b2894lxlx/tms-erp-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IAM对接调试

Browse Source
This commit is contained in:
b2894lxlx
2026-07-15 22:25:53 +08:00
parent 5860040bcf
commit 2ebe156540
1 changed files with 48 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
View File

@@ -56,6 +56,7 @@ import org.springframework.stereotype.Component;
import java.io.IOException; import java.io.IOException;
import java.net.URI; import java.net.URI;
import java.net.URLDecoder;
import java.net.URLEncoder; import java.net.URLEncoder;
import java.net.http.HttpClient; import java.net.http.HttpClient;
import java.net.http.HttpRequest; import java.net.http.HttpRequest;
@@ -122,7 +123,12 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND); throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
} }
UserInfo userInfo = loadOrCreateIamUser(request, profileResponse, accountNo); String tenantId = resolveTenantId(request);
if (StringUtil.isBlank(tenantId)) {
log.warn("IAM统一身份认证请求缺少租户ID，accountNo={}", accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
}
UserInfo userInfo = loadOrCreateIamUser(request, profileResponse, tenantId, accountNo);
OAuth2User user = TokenUtil.convertUser(userInfo, request); OAuth2User user = TokenUtil.convertUser(userInfo, request);
if (user == null) { if (user == null) {
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND); throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
@@ -131,28 +137,28 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
return user; return user;
} }
private UserInfo loadOrCreateIamUser(OAuth2Request request, IamSsoProfileResponse profileResponse, String accountNo) { private UserInfo loadOrCreateIamUser(OAuth2Request request, IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
R<UserInfo> result = userClient.userInfo(request.getTenantId(), accountNo); R<UserInfo> result = userClient.userInfo(tenantId, accountNo);
if (result.isSuccess() && result.getData() != null) { if (result.isSuccess() && result.getData() != null) {
return result.getData(); return result.getData();
} }
log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}", request.getTenantId(), accountNo); log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}", tenantId, accountNo);
R<Boolean> saveResult = userClient.saveUser(buildIamUser(request, profileResponse, accountNo)); R<Boolean> saveResult = userClient.saveUser(buildIamUser(profileResponse, tenantId, accountNo));
if (!saveResult.isSuccess() || !Boolean.TRUE.equals(saveResult.getData())) { if (!saveResult.isSuccess() || !Boolean.TRUE.equals(saveResult.getData())) {
log.warn("IAM统一身份认证自动创建用户失败，tenantId={}, accountNo={}, msg={}", request.getTenantId(), accountNo, saveResult.getMsg()); log.warn("IAM统一身份认证自动创建用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, saveResult.getMsg());
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND); throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
} }
R<UserInfo> createdResult = userClient.userInfo(request.getTenantId(), accountNo); R<UserInfo> createdResult = userClient.userInfo(tenantId, accountNo);
if (!createdResult.isSuccess() || createdResult.getData() == null) { if (!createdResult.isSuccess() || createdResult.getData() == null) {
log.warn("IAM统一身份认证自动创建用户后未查询到用户，tenantId={}, accountNo={}", request.getTenantId(), accountNo); log.warn("IAM统一身份认证自动创建用户后未查询到用户，tenantId={}, accountNo={}", tenantId, accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND); throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
} }
return createdResult.getData(); return createdResult.getData();
} }
private User buildIamUser(OAuth2Request request, IamSsoProfileResponse profileResponse, String accountNo) { private User buildIamUser(IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
User user = new User(); User user = new User();
user.setTenantId(request.getTenantId()); user.setTenantId(tenantId);
user.setUserType(UserType.WEB.getCategory()); user.setUserType(UserType.WEB.getCategory());
user.setAccount(accountNo); user.setAccount(accountNo);
user.setPassword(accountNo); user.setPassword(accountNo);
@@ -162,12 +168,42 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
user.setDeptId(StringPool.MINUS_ONE); user.setDeptId(StringPool.MINUS_ONE);
user.setPostId(StringPool.MINUS_ONE); user.setPostId(StringPool.MINUS_ONE);
user.setStatus(StatusType.ACTIVE.getType()); user.setStatus(StatusType.ACTIVE.getType());
log.info("IAM统一身份认证自动创建用户参数，tenantId={}, accountNo={}, iamId={}", request.getTenantId(), accountNo, profileResponse.getId()); log.info("IAM统一身份认证自动创建用户参数，tenantId={}, accountNo={}, iamId={}", tenantId, accountNo, profileResponse.getId());
return user; return user;
} }
private boolean isIamRequest(OAuth2Request request) { private boolean isIamRequest(OAuth2Request request) {
return StringUtil.isNotBlank(properties.getRedirectUri()) && StringUtil.equals(properties.getRedirectUri(), request.getRedirectUri()); String redirectUri = normalizeRedirectUri(request.getRedirectUri());
boolean iamRequest = StringUtil.isNotBlank(properties.getRedirectUri())
&& StringUtil.isNotBlank(request.getCode())
&& StringUtil.equals(properties.getRedirectUri(), redirectUri);
if (!iamRequest) {
log.info("IAM统一身份认证请求未命中，configRedirectUri={}, requestRedirectUri={}, normalizedRedirectUri={}, code={}",
properties.getRedirectUri(), request.getRedirectUri(), redirectUri, request.getCode());
}
return iamRequest;
}
private String resolveTenantId(OAuth2Request request) {
if (StringUtil.isNotBlank(request.getTenantId())) {
return request.getTenantId();
}
if (request.getHttpRequest() == null) {
return null;
}
return request.getHttpRequest().getParameter("tenantId");
}
private String normalizeRedirectUri(String redirectUri) {
if (StringUtil.isBlank(redirectUri)) {
return redirectUri;
}
try {
return URLDecoder.decode(redirectUri, StandardCharsets.UTF_8);
} catch (IllegalArgumentException exception) {
log.warn("IAM统一身份认证redirect_uri解码失败，redirectUri={}", redirectUri, exception);
return redirectUri;
}
} }
private void validateRequest(OAuth2Request request) { private void validateRequest(OAuth2Request request) {