调整 IAM

blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java

@@ -86,6 +86,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 	private static final String IAM_TOKEN_URI = "/iam/sso/token";
 	private static final String BEARER_PREFIX = "Bearer ";
 	private static final String BASIC_PREFIX = "Basic ";
+	private static final String IAM_DEFAULT_ROLE_ID = "1123598816738675203";
 
 	private final OAuth2ClientService clientService;
 	private final IUserClient userClient;
@@ -159,27 +160,40 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 		if (user == null) {
 			throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
 		}
+		if (user.getAuthorities() == null || user.getAuthorities().isEmpty()) {
+			log.warn("IAM统一身份认证用户缺少可登录角色，tenantId={}, accountNo={}", tenantId, accountNo);
+			throw new UserInvalidException(OAuth2TokenConstant.USER_HAS_NO_ROLE);
+		}
 		user.setClient(client(request));
 		return user;
 	}
 
 	private UserInfo loadOrCreateIamUser(OAuth2Request request, IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
 		R<UserInfo> result = userClient.userInfo(tenantId, accountNo);
-		if (result.isSuccess() && hasUser(result.getData())) {
+		if (result.isSuccess() && hasLoginAccess(result.getData())) {
 			return result.getData();
 		}
+		if (result.isSuccess() && hasUser(result.getData())) {
+			log.info("IAM统一身份认证账号缺少可登录角色，开始补齐默认角色，tenantId={}, accountNo={}", tenantId, accountNo);
+		} else {
 			log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}, querySuccess={}",
 				tenantId, accountNo, result.isSuccess());
+		}
 		R<Boolean> saveResult = userClient.saveIamUser(buildIamUser(profileResponse, tenantId, accountNo));
 		if (!saveResult.isSuccess() || !Boolean.TRUE.equals(saveResult.getData())) {
-			log.warn("IAM统一身份认证自动创建用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, saveResult.getMsg());
+			String failMsg = StringUtil.isNotBlank(saveResult.getMsg()) ? saveResult.getMsg() : OAuth2TokenConstant.USER_HAS_NO_ROLE;
-			throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
+			log.warn("IAM统一身份认证自动创建或补齐用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, failMsg);
+			throw new UserInvalidException(failMsg);
 		}
 		R<UserInfo> createdResult = userClient.userInfo(tenantId, accountNo);
 		if (!createdResult.isSuccess() || !hasUser(createdResult.getData())) {
 			log.warn("IAM统一身份认证自动创建用户后未查询到用户，tenantId={}, accountNo={}", tenantId, accountNo);
 			throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
 		}
+		if (!hasRoles(createdResult.getData())) {
+			log.warn("IAM统一身份认证自动创建用户后仍缺少可登录角色，tenantId={}, accountNo={}", tenantId, accountNo);
+			throw new UserInvalidException(OAuth2TokenConstant.USER_HAS_NO_ROLE);
+		}
 		return createdResult.getData();
 	}
 
@@ -191,6 +205,14 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 		return userInfo != null && userInfo.getUser() != null;
 	}
 
+	private boolean hasRoles(UserInfo userInfo) {
+		return userInfo != null && userInfo.getRoles() != null && !userInfo.getRoles().isEmpty();
+	}
+
+	private boolean hasLoginAccess(UserInfo userInfo) {
+		return hasUser(userInfo) && hasRoles(userInfo);
+	}
+
 	private User buildIamUser(IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
 		User user = new User();
 		user.setTenantId(tenantId);
@@ -199,7 +221,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 		user.setPassword(UUID.randomUUID().toString());
 		user.setName(accountNo);
 		user.setRealName(accountNo);
-		user.setRoleId(StringPool.MINUS_ONE);
+		user.setRoleId(IAM_DEFAULT_ROLE_ID);
 		user.setDeptId(StringPool.MINUS_ONE);
 		user.setPostId(StringPool.MINUS_ONE);
 		user.setIsOa(1);

blade-auth/src/main/java/org/springblade/auth/handler/BladeAuthorizationHandler.java

@@ -154,7 +154,11 @@ public class BladeAuthorizationHandler extends AbstractAuthorizationHandler {
 	 */
 	@Override
 	public void authFailure(OAuth2User user, OAuth2Request request, OAuth2Validation validation) {
-		// 自定义认证失败回调
+		log.error("用户：{}，认证失败，失败原因：{}，grantType={}，authorities={}",
+			user == null ? request.getUsername() : user.getAccount(),
+			validation.getMessage(),
+			request.getGrantType(),
+			user == null ? null : user.getAuthorities());
 	}
 
 	/**

blade-service/blade-system/src/main/java/org/springblade/system/service/IUserService.java

@@ -281,7 +281,7 @@ public interface IUserService extends BaseService<User> {
 	boolean registerUser(User user);
 
 	/**
-	 * 新建IAM统一身份认证用户（按可信租户落库）
+	 * 新建或补齐IAM统一身份认证用户（按可信租户落库，默认分配角色 1123598816738675203）
 	 *
 	 * @param user 用户实体
 	 * @return 是否成功

blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java

@@ -96,6 +96,7 @@ public class UserServiceImpl extends BaseServiceImpl<UserMapper, User> implement
 	private static final String PASSWORD_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
 	private static final int RANDOM_PASSWORD_LENGTH = 8;
 	private static final SecureRandom SECURE_RANDOM = new SecureRandom();
+	private static final Long IAM_DEFAULT_ROLE_ID = 1123598816738675203L;
 
 	private final IUserDeptService userDeptService;
 	private final UserDataScopeMapper userDataScopeMapper;
@@ -563,8 +564,27 @@ public class UserServiceImpl extends BaseServiceImpl<UserMapper, User> implement
 		if (user.getUserType() == null) {
 			user.setUserType(UserType.WEB.getCategory());
 		}
-		if (StringUtil.isBlank(user.getRoleId())) {
+		String defaultRoleId = resolveIamDefaultRoleId();
-			user.setRoleId(StringPool.MINUS_ONE);
+		User existingUser = userByAccount(user.getTenantId(), user.getAccount());
+		if (existingUser != null) {
+			boolean changed = false;
+			if (isMissingIamRole(existingUser.getRoleId())) {
+				existingUser.setRoleId(defaultRoleId);
+				changed = true;
+			}
+			if (existingUser.getIsOa() == null || existingUser.getIsOa() != 1) {
+				existingUser.setIsOa(1);
+				existingUser.setSyncTime(new Date());
+				changed = true;
+			}
+			if (!changed) {
+				return true;
+			}
+			CacheUtil.clear(USER_CACHE);
+			return this.updateById(existingUser);
+		}
+		if (isMissingIamRole(user.getRoleId())) {
+			user.setRoleId(defaultRoleId);
 		}
 		if (StringUtil.isBlank(user.getDeptId())) {
 			user.setDeptId(StringPool.MINUS_ONE);
@@ -579,6 +599,20 @@ public class UserServiceImpl extends BaseServiceImpl<UserMapper, User> implement
 		return saveUser(user);
 	}
 
+	private boolean isMissingIamRole(String roleId) {
+		return StringUtil.isBlank(roleId) || StringPool.MINUS_ONE.equals(roleId);
+	}
+
+	private String resolveIamDefaultRoleId() {
+		Role role = roleService.getOne(Wrappers.<Role>lambdaQuery()
+			.eq(Role::getId, IAM_DEFAULT_ROLE_ID)
+			.eq(Role::getIsDeleted, BladeConstant.DB_NOT_DELETED));
+		if (role == null || role.getId() == null) {
+			throw new ServiceException("IAM用户默认角色不存在，roleId=" + IAM_DEFAULT_ROLE_ID);
+		}
+		return String.valueOf(role.getId());
+	}
+
 	@Override
 	@Transactional(rollbackFor = Exception.class)
 	public boolean updatePlatform(Long userId, Integer userType, String userExt) {