b2894lxlx/tms-erp-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

调整 IAM

Browse Source
This commit is contained in:
b2894lxlx
2026-09-16 04:51:16 +08:00
parent af3b6982fd
commit 4d412e90ee
4 changed files with 70 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
+28 -6
View File
@@ -86,6 +86,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
private static final String IAM_TOKEN_URI = "/iam/sso/token";
private static final String BEARER_PREFIX = "Bearer ";
private static final String BASIC_PREFIX = "Basic ";
private static final String IAM_DEFAULT_ROLE_ID = "1123598816738675203";
private final OAuth2ClientService clientService;
private final IUserClient userClient;
@@ -159,27 +160,40 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
if (user == null) {
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
}
if (user.getAuthorities() == null || user.getAuthorities().isEmpty()) {
log.warn("IAM统一身份认证用户缺少可登录角色，tenantId={}, accountNo={}", tenantId, accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_HAS_NO_ROLE);
}
user.setClient(client(request));
return user;
}
private UserInfo loadOrCreateIamUser(OAuth2Request request, IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
R<UserInfo> result = userClient.userInfo(tenantId, accountNo);
if (result.isSuccess() && hasUser(result.getData())) {
if (result.isSuccess() && hasLoginAccess(result.getData())) {
return result.getData();
}
log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}, querySuccess={}",
tenantId, accountNo, result.isSuccess());
if (result.isSuccess() && hasUser(result.getData())) {
log.info("IAM统一身份认证账号缺少可登录角色，开始补齐默认角色，tenantId={}, accountNo={}", tenantId, accountNo);
} else {
log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}, querySuccess={}",
tenantId, accountNo, result.isSuccess());
}
R<Boolean> saveResult = userClient.saveIamUser(buildIamUser(profileResponse, tenantId, accountNo));
if (!saveResult.isSuccess() || !Boolean.TRUE.equals(saveResult.getData())) {
log.warn("IAM统一身份认证自动创建用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, saveResult.getMsg());
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
String failMsg = StringUtil.isNotBlank(saveResult.getMsg()) ? saveResult.getMsg() : OAuth2TokenConstant.USER_HAS_NO_ROLE;
log.warn("IAM统一身份认证自动创建或补齐用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, failMsg);
throw new UserInvalidException(failMsg);
}
R<UserInfo> createdResult = userClient.userInfo(tenantId, accountNo);
if (!createdResult.isSuccess() || !hasUser(createdResult.getData())) {
log.warn("IAM统一身份认证自动创建用户后未查询到用户，tenantId={}, accountNo={}", tenantId, accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
}
if (!hasRoles(createdResult.getData())) {
log.warn("IAM统一身份认证自动创建用户后仍缺少可登录角色，tenantId={}, accountNo={}", tenantId, accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_HAS_NO_ROLE);
}
return createdResult.getData();
}
@@ -191,6 +205,14 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
return userInfo != null && userInfo.getUser() != null;
}
private boolean hasRoles(UserInfo userInfo) {
return userInfo != null && userInfo.getRoles() != null && !userInfo.getRoles().isEmpty();
}
private boolean hasLoginAccess(UserInfo userInfo) {
return hasUser(userInfo) && hasRoles(userInfo);
}
private User buildIamUser(IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
User user = new User();
user.setTenantId(tenantId);
@@ -199,7 +221,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
user.setPassword(UUID.randomUUID().toString());
user.setName(accountNo);
user.setRealName(accountNo);
user.setRoleId(StringPool.MINUS_ONE);
user.setRoleId(IAM_DEFAULT_ROLE_ID);
user.setDeptId(StringPool.MINUS_ONE);
user.setPostId(StringPool.MINUS_ONE);
user.setIsOa(1);
blade-auth/src/main/java/org/springblade/auth/handler/BladeAuthorizationHandler.java
+5 -1
View File
@@ -154,7 +154,11 @@ public class BladeAuthorizationHandler extends AbstractAuthorizationHandler {
*/
@Override
public void authFailure(OAuth2User user, OAuth2Request request, OAuth2Validation validation) {
// 自定义认证失败回调
log.error("用户：{}，认证失败，失败原因：{}，grantType={}，authorities={}",
user == null ? request.getUsername() : user.getAccount(),
validation.getMessage(),
request.getGrantType(),
user == null ? null : user.getAuthorities());
}
/**