From 8452f1f8f45104537e9d35569a23b0d6a6b56228 Mon Sep 17 00:00:00 2001
From: b2894lxlx <517289602@qq.com>
Date: Wed, 15 Jul 2026 22:40:30 +0800
Subject: [PATCH] =?UTF-8?q?IAM=E5=AF=B9=E6=8E=A5=E8=B0=83=E8=AF=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../auth/granter/IamSsoTokenGranter.java      | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java b/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
index d3c7b7c..b128525 100644
--- a/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
+++ b/blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
@@ -37,6 +37,7 @@ import org.springblade.core.oauth2.exception.UserInvalidException;
 import org.springblade.core.oauth2.granter.AuthorizationCodeGranter;
 import org.springblade.core.oauth2.handler.PasswordHandler;
 import org.springblade.core.oauth2.provider.OAuth2Request;
+import org.springblade.core.oauth2.service.OAuth2Client;
 import org.springblade.core.oauth2.service.OAuth2ClientService;
 import org.springblade.core.oauth2.service.OAuth2User;
 import org.springblade.core.oauth2.service.OAuth2UserService;
@@ -78,10 +79,12 @@ import java.util.stream.Collectors;
 @Order(Ordered.HIGHEST_PRECEDENCE)
 public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 
+	private static final String GRANT_TYPE = "iam_sso";
 	private static final String IAM_GRANT_TYPE = "authorization_code";
 	private static final String BEARER_PREFIX = "Bearer ";
 	private static final String BASIC_PREFIX = "Basic ";
 
+	private final OAuth2ClientService clientService;
 	private final IUserClient userClient;
 	private final IamSsoProperties properties;
 	private final ObjectMapper objectMapper;
@@ -95,16 +98,33 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
 							  IamSsoProperties properties,
 							  ObjectMapper objectMapper) {
 		super(clientService, userService, passwordHandler, bladeRedis);
+		this.clientService = clientService;
 		this.userClient = userClient;
 		this.properties = properties;
 		this.objectMapper = objectMapper;
 		this.httpClient = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10)).build();
 	}
 
+	@Override
+	public String type() {
+		return GRANT_TYPE;
+	}
+
+	@Override
+	public OAuth2Client client(OAuth2Request request) {
+		String clientId = request.getClientId();
+		String clientSecret = request.getClientSecret();
+		OAuth2Client client = clientService.loadByClientId(clientId);
+		if (!clientService.validateClient(client, clientId, clientSecret)) {
+			throw new UserInvalidException(OAuth2TokenConstant.TOKEN_NOT_CORRECT);
+		}
+		return client;
+	}
+
 	@Override
 	public OAuth2User user(OAuth2Request request) {
 		if (!isIamRequest(request)) {
-			return super.user(request);
+			throw new UserInvalidException(OAuth2TokenConstant.TOKEN_NOT_CORRECT);
 		}
 		validateRequest(request);
 		// 先校验本系统客户端，IAM的redirect_uri由后续远端接口校验。