b2894lxlx/tms-erp-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

调整 IAM

Browse Source
This commit is contained in:
b2894lxlx
2026-09-16 06:29:26 +08:00
parent 4d412e90ee
commit d1b4f286b2
9 changed files with 287 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blade-auth/src/main/java/org/springblade/auth/granter/IamSsoTokenGranter.java
+24 -5
View File
@@ -45,6 +45,7 @@ import org.springblade.core.redis.cache.BladeRedis;
import org.springblade.core.tool.api.R;
import org.springblade.core.tool.utils.StringUtil;
import org.springblade.core.tool.utils.StringPool;
import org.springblade.system.cache.DictCache;
import org.springblade.system.feign.IUserClient;
import org.springblade.system.pojo.entity.User;
import org.springblade.system.pojo.entity.UserInfo;
@@ -86,7 +87,9 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
private static final String IAM_TOKEN_URI = "/iam/sso/token";
private static final String BEARER_PREFIX = "Bearer ";
private static final String BASIC_PREFIX = "Basic ";
private static final String IAM_DEFAULT_ROLE_ID = "1123598816738675203";
private static final String IAM_DEFAULT_DICT_CODE = "iam_default";
private static final String IAM_DEFAULT_ROLE_NAME = "默认角色";
private static final String IAM_DEFAULT_DEPT_NAME = "默认部门";
private final OAuth2ClientService clientService;
private final IUserClient userClient;
@@ -155,6 +158,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
log.warn("IAM统一身份认证请求缺少租户ID，accountNo={}", accountNo);
throw new UserInvalidException(OAuth2TokenConstant.USER_NOT_FOUND);
}
log.info("IAM统一身份认证开始匹配本系统账号，tenantId={}, accountNo={}", tenantId, accountNo);
UserInfo userInfo = loadOrCreateIamUser(request, profileResponse, tenantId, accountNo);
OAuth2User user = TokenUtil.convertUser(userInfo, request);
if (user == null) {
@@ -174,7 +178,7 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
return result.getData();
}
if (result.isSuccess() && hasUser(result.getData())) {
log.info("IAM统一身份认证账号缺少可登录角色，开始补齐默认角色，tenantId={}, accountNo={}", tenantId, accountNo);
log.info("IAM统一身份认证账号缺少有效角色或部门，开始补齐默认配置，tenantId={}, accountNo={}", tenantId, accountNo);
} else {
log.info("IAM统一身份认证未匹配到本系统账号，开始自动创建用户，tenantId={}, accountNo={}, querySuccess={}",
tenantId, accountNo, result.isSuccess());
@@ -210,7 +214,14 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
}
private boolean hasLoginAccess(UserInfo userInfo) {
return hasUser(userInfo) && hasRoles(userInfo);
return hasUser(userInfo) && hasRoles(userInfo) && hasValidAssignment(userInfo.getUser());
}
private boolean hasValidAssignment(User user) {
return StringUtil.isNotBlank(user.getRoleId())
&& !StringPool.MINUS_ONE.equals(user.getRoleId())
&& StringUtil.isNotBlank(user.getDeptId())
&& !StringPool.MINUS_ONE.equals(user.getDeptId());
}
private User buildIamUser(IamSsoProfileResponse profileResponse, String tenantId, String accountNo) {
@@ -221,8 +232,8 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
user.setPassword(UUID.randomUUID().toString());
user.setName(accountNo);
user.setRealName(accountNo);
user.setRoleId(IAM_DEFAULT_ROLE_ID);
user.setDeptId(StringPool.MINUS_ONE);
user.setRoleId(resolveIamDefaultId(IAM_DEFAULT_ROLE_NAME));
user.setDeptId(resolveIamDefaultId(IAM_DEFAULT_DEPT_NAME));
user.setPostId(StringPool.MINUS_ONE);
user.setIsOa(1);
user.setSyncTime(new Date());
@@ -231,6 +242,14 @@ public class IamSsoTokenGranter extends AuthorizationCodeGranter {
return user;
}
private String resolveIamDefaultId(String dictValue) {
String dictKey = DictCache.getKey(IAM_DEFAULT_DICT_CODE, dictValue);
if (StringUtil.isBlank(dictKey) || StringPool.MINUS_ONE.equals(dictKey)) {
throw new UserInvalidException(StringUtil.format("IAM默认配置 [{}] 未配置有效键值", dictValue));
}
return dictKey;
}
public boolean supports(OAuth2Request request) {
return isIamRequest(request, false);
}
blade-auth/src/main/resources/application.yml
+1 -1
View File
@@ -100,5 +100,5 @@ iam:
system-client-id: ${IAM_SSO_SYSTEM_CLIENT_ID:saber3}
system-client-secret: ${IAM_SSO_SYSTEM_CLIENT_SECRET:saber3_secret}
redirect-uri: ${IAM_SSO_REDIRECT_URI:http://172.16.203.228:8000/callback}
authorization: ${IAM_SSO_AUTHORIZATION:Z3d6aF90bXMtOVJJU0RVN1U6YW0yYkcwWnBJZ0RQZmtrSjNaZkZjUDBSaGFuSEtxQng=}
authorization: ${IAM_SSO_AUTHORIZATION:YjNlZmU0ODEwMzJiNGJhZTpkYzQ5NDY1NmQ4MzE0NThjODI5MzlmNzA2ZjliNDY3MQ==}
profile-authorization: ${IAM_SSO_PROFILE_AUTHORIZATION:Z3d6aF90bXMtOVJJU0RVN1U6YW0yYkcwWnBJZ0RQZmtrSjNaZkZjUDBSaGFuSEtxQng=}