From 5038f63dc3db446e1c5733ed836a7675a4e349ad Mon Sep 17 00:00:00 2001
From: b2894lxlx <517289602@qq.com>
Date: Wed, 15 Jul 2026 16:35:17 +0800
Subject: [PATCH] =?UTF-8?q?IAM=E5=AF=B9=E6=8E=A5=E8=B0=83=E8=AF=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../auth/granter/IamSsoTokenGranter.java      | 26 +++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java b/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
index 52a24aa..0759468 100644
--- a/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
+++ b/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
@@ -152,13 +152,16 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 
 	private IamSsoTokenResponse requestIamToken(OAuth2Request request) {
 		try {
+			Map<String, String> tokenParams = buildTokenParams(request);
+			String tokenBody = buildTokenBody(tokenParams);
 			HttpRequest httpRequest = HttpRequest.newBuilder(URI.create(properties.getTokenUrl()))
 				.timeout(Duration.ofSeconds(10))
 				.header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE)
 				.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED_VALUE)
 				.header(HttpHeaders.AUTHORIZATION, authorizationHeader())
-				.POST(HttpRequest.BodyPublishers.ofString(buildTokenBody(request), StandardCharsets.UTF_8))
+				.POST(HttpRequest.BodyPublishers.ofString(tokenBody, StandardCharsets.UTF_8))
 				.build();
+			log.info("IAM统一身份认证换取Token请求，method={}, headers={}, body={}", httpRequest.method(), maskHeaders(httpRequest.headers().map()), buildMaskTokenBody(tokenParams));
 			HttpResponse<String> response = httpClient.send(
 				httpRequest,
 				HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8)
@@ -185,10 +188,12 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 				.header(HttpHeaders.AUTHORIZATION, profileAuthorizationHeader(accessToken))
 				.GET()
 				.build();
+			log.info("IAM统一身份认证获取用户信息请求，headers={}, body={}", maskHeaders(httpRequest.headers().map()), "无");
 			HttpResponse<String> response = httpClient.send(
 				httpRequest,
 				HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8)
 			);
+			log.info("IAM统一身份认证获取用户信息响应，headers={}, body={}", response.headers().map(), response.body());
 			if (response.statusCode() < 200 || response.statusCode() >= 300) {
 				log.warn("IAM统一身份认证获取用户信息失败，status={}", response.statusCode());
 				throw new UserInvalidException(OAuth2TokenConstant.TOKEN_NOT_CORRECT);
@@ -203,18 +208,29 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 		}
 	}
 
-	private String buildTokenBody(OAuth2Request request) {
+	private Map<String, String> buildTokenParams(OAuth2Request request) {
 		Map<String, String> params = new LinkedHashMap<>();
 		params.put("grant_type", IAM_GRANT_TYPE);
 		params.put("client_id", properties.getClientId());
 		params.put("client_secret", properties.getClientSecret());
 		params.put("code", request.getCode());
 		params.put("redirect_uri", properties.getRedirectUri());
+		return params;
+	}
+
+	private String buildTokenBody(Map<String, String> params) {
 		return params.entrySet().stream()
 			.map(entry -> encode(entry.getKey()) + "=" + encode(entry.getValue()))
 			.collect(Collectors.joining("&"));
 	}
 
+	private String buildMaskTokenBody(Map<String, String> params) {
+		Map<String, String> maskParams = new LinkedHashMap<>(params);
+		maskParams.put("client_secret", "******");
+		maskParams.put("code", "******");
+		return buildTokenBody(maskParams);
+	}
+
 	private String buildProfileUrl(String accessToken) {
 		String separator = properties.getProfileUrl().contains("?") ? "&" : "?";
 		return properties.getProfileUrl() + separator + "access_token=" + encode(accessToken);
@@ -237,6 +253,12 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 		return BEARER_PREFIX + accessToken;
 	}
 
+	private Map<String, java.util.List<String>> maskHeaders(Map<String, java.util.List<String>> headers) {
+		Map<String, java.util.List<String>> maskHeaders = new LinkedHashMap<>(headers);
+		maskHeaders.replaceAll((key, value) -> HttpHeaders.AUTHORIZATION.equalsIgnoreCase(key) ? java.util.List.of("******") : value);
+		return maskHeaders;
+	}
+
 	private String encode(String value) {
 		return URLEncoder.encode(value, StandardCharsets.UTF_8);
 	}