调整 IAM

blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java

@@ -85,7 +85,6 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 	private static final String GRANT_TYPE = "iam_sso";
 	private static final String IAM_GRANT_TYPE = "authorization_code";
 	private static final String IAM_TOKEN_URI = "/iam/sso/token";
-	private static final String BEARER_PREFIX = "Bearer ";
 	private static final String BASIC_PREFIX = "Basic ";
 	private static final String IAM_DEFAULT_DICT_CODE = "iam_default";
 	private static final String IAM_DEFAULT_ROLE_NAME = "默认角色";
@@ -339,12 +338,16 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 
 	private IamSsoProfileResponse requestIamProfile(String accessToken) {
 		try {
-			HttpRequest httpRequest = HttpRequest.newBuilder(URI.create(buildProfileUrl(accessToken)))
+			HttpRequest.Builder requestBuilder = HttpRequest.newBuilder(URI.create(buildProfileUrl(accessToken)))
 				.timeout(Duration.ofSeconds(10))
 				.header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE)
-				.header(HttpHeaders.AUTHORIZATION, profileAuthorizationHeader(accessToken))
-				.GET()
-				.build();
+				// 与 IAM 同步接口一致：Authorization 走网关凭证，Auth 走业务凭证。
+				.header(HttpHeaders.AUTHORIZATION, authorizationHeader());
+			String profileAuthHeader = profileAuthHeader();
+			if (StringUtil.isNotBlank(profileAuthHeader)) {
+				requestBuilder.header("Auth", profileAuthHeader);
+			}
+			HttpRequest httpRequest = requestBuilder.GET().build();
 			log.info("IAM统一身份认证获取用户信息请求，url={}, method={}", properties.getProfileUrl(), httpRequest.method());
 			HttpResponse<String> response = httpClient.send(
 				httpRequest,
@@ -352,7 +355,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 			);
 			log.info("IAM统一身份认证获取用户信息响应，status={}", response.statusCode());
 			if (response.statusCode() < 200 || response.statusCode() >= 300) {
-				log.warn("IAM统一身份认证获取用户信息失败，status={}", response.statusCode());
+				log.warn("IAM统一身份认证获取用户信息失败，status={}, body={}", response.statusCode(), response.body());
 				throw new UserInvalidException(OAuth2TokenConstant.TOKEN_NOT_CORRECT);
 			}
 			return objectMapper.readValue(response.body(), IamSsoProfileResponse.class);
@@ -420,11 +423,15 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 		return BASIC_PREFIX + authorization;
 	}
 
-	private String profileAuthorizationHeader(String accessToken) {
-		if (StringUtil.isNotBlank(properties.getProfileAuthorization())) {
-			return withBasicPrefix(properties.getProfileAuthorization());
+	/**
+	 * IAM 业务侧 Auth 头。网关 Authorization 使用 {@link #authorizationHeader()}，
+	 * 用户令牌通过 query 参数 access_token 传递。
+	 */
+	private String profileAuthHeader() {
+		if (StringUtil.isBlank(properties.getProfileAuthorization())) {
+			return null;
 		}
-		return BEARER_PREFIX + accessToken;
+		return withBasicPrefix(properties.getProfileAuthorization());
 	}
 
 	private String encode(String value) {

blade-auth/src/main/java/org/springblade/auth/props/IamSsoProperties.java

@@ -78,7 +78,8 @@ public class IamSsoProperties {
 	private String authorization;
 
 	/**
-	 * IAM用户信息认证头。为空时默认使用 Bearer accessToken
+	 * IAM业务侧 Auth 请求头。为空时不传 Auth；
+	 * Authorization 统一使用网关凭证 {@link #authorization}。
 	 */
 	private String profileAuthorization;