    boolean validResp = UpmpService.trade(req, resp);
   if(order.getPayState()==0){
    returnMap.put("errcode",-98);
    returnMap.put("msg","该订单已支付");
   }else{
          // 商户的业务逻辑
          if (validResp){
              // 服务器应答签名验证成功
          returnMap.put("tn", resp.get("tn"));//交易流水号,默认的参数就是tn
           returnMap.put("errcode",0);
     returnMap.put("msg","成功返回流水号");
          }else {
              // 服务器应答签名验证失败
          returnMap.put("errcode",-100);
     returnMap.put("msg","系统出错");
          }
   }
   }else {
    returnMap.put("errcode",-9);
    returnMap.put("msg","传值错误");
   }

  }catch (Exception e) {
   e.printStackTrace();
   returnMap.put("errcode",-99);
   returnMap.put("msg","服务器出现异常");
  }
  result=JSON.toJSONString(returnMap);
  return result;
}

CallBackUnionPay.java
这个是我自己写的一个银联回调的servlet,opt为自定义参数,opt=0代表支付订单,opt=1代表充值操作

/**
* Alipay.com Inc.
* Copyright (c) 2005-2008 All Rights Reserved.
*/
package com.unionpay.upmp.sdk.callback;

import java.io.IOException;
import java.io.PrintWriter;
import java.util.Date;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import com.airplane.base.AbstractExecution;
import com.airplane.dao.AccountDao;
import com.airplane.dao.IntegralDao;
import com.airplane.dao.OrderDao;
import com.airplane.dao.UserDao;
import com.airplane.domain.Account;
import com.airplane.domain.Integral;
import com.airplane.domain.Order;
import com.airplane.domain.User;
import com.google.gson.Gson;
import com.unionpay.upmp.sdk.service.UpmpService;

/**
* 接收通知并处理
*
* @author gxw
*/
public class CallBackUnionPay extends HttpServlet {

private static final long serialVersionUID = 7216412938937049671L;
private static Log logger = LogFactory.getLog(CallBackUnionPay.class);

    @SuppressWarnings("unchecked")
public void doPost(HttpServletRequest request, HttpServletResponse response){
    logger.info("==============================here===========================");
    System.out.println("接收到通知!");
    PrintWriter out;
  try {
   out = response.getWriter();
    Map params = new HashMap();
    Map requestParams = request.getParameterMap();
    logger.info("request的参数:"+requestParams);
    for (Iterator iter = requestParams.keySet().iterator(); iter.hasNext();) {
      String name = (String) iter.next();
      String[] values = (String[]) requestParams.get(name);
      String valueStr = "";
      for (int i = 0; i < values.length; i++) {
       valueStr = (i == values.length - 1) ? valueStr + values[i]
         : valueStr + values[i] + ",";
      }
      params.put(name, valueStr);
    }
    logger.info("request处理后的参数:"+params);
    Map personParams = new Gson().fromJson(params.get("reqReserved"), Map.class);//解析在上一步自定义的json参数,方便处理业务逻辑.
     if(UpmpService.verifySignature(params)){// 服务器签名验证成功
      //请在这里加上商户的业务逻辑程序代码
        if("0".equals(personParams.get("opt"))){
   String user_id = personParams.get("user_id");
   String order_id = personParams.get("order_id");
   logger.info("user_id"+user_id+"&order_id="+order_id);
      //获取通知返回参数，可参考接口文档中通知参数列表(以下仅供参考)
      String transStatus = request.getParameter("transStatus");// 交易状态
      if (null != transStatus && transStatus.equals("00")) {
          // 交易处理成功
     }
      out.println("success");
    }
    if("1".equals(personParams.get("opt"))){
   String payMoney2 = params.get("settleAmount");
   String user_id2 = personParams.get("user_id");
      //获取通知返回参数，可参考接口文档中通知参数列表(以下仅供参考)
      String transStatus2 = request.getParameter("transStatus");// 交易状态
      if (null != transStatus2 && transStatus2.equals("00")) {
          // 交易处理成功
      }
      out.println("success");
    }
    else{// 服务器签名验证失败
      out.println("fail");
    }
    }

  }catch (IOException e) {
   e.printStackTrace();
   logger.error(e);
  }
    }
    /*public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
    doPost(request, response);
}*/
}

龚小伟 2013-09-24 14:47 发表评论

支付宝快捷支付(安卓版)的服务器开发流程

龚小伟 — Wed, 14 Aug 2013 06:12:00 GMT

1 package com.alipay.client.base;
2
3 public class PartnerConfig {
4
5     //合作商户ID。用签约支付宝账号登录ms.alipay.com后，在账户信息页面获取。
6     public static final String PARTNER = "2088011096718773";
7     // 账户ID。用签约支付宝账号登录ms.alipay.com后，在账户信息页面获取。
8     public static final String SELLER = "2088011096718773";
9     // 商户（RSA）私钥
10     public static final String RSA_PRIVATE = "";
11
12     // 支付宝（RSA）公钥用签约支付宝账号登录ms.alipay.com后，在密钥管理页面获取。
13     public static final String RSA_ALIPAY_PUBLIC = "";
14
15 }

PartnerConfig.java为封装商家提供的属性类,参数全部由商户提供或者技术生成
PARTNER 与SELLER 为商户提供的pid,可以再支付宝ms.alipay.com查看.
RSA_PRIVATE为支付宝提供的openssl-0.9.8k_WIN32(RSA密钥生成工具)生成商户私钥.根据商户私钥生成商户公钥(RSA密钥生成工具),把商户公钥在支付宝的私钥管理页面进行提交,支付宝会为商户提供一个支付宝公钥既RSA_ALIPAY_PUBLIC字段的值

package com.alipay.client.callback;

import java.io.PrintWriter;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.alipay.client.base.PartnerConfig;
import com.alipay.client.security.RSASignature;

/**
* 安全支付支付完成商户同步处理程序
* 对支付宝返回订单信息验签名
*/
public class RSACallBack extends HttpServlet {

    private static final long serialVersionUID = -2234271646410251381L;

    //签名成功
    public static final String RESULT_CHECK_SIGN_SUCCEED  = "T";
    //签名失败
    public static final String RESULT_CHECK_SIGN_FAILED = "F";

    @SuppressWarnings("unchecked")
    public void doPost(HttpServletRequest request, HttpServletResponse response)throws UnsupportedEncodingException {
        //获得待签名数据和签名值
        String sign = URLDecoder.decode(request.getParameter("sign"),"utf-8");
        String content = URLDecoder.decode(request.getParameter("content"),"utf-8");

        String retVal = RESULT_CHECK_SIGN_FAILED;
        //使用支付宝公钥验签名
        try {
            PrintWriter out = response.getWriter();
            if(RSASignature.doCheck(content, sign, PartnerConfig.RSA_ALIPAY_PUBLIC)){
                retVal=RESULT_CHECK_SIGN_SUCCEED;
            }

            response.setContentType("text/html");
            System.out.println("retVal : " + retVal);
            out.print(retVal);
            out.flush();
            out.close();
        } catch (Exception e) {
            e.printStackTrace();
            System.out.println("验签名失败");
        }

    }
}
这个类基本不需要做修改,主要是RESULT_CHECK_SIGN_SUCCEED和RESULT_CHECK_SIGN_FAILED的值必须要与客户端相应代码的相应字段保持一致.这个类主要是支付完成之后客户端与服务器进行的一次验签名,可以用来更新数据给客户端.

/**
* Alipay.com Inc.
* Copyright (c) 2005-2008 All Rights Reserved.
*/
package com.alipay.client.notify;

import java.io.IOException;
import java.io.PrintWriter;
import java.util.Date;
import java.util.Map;

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import com.airplane.base.AbstractExecution;
import com.airplane.dao.IntegralDao;
import com.airplane.dao.OrderDao;
import com.airplane.dao.UserDao;
import com.airplane.domain.Integral;
import com.airplane.domain.Order;
import com.airplane.domain.User;
import com.alipay.client.base.PartnerConfig;
import com.alipay.client.security.RSASignature;

/**
* 接收通知并处理
*
* @author 3y
* @version $Id: NotifyReceiver.java, v 0.1 2011-8-15 下午03:11:58 3y Exp $
*/
public class RSANotifyReceiver extends HttpServlet {

    private static final long                          serialVersionUID = 7216412938937049671L;
    private static Log logger = LogFactory.getLog(RSANotifyReceiver.class);

    @SuppressWarnings("unchecked")
    public void doPost(HttpServletRequest request, HttpServletResponse response){
        System.out.println("接收到通知!");
        //获得通知参数
        try{
        Map map = request.getParameterMap();
        //获得通知签名
        String sign = (String) ((Object[]) map.get("sign"))[0];
        logger.info("sign="+sign);
        //获得待验签名的数据
        String verifyData = getVerifyData(map);
        logger.info("verifyData="+verifyData);
        boolean verified = false;
        //使用支付宝公钥验签名
        try {
            verified = RSASignature.doCheck(verifyData, sign, PartnerConfig.RSA_ALIPAY_PUBLIC);
            logger.info("verified="+verified);
        } catch (Exception e) {
            e.printStackTrace();
        }
        PrintWriter out = response.getWriter();
        //验证签名通过
        if (verified) {
            //根据交易状态处理业务逻辑
            //当交易状态成功，处理业务逻辑成功。回写success
                    logger.info("支付宝支付:保存数据库信息success");
                    out.print("success");
                }else{
                    out.print("fail");
                }
            }

            }else{
                out.print("fail");
            }
        } else {
            System.out.println("接收支付宝系统通知验证签名失败，请检查！");
            out.print("fail");
        }
        }catch (Exception e) {
            e.printStackTrace();
            logger.info(e);
        }
    }

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
        doPost(request, response);
    }

    /**
     * 获得验签名的数据
     * @param map
     * @return
     * @throws Exception
     */
    @SuppressWarnings("unchecked")
    private String getVerifyData(Map map) {
        String notify_data = (String) ((Object[]) map.get("notify_data"))[0];
        logger.info(notify_data);
        return "notify_data="+notify_data;
    }
}
RSANotifyReceiver.java是支付宝回调服务器的servlet,需要安卓客户端传递该servlet地址及相关参数给支付宝,支付宝会在支付完成之后进行回调.回调之后会返回消息给支付宝.

/**
* Alipay.com Inc.
* Copyright (c) 2005-2008 All Rights Reserved.
*/
package com.alipay.client.trade;

import java.io.IOException;
import java.io.PrintWriter;
import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
import java.security.Security;

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

import com.airplane.action.BackStageAction;
import com.alipay.client.base.PartnerConfig;
import com.alipay.client.security.RSASignature;
import com.alipay.client.util.StringUtil;

/**
*
* 安全支付服务器端处理程序
*
* 1.将业务参数：合作商户ID、外部交易号、商品名称、商品的具体描述、商品总价、卖家帐户、notify_url这些参数按照固定顺序签名
* 2.将签名结果返回客户端
* @author 3Y
*/
public class RSATrade extends HttpServlet {

    private static final long serialVersionUID = -3035307235076650766L;
    private static Log logger = LogFactory.getLog(RSATrade.class);
    static {
          Security.addProvider(new BouncyCastleProvider());
       }
    String basePath="";
    public void doPost(HttpServletRequest request, HttpServletResponse response)
            throws IOException {
        System.out.println("request in");
        response.setCharacterEncoding("utf-8");
        PrintWriter out = response.getWriter();
        logger.info("here");
        //得到应用服务器地址
        String path = request.getContextPath();
        basePath = request.getScheme() + "://" + request.getLocalAddr() + ":"
                                   + request.getServerPort() + path + "/";
        logger.info("here1");
        String strReString="";
        //检查商户PartnerConfig.java文件的配置参数
        logger.info(checkInfo());
        if(!checkInfo()){
            strReString="F缺少partner或者seller," +
                    "请在com/alipay/client/base/PartnerConfig.java中增加";
            out.print(strReString);
            return;
        }

        String signData=getSignDate(request);
        String sign = sign(signData,PartnerConfig.RSA_PRIVATE);
        signData = URLEncoder.encode(signData,"utf-8");
         sign = URLEncoder.encode(sign,"utf-8");
        logger.info(signData);
        logger.info(sign);
        //返回待签名数据和签名数据
        strReString="T"+signData+""+sign+"";
        logger.info(strReString);
        //对返回客户端的数据encode
        out.print(strReString);
        return;
    }



    //检查商户PartnerConfig.java文件的配置参数
    private boolean checkInfo() {
        String partner = PartnerConfig.PARTNER;
        String seller = PartnerConfig.SELLER;
        //如果合作商户ID为空或者账号ID为空返回false
        if (StringUtil.isBlank(partner) || StringUtil.isBlank(seller))
            return false;

        return true;
    }


    /**
     * 准备待签名的数据
     *
     * @param request
     * @return
     * @throws UnsupportedEncodingException
     */
    private String getSignDate(
            HttpServletRequest request) throws UnsupportedEncodingException {
        request.setCharacterEncoding("utf-8");

        //合作商户ID
        String partner = PartnerConfig.PARTNER;
        //卖家帐号
        String seller = PartnerConfig.SELLER;
     // 外部交易号这里取当前时间，商户可根据自己的情况修改此参数，但保证唯一性
        String outTradeNo = System.currentTimeMillis() + "";
        String opt = request.getParameter("opt").trim();
        String user_id = request.getParameter("user_id").trim();
        //opt:0为支付,1为充值
        if("0".equals(opt)){
            outTradeNo = request.getParameter("order_id").trim();
        }else if("1".equals(opt)){
            outTradeNo = System.currentTimeMillis() + "";
        }

        // 商品名称
        String subject = request.getParameter("subject").trim();
        // 商品具体描述
        String body = request.getParameter("body").trim();
        // 商品总价
        String totalFee = request.getParameter("total_fee").trim();
        // 接收支付宝发送的通知的url 商户可根据自己的情况修改此参数
        String notify_url = basePath+"servlet/RSANotifyReceiver?opt=" + opt +"&order_id="+outTradeNo+"&user_id="+user_id+"&payMoney="+totalFee;

        //组装待签名数据
        String signData = "partner=" + "\"" + partner + "\"";
        signData += "&";
        signData += "seller=" + "\"" + seller + "\"";
        signData += "&";
        signData += "out_trade_no=" + "\"" + outTradeNo + "\"";
        signData += "&";
        signData += "subject=" + "\"" + subject+ "\"";
        signData += "&";
        signData += "body=" + "\"" + body + "\"";
        signData += "&";
        signData += "total_fee=" + "\""+ totalFee + "\"";
        signData += "&";
        signData += "notify_url=" + "\""+notify_url+ "\"";
        return signData;
    }



    /**
     * 对参数进行签名
     *
     * @param signData 待签名数据，key rsa商户私钥
     * @return
     */
    private String sign(String signData,String key) {
        System.out.println("signData:"+signData);
        String sign = "";
        try {
            sign = RSASignature.sign(signData, key);
        } catch (Exception e1) {
            e1.printStackTrace();
        }
        return sign;
    }


}
RSATrade.java为客户端与服务器端为商品信息进行的签名操作,签名完成之后服务器会将签名信息以及回调地址返给客户端.客户端拿到回调地址交给支付宝进行回调.
支付宝流程为:客户端在支付宝支付之前请求RSATrade.java,此时服务器为商品信息注册签名,签名完成之后服务器把签名过的商品信息和支付宝的回调地址(RSANotifyReceiver
)和参数传给客户端,客户端会把回调地址和签过名的商品信息交给支付宝,支付宝在完成支付之后请求回调地址,进行签名和公钥验证,验证成功即可执行持久化操作.若操作成功,客户端会请求RSACallBack.java类,进行客户端与服务器端的同步操作.

龚小伟 2013-08-14 14:12 发表评论