b2894lxlx/tms-erp-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

调整 IAM

Browse Source
This commit is contained in:
b2894lxlx
2026-09-16 04:51:16 +08:00
parent af3b6982fd
commit 4d412e90ee
4 changed files with 70 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
+28 -6
View File
@@ -86,6 +86,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
private static final String IAM_TOKEN_URI = "/iam/sso/token";
private static final String BEARER_PREFIX = "Bearer ";
private static final String BASIC_PREFIX = "Basic ";
private static final String IAM_DEFAULT_ROLE_ID = "1123598816738675203";
private final OAuth2ClientService clientService;
private final IUserClient userClient;
@@ -159,27 +160,40 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
if (user == null) {
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
}
if (user.getAuthorities() == null || user.getAuthorities().isEmpty()) {
log.warn("IAM统一身份认证用户缺少可登录角色，tenantId={}, accountNo={}", tenantId, accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_HAS_NO_ROLE);
}
user.setClient(client(request));
return user;
}
private UserInfo loadOrCreateIamUser(OAuth2Request request, IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
R<UserInfo> result = userClient.userInfo(tenantId, accountNo);
if (result.isSuccess() && hasUser(result.getData())) {
if (result.isSuccess() && hasLoginAccess(result.getData())) {
return result.getData();
}
log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}, querySuccess={}",
tenantId, accountNo, result.isSuccess());
if (result.isSuccess() && hasUser(result.getData())) {
log.info("IAM统一身份认证账号缺少可登录角色，开始补齐默认角色，tenantId={}, accountNo={}", tenantId, accountNo);
} else {
log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}, querySuccess={}",
tenantId, accountNo, result.isSuccess());
}
R<Boolean> saveResult = userClient.saveIamUser(buildIamUser(profileResponse, tenantId, accountNo));
if (!saveResult.isSuccess() || !Boolean.TRUE.equals(saveResult.getData())) {
log.warn("IAM统一身份认证自动创建用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, saveResult.getMsg());
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
String failMsg = StringUtil.isNotBlank(saveResult.getMsg()) ? saveResult.getMsg() : OAuth2TokenConstant.USER_HAS_NO_ROLE;
log.warn("IAM统一身份认证自动创建或补齐用户失败，tenantId={}, accountNo={}, msg={}", tenantId, accountNo, failMsg);
throw new UserInvalidException(failMsg);
}
R<UserInfo> createdResult = userClient.userInfo(tenantId, accountNo);
if (!createdResult.isSuccess() || !hasUser(createdResult.getData())) {
log.warn("IAM统一身份认证自动创建用户后未查询到用户，tenantId={}, accountNo={}", tenantId, accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
}
if (!hasRoles(createdResult.getData())) {
log.warn("IAM统一身份认证自动创建用户后仍缺少可登录角色，tenantId={}, accountNo={}", tenantId, accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_HAS_NO_ROLE);
}
return createdResult.getData();
}
@@ -191,6 +205,14 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
return userInfo != null && userInfo.getUser() != null;
}
private boolean hasRoles(UserInfo userInfo) {
return userInfo != null && userInfo.getRoles() != null && !userInfo.getRoles().isEmpty();
}
private boolean hasLoginAccess(UserInfo userInfo) {
return hasUser(userInfo) && hasRoles(userInfo);
}
private User buildIamUser(IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
User user = new User();
user.setTenantId(tenantId);
@@ -199,7 +221,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
user.setPassword(UUID.randomUUID().toString());
user.setName(accountNo);
user.setRealName(accountNo);
user.setRoleId(StringPool.MINUS_ONE);
user.setRoleId(IAM_DEFAULT_ROLE_ID);
user.setDeptId(StringPool.MINUS_ONE);
user.setPostId(StringPool.MINUS_ONE);
user.setIsOa(1);
blade-auth/src/main/java/org/springblade/auth/handler/BladeAuthorizationHandler.java
+5 -1
View File
@@ -154,7 +154,11 @@ public class BladeAuthorizationHandler extends AbstractAuthorizationHandler {
*/
@Override
public void authFailure(OAuth2User user, OAuth2Request request, OAuth2Validation validation) {
// 自定义认证失败回调
log.error("用户：{}，认证失败，失败原因：{}，grantType={}，authorities={}",
user == null ? request.getUsername() : user.getAccount(),
validation.getMessage(),
request.getGrantType(),
user == null ? null : user.getAuthorities());
}
/**
blade-service/blade-system/src/main/java/org/springblade/system/service/IUserService.java
+1 -1
View File
@@ -281,7 +281,7 @@ public interface IUserService extends BaseService<User> {
boolean registerUser(User user);
/**
* 新建IAM统一身份认证用户（按可信租户落库）
* 新建或补齐IAM统一身份认证用户（按可信租户落库，默认分配角色 1123598816738675203）
*
* @param user 用户实体
* @return 是否成功
blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java
+36 -2
View File
@@ -96,6 +96,7 @@ public class UserServiceImpl extends BaseServiceImpl<UserMapper, User> implement
private static final String PASSWORD_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
private static final int RANDOM_PASSWORD_LENGTH = 8;
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
private static final Long IAM_DEFAULT_ROLE_ID = 1123598816738675203L;
private final IUserDeptService userDeptService;
private final UserDataScopeMapper userDataScopeMapper;
@@ -563,8 +564,27 @@ public class UserServiceImpl extends BaseServiceImpl<UserMapper, User> implement
if (user.getUserType() == null) {
user.setUserType(UserType.WEB.getCategory());
}
if (StringUtil.isBlank(user.getRoleId())) {
user.setRoleId(StringPool.MINUS_ONE);
String defaultRoleId = resolveIamDefaultRoleId();
User existingUser = userByAccount(user.getTenantId(), user.getAccount());
if (existingUser != null) {
boolean changed = false;
if (isMissingIamRole(existingUser.getRoleId())) {
existingUser.setRoleId(defaultRoleId);
changed = true;
}
if (existingUser.getIsOa() == null || existingUser.getIsOa() != 1) {
existingUser.setIsOa(1);
existingUser.setSyncTime(new Date());
changed = true;
}
if (!changed) {
return true;
}
CacheUtil.clear(USER_CACHE);
return this.updateById(existingUser);
}
if (isMissingIamRole(user.getRoleId())) {
user.setRoleId(defaultRoleId);
}
if (StringUtil.isBlank(user.getDeptId())) {
user.setDeptId(StringPool.MINUS_ONE);
@@ -579,6 +599,20 @@ public class UserServiceImpl extends BaseServiceImpl<UserMapper, User> implement
return saveUser(user);
}
private boolean isMissingIamRole(String roleId) {
return StringUtil.isBlank(roleId) || StringPool.MINUS_ONE.equals(roleId);
}
private String resolveIamDefaultRoleId() {
Role role = roleService.getOne(Wrappers.<Role>lambdaQuery()
.eq(Role::getId, IAM_DEFAULT_ROLE_ID)
.eq(Role::getIsDeleted, BladeConstant.DB_NOT_DELETED));
if (role == null || role.getId() == null) {
throw new ServiceException("IAM用户默认角色不存在，roleId=" + IAM_DEFAULT_ROLE_ID);
}
return String.valueOf(role.getId());
}
@Override
@Transactional(rollbackFor = Exception.class)
public boolean updatePlatform(Long userId, Integer userType, String userExt) {