b2894lxlx/tms-erp-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

调整 IAM

Browse Source
This commit is contained in:
b2894lxlx
2026-09-16 08:50:24 +08:00
parent cbc7e16453
commit 8207afe04f
2 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
+17 -10
View File
@@ -85,7 +85,6 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
private static final String GRANT_TYPE = "iam_sso"; private static final String GRANT_TYPE = "iam_sso";
private static final String IAM_GRANT_TYPE = "authorization_code"; private static final String IAM_GRANT_TYPE = "authorization_code";
private static final String IAM_TOKEN_URI = "/iam/sso/token"; private static final String IAM_TOKEN_URI = "/iam/sso/token";
private static final String BEARER_PREFIX = "Bearer ";
private static final String BASIC_PREFIX = "Basic "; private static final String BASIC_PREFIX = "Basic ";
private static final String IAM_DEFAULT_DICT_CODE = "iam_default"; private static final String IAM_DEFAULT_DICT_CODE = "iam_default";
private static final String IAM_DEFAULT_ROLE_NAME = "默认角色"; private static final String IAM_DEFAULT_ROLE_NAME = "默认角色";
@@ -339,12 +338,16 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
private IamSsoProfileResponse requestIamProfile(String accessToken) { private IamSsoProfileResponse requestIamProfile(String accessToken) {
try { try {
HttpRequest httpRequest = HttpRequest.newBuilder(URI.create(buildProfileUrl(accessToken))) HttpRequest.Builder requestBuilder = HttpRequest.newBuilder(URI.create(buildProfileUrl(accessToken)))
.timeout(Duration.ofSeconds(10)) .timeout(Duration.ofSeconds(10))
.header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE) .header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE)
.header(HttpHeaders.AUTHORIZATION, profileAuthorizationHeader(accessToken)) // 与 IAM 同步接口一致：Authorization 走网关凭证，Auth 走业务凭证。
.GET() .header(HttpHeaders.AUTHORIZATION, authorizationHeader());
.build(); String profileAuthHeader = profileAuthHeader();
if (StringUtil.isNotBlank(profileAuthHeader)) {
requestBuilder.header("Auth", profileAuthHeader);
}
HttpRequest httpRequest = requestBuilder.GET().build();
log.info("IAM统一身份认证获取用户信息请求，url={}, method={}", properties.getProfileUrl(), httpRequest.method()); log.info("IAM统一身份认证获取用户信息请求，url={}, method={}", properties.getProfileUrl(), httpRequest.method());
HttpResponse<String> response = httpClient.send( HttpResponse<String> response = httpClient.send(
httpRequest, httpRequest,
@@ -352,7 +355,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
); );
log.info("IAM统一身份认证获取用户信息响应，status={}", response.statusCode()); log.info("IAM统一身份认证获取用户信息响应，status={}", response.statusCode());
if (response.statusCode() < 200 || response.statusCode() >= 300) { if (response.statusCode() < 200 || response.statusCode() >= 300) {
log.warn("IAM统一身份认证获取用户信息失败，status={}", response.statusCode()); log.warn("IAM统一身份认证获取用户信息失败，status={}, body={}", response.statusCode(), response.body());
throw new UserInvalidException(OAuth2TokenConstant.TOKEN_NOT_CORRECT); throw new UserInvalidException(OAuth2TokenConstant.TOKEN_NOT_CORRECT);
} }
return objectMapper.readValue(response.body(), IamSsoProfileResponse.class); return objectMapper.readValue(response.body(), IamSsoProfileResponse.class);
@@ -420,11 +423,15 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
return BASIC_PREFIX + authorization; return BASIC_PREFIX + authorization;
} }
private String profileAuthorizationHeader(String accessToken) { /**
if (StringUtil.isNotBlank(properties.getProfileAuthorization())) { * IAM 业务侧 Auth 头。网关 Authorization 使用 {@link #authorizationHeader()}，
return withBasicPrefix(properties.getProfileAuthorization()); * 用户令牌通过 query 参数 access_token 传递。
*/
private String profileAuthHeader() {
if (StringUtil.isBlank(properties.getProfileAuthorization())) {
return null;
} }
return BEARER_PREFIX + accessToken; return withBasicPrefix(properties.getProfileAuthorization());
} }
private String encode(String value) { private String encode(String value) {
blade-auth/src/main/java/org/springblade/auth/props/IamSsoProperties.java
+2 -1
View File
@@ -78,7 +78,8 @@ public class IamSsoProperties {
private String authorization; private String authorization;
/** /**
* IAM用户信息认证头。为空时默认使用 Bearer accessToken * IAM业务侧 Auth 请求头。为空时不传 Auth；
* Authorization 统一使用网关凭证 {@link #authorization}。
*/ */
private String profileAuthorization; private String profileAuthorization;