diff --git a/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java b/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java index c1dfecf..1e8a6f0 100644 --- a/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java +++ b/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java @@ -86,6 +86,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter { private static final String IAM_TOKEN_URI = "/iam/sso/token"; private static final String BEARER_PREFIX = "Bearer "; private static final String BASIC_PREFIX = "Basic "; + private static final String IAM_DEFAULT_ROLE_ID = "1123598816738675203"; private final OAuth2ClientService clientService; private final IUserClient userClient; @@ -159,27 +160,40 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter { if (user == null) { throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND); } + if (user.getAuthorities() == null || user.getAuthorities().isEmpty()) { + log.warn("IAM统一身份认证用户缺少可登录角色，tenantId={}, accountNo={}", tenantId, accountNo); + throw new UserInvalidException(OAuth2TokenConstant.USER_HAS_NO_ROLE); + } user.setClient(client(request)); return user; } private UserInfo loadOrCreateIamUser(OAuth2Request request, IamSsoProfileResponse profileResponse, String tenantId, String accountNo) { R result = userClient.userInfo(tenantId, accountNo); - if (result.isSuccess() && hasUser(result.getData())) { + if (result.isSuccess() && hasLoginAccess(result.getData())) { return result.getData(); } - log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}, querySuccess={}", - tenantId, accountNo, result.isSuccess()); + if (result.isSuccess() && hasUser(result.getData())) { + log.info("IAM统一身份认证账号缺少可登录角色，开始补齐默认角色，tenantId={}, accountNo={}", tenantId, accountNo); + } else { + log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}, querySuccess={}", + tenantId, accountNo, result.isSuccess()); + } R saveResult = userClient.saveIamUser(buildIamUser(profileResponse, tenantId, accountNo)); if (!saveResult.isSuccess() || !Boolean.TRUE.equals(saveResult.getData())) { - log.warn("IAM统一身份认证自动创建用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, saveResult.getMsg()); - throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND); + String failMsg = StringUtil.isNotBlank(saveResult.getMsg()) ? saveResult.getMsg() : OAuth2TokenConstant.USER_HAS_NO_ROLE; + log.warn("IAM统一身份认证自动创建或补齐用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, failMsg); + throw new UserInvalidException(failMsg); } R createdResult = userClient.userInfo(tenantId, accountNo); if (!createdResult.isSuccess() || !hasUser(createdResult.getData())) { log.warn("IAM统一身份认证自动创建用户后未查询到用户，tenantId={}, accountNo={}", tenantId, accountNo); throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND); } + if (!hasRoles(createdResult.getData())) { + log.warn("IAM统一身份认证自动创建用户后仍缺少可登录角色，tenantId={}, accountNo={}", tenantId, accountNo); + throw new UserInvalidException(OAuth2TokenConstant.USER_HAS_NO_ROLE); + } return createdResult.getData(); } @@ -191,6 +205,14 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter { return userInfo != null && userInfo.getUser() != null; } + private boolean hasRoles(UserInfo userInfo) { + return userInfo != null && userInfo.getRoles() != null && !userInfo.getRoles().isEmpty(); + } + + private boolean hasLoginAccess(UserInfo userInfo) { + return hasUser(userInfo) && hasRoles(userInfo); + } + private User buildIamUser(IamSsoProfileResponse profileResponse, String tenantId, String accountNo) { User user = new User(); user.setTenantId(tenantId); @@ -199,7 +221,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter { user.setPassword(UUID.randomUUID().toString()); user.setName(accountNo); user.setRealName(accountNo); - user.setRoleId(StringPool.MINUS_ONE); + user.setRoleId(IAM_DEFAULT_ROLE_ID); user.setDeptId(StringPool.MINUS_ONE); user.setPostId(StringPool.MINUS_ONE); user.setIsOa(1); diff --git a/blade-auth/src/main/java/org/springblade/auth/handler/BladeAuthorizationHandler.java b/blade-auth/src/main/java/org/springblade/auth/handler/BladeAuthorizationHandler.java index e6e793e..2c12576 100644 --- a/blade-auth/src/main/java/org/springblade/auth/handler/BladeAuthorizationHandler.java +++ b/blade-auth/src/main/java/org/springblade/auth/handler/BladeAuthorizationHandler.java @@ -154,7 +154,11 @@ public class BladeAuthorizationHandler extends AbstractAuthorizationHandler { */ @Override public void authFailure(OAuth2User user, OAuth2Request request, OAuth2Validation validation) { - // 自定义认证失败回调 + log.error("用户：{}，认证失败，失败原因：{}，grantType={}，authorities={}", + user == null ? request.getUsername() : user.getAccount(), + validation.getMessage(), + request.getGrantType(), + user == null ? null : user.getAuthorities()); } /** diff --git a/blade-service/blade-system/src/main/java/org/springblade/system/service/IUserService.java b/blade-service/blade-system/src/main/java/org/springblade/system/service/IUserService.java index e1ff5ee..35899e0 100644 --- a/blade-service/blade-system/src/main/java/org/springblade/system/service/IUserService.java +++ b/blade-service/blade-system/src/main/java/org/springblade/system/service/IUserService.java @@ -281,7 +281,7 @@ public interface IUserService extends BaseService { boolean registerUser(User user); /** - * 新建IAM统一身份认证用户（按可信租户落库） + * 新建或补齐IAM统一身份认证用户（按可信租户落库，默认分配角色 1123598816738675203） * * @param user 用户实体 * @return 是否成功 diff --git a/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java b/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java index 944d99e..8428dfe 100644 --- a/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java +++ b/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java @@ -96,6 +96,7 @@ public class UserServiceImpl extends BaseServiceImpl implement private static final String PASSWORD_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789"; private static final int RANDOM_PASSWORD_LENGTH = 8; private static final SecureRandom SECURE_RANDOM = new SecureRandom(); + private static final Long IAM_DEFAULT_ROLE_ID = 1123598816738675203L; private final IUserDeptService userDeptService; private final UserDataScopeMapper userDataScopeMapper; @@ -563,8 +564,27 @@ public class UserServiceImpl extends BaseServiceImpl implement if (user.getUserType() == null) { user.setUserType(UserType.WEB.getCategory()); } - if (StringUtil.isBlank(user.getRoleId())) { - user.setRoleId(StringPool.MINUS_ONE); + String defaultRoleId = resolveIamDefaultRoleId(); + User existingUser = userByAccount(user.getTenantId(), user.getAccount()); + if (existingUser != null) { + boolean changed = false; + if (isMissingIamRole(existingUser.getRoleId())) { + existingUser.setRoleId(defaultRoleId); + changed = true; + } + if (existingUser.getIsOa() == null || existingUser.getIsOa() != 1) { + existingUser.setIsOa(1); + existingUser.setSyncTime(new Date()); + changed = true; + } + if (!changed) { + return true; + } + CacheUtil.clear(USER_CACHE); + return this.updateById(existingUser); + } + if (isMissingIamRole(user.getRoleId())) { + user.setRoleId(defaultRoleId); } if (StringUtil.isBlank(user.getDeptId())) { user.setDeptId(StringPool.MINUS_ONE); @@ -579,6 +599,20 @@ public class UserServiceImpl extends BaseServiceImpl implement return saveUser(user); } + private boolean isMissingIamRole(String roleId) { + return StringUtil.isBlank(roleId) || StringPool.MINUS_ONE.equals(roleId); + } + + private String resolveIamDefaultRoleId() { + Role role = roleService.getOne(Wrappers.lambdaQuery() + .eq(Role::getId, IAM_DEFAULT_ROLE_ID) + .eq(Role::getIsDeleted, BladeConstant.DB_NOT_DELETED)); + if (role == null || role.getId() == null) { + throw new ServiceException("IAM用户默认角色不存在，roleId=" + IAM_DEFAULT_ROLE_ID); + } + return String.valueOf(role.getId()); + } + @Override @Transactional(rollbackFor = Exception.class) public boolean updatePlatform(Long userId, Integer userType, String userExt) {