b2894lxlx/tms-erp-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

调整 IAM

Browse Source
This commit is contained in:
b2894lxlx
2026-09-16 08:50:24 +08:00
parent cbc7e16453
commit 8207afe04f
2 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
+17 -10
View File
@@ -85,7 +85,6 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
private static final String GRANT_TYPE = "iam_sso";
private static final String IAM_GRANT_TYPE = "authorization_code";
private static final String IAM_TOKEN_URI = "/iam/sso/token";
private static final String BEARER_PREFIX = "Bearer ";
private static final String BASIC_PREFIX = "Basic ";
private static final String IAM_DEFAULT_DICT_CODE = "iam_default";
private static final String IAM_DEFAULT_ROLE_NAME = "默认角色";
@@ -339,12 +338,16 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
private IamSsoProfileResponse requestIamProfile(String accessToken) {
try {
HttpRequest httpRequest = HttpRequest.newBuilder(URI.create(buildProfileUrl(accessToken)))
HttpRequest.Builder requestBuilder = HttpRequest.newBuilder(URI.create(buildProfileUrl(accessToken)))
.timeout(Duration.ofSeconds(10))
.header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE)
.header(HttpHeaders.AUTHORIZATION, profileAuthorizationHeader(accessToken))
.GET()
.build();
// 与 IAM 同步接口一致：Authorization 走网关凭证，Auth 走业务凭证。
.header(HttpHeaders.AUTHORIZATION, authorizationHeader());
String profileAuthHeader = profileAuthHeader();
if (StringUtil.isNotBlank(profileAuthHeader)) {
requestBuilder.header("Auth", profileAuthHeader);
}
HttpRequest httpRequest = requestBuilder.GET().build();
log.info("IAM统一身份认证获取用户信息请求，url={}, method={}", properties.getProfileUrl(), httpRequest.method());
HttpResponse<String> response = httpClient.send(
httpRequest,
@@ -352,7 +355,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
);
log.info("IAM统一身份认证获取用户信息响应，status={}", response.statusCode());
if (response.statusCode() < 200 || response.statusCode() >= 300) {
log.warn("IAM统一身份认证获取用户信息失败，status={}", response.statusCode());
log.warn("IAM统一身份认证获取用户信息失败，status={}, body={}", response.statusCode(), response.body());
throw new UserInvalidException(OAuth2TokenConstant.TOKEN_NOT_CORRECT);
}
return objectMapper.readValue(response.body(), IamSsoProfileResponse.class);
@@ -420,11 +423,15 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
return BASIC_PREFIX + authorization;
}
private String profileAuthorizationHeader(String accessToken) {
if (StringUtil.isNotBlank(properties.getProfileAuthorization())) {
return withBasicPrefix(properties.getProfileAuthorization());
/**
* IAM 业务侧 Auth 头。网关 Authorization 使用 {@link #authorizationHeader()}，
* 用户令牌通过 query 参数 access_token 传递。
*/
private String profileAuthHeader() {
if (StringUtil.isBlank(properties.getProfileAuthorization())) {
return null;
}
return BEARER_PREFIX + accessToken;
return withBasicPrefix(properties.getProfileAuthorization());
}
private String encode(String value) {
blade-auth/src/main/java/org/springblade/auth/props/IamSsoProperties.java
+2 -1
View File
@@ -78,7 +78,8 @@ public class IamSsoProperties {
private String authorization;
/**
* IAM用户信息认证头。为空时默认使用 Bearer accessToken
* IAM业务侧 Auth 请求头。为空时不传 Auth；
* Authorization 统一使用网关凭证 {@link #authorization}。
*/
private String profileAuthorization;