1
2
3
4
5
6
7
8
9

# oa单点登录配置
oa_login_grantType=authorization_code
oa_login_clientId=APPNAME_S4933
oa_login_clientSecret=a25a1e314677449883ea3c9dadacfc4
oa_login_host=https://ssosit.kitebin.top
oa_login_accessTokenUrl=:8083/bam-protocol-service/oauth2/getToken?client_id={clientId}&grant_type=authorization_code&code={code}&client_secret={clientSecret}
oa_login_oaUserLoginUrl=:8083/bam-protocol-service/oauth2/getUserInfo?access_token={accessToken}&client_id={clientId}
oa_login_oaAuthLoginUrl=/idp/authCenter/authenticate?response_type=code&state=1&client_id={clientId}&redirect_uri=
oa_login_redirectUrl=https://第三方应用域名/iam-redirect-proxy?url=

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

oa:
  login:
    grantType: ${oa_login_grantType}
    clientId: ${oa_login_clientId}
    clientSecret: ${oa_login_clientSecret}
    host: ${oa_login_host}
    accessTokenUrl: ${oa_login_accessTokenUrl}
    oaUserLoginUrl: ${oa_login_oaUserLoginUrl}
    oaAuthLoginUrl: ${oa_login_oaAuthLoginUrl}
    redirectUrl: ${oa_login_redirectUrl}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

@Data
@Component
@ConfigurationProperties(prefix = "oa.login")
public class OaLoginProperties {
	
	private String grantType;
	
	private String clientId;
	
	private String clientSecret;
	
	private String host;
	
	private String accessTokenUrl;
	
	private String oaUserLoginUrl;
	
	private String oaAuthLoginUrl;
	
	private String redirectUrl;
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

@RestController
public class LoginController {

	@Resource
	private LoginService loginService;
	
	@Resource
	private OaLoginProperties oaLoginProperties;
	
	@RequestMapping(value = "/login", method = RequestMethod.POST)
	public BaseResponse<UserPo> login(@RequestBody UserPo userPo, HttpServletRequest request) {
		Subject subject = SecurityUtils.getSubject();
		if (!subject.isAuthenticated()) {
			String password = userPo.getPassword();
			String header = request.getHeader("md5");
			if (header == null) {
				password = new SimpleHash(ShiroConfig.hashAlgorithm, password, ShiroConfig.credentialSalt, ShiroConfig.hashIterations).toString();
			}
			UsernamePasswordToken token = new UsernamePasswordToken(userPo.getUsername(), password);
			try {
				subject.login(token);
			} catch (UnknownAccountException e) {
				return BaseResponse.buildFailedResponse("用户名不正确");
			} catch (IncorrectCredentialsException ice) {
				return BaseResponse.buildFailedResponse("用户名或密码错误");
			} catch (LockedAccountException lae) {
				return BaseResponse.buildFailedResponse("该用户被禁用");
			} catch (LicenseExpirateException e) {
				return BaseResponse.buildFailedResponse("因授权过期系统已被锁定，请联系IT人员处理");
			} catch (AuthenticationException ae) {
				return BaseResponse.buildFailedResponse("登录失败");
			}
		}
		UserPo userInfo = (UserPo) Identity.getLoginIdentity();
		return BaseResponse.buildSuccessfulResponse(userInfo);
	}
	

	/**
	* 拼接 url，请求认证及授权
	*/
	@RequestMapping(value = "/login/iam-url", method = RequestMethod.GET)
	public BaseResponse<String> getIamUrl(@RequestParam String uri) {
		if (!StringUtils.hasLength(uri)) {
			return BaseResponse.buildFailedResponse("请求参数uri为空");
		}
		StringBuilder oaLoginUrl = new StringBuilder(256);
		String redirectUrl = new String();
		try {
			redirectUrl = oaLoginProperties.getRedirectUrl() + URLEncoder.encode(uri, StandardCharsets.UTF_8.name());
		} catch (UnsupportedEncodingException e) {
			throw new RuntimeException("URL编码失败", e);
		}
		String oaAuthLoginUrl = oaLoginProperties.getOaAuthLoginUrl().replace("{clientId}", oaLoginProperties.getClientId());
		oaLoginUrl.append(oaLoginProperties.getHost())
				  .append(oaAuthLoginUrl)
				  .append(redirectUrl);
		return BaseResponse.buildSuccessfulResponse(oaLoginUrl.toString());
	}
	
	/**
	* 根据授权码code，获取 access_token 并以此获取用户信息，登录系统返回用户信息
	*/
	@RequestMapping(value = "/login/iam-login", method = RequestMapping.POST)
	public BaseResponse<UserPo> iamLogin(@RequestBody String code, HttpServletReqeust request) {
		JSONObject josnObject = JSONObject.parseObject(code);
		String codeStr = jsonObject.getString("code");
		if (!StringUtils.hasLength()) {
			return BaseResponse.buildFailedResponse("请求参数code为空");
		}
		String accessTokenUrl = oaLoginProperties.getAccessTokenUrl().replace("{clientId}", oaLoginProperties.getClientId())
				.replace("{clientSecret}", oaLoginProperties.getClientSecret())
				.replace("{code}", codeStr);
		String oaUserLoginUrl = oaLoginProperties.getOaUserLoginUrl()
				.replace("{clientId}", oaLoginProperties.getClientId());
		// 1. iam 认证登录返回用户工号
		OaLoginDTO result = loginService.oaLogin(oaLoginProperties.getHost() + accessTokenUrl, oaLoginProperties.getHost() + oaUserLoginUrl);
		String userNo = result.getData();
		// 接口调用异常处理
		if (!StringUtils.hasLength(userNo)) {
			return BaseResponse.buildFailedResponse("【" + result.getErrCode() + "】" + result.getMessage() + "; " + result.getApiName() + "错误，请联系管理员处理。");
		}
		
		// 2. 通过工号去用户表查询用户是否存在，存在则登录，不存在返回提示
		User user = User.findByUserNo(userNo);
		if (Objects.isNull(user.getUserPo()) || user.getUserPo().getUserNo() == null) {
			return BaseResponse.buildFailedResponse("用户不存在");
		}
		UserPo userPo = user.getUserPo();
		
		// 3. 第三方系统登录
		Subject subject = SecurityUtils.getSubject();
		if (!subject.isAuthenticated()) {
			String password = userPo.getPassword(); // 注意：密码从数据库查询已经经过 md5 处理，不用再次使用 md5 哈希计算
			UsernamePasswordToken token = new UsernamePasswordToken(userPo.getUsername(), password);
			try {
				subject.login(token);
			} catch (UnknownAccountException e) {
				return BaseResponse.buildFailedResponse("用户名不正确");
			} catch (IncorrectCredentialsException ice) {
				return BaseResponse.buildFailedResponse("用户名或密码错误");
			} catch (LockedAccountException lae) {
				return BaseResponse.buildFailedResponse("该用户被禁用");
			} catch (LicenseExpirateException e) {
				return BaseResponse.buildFailedResponse("因授权过期系统已被锁定，请联系IT人员处理");
			} catch (AuthenticationException ae) {
				return BaseResponse.buildFailedResponse("登录失败");
			}
		}
		UserPo userInfo = (UserPo) Identity.getLoginIdentity();
		return BaseResponse.buildSuccessfulResponse(userInfo);
		
	
	}
	
	/**
	* 登出接口
	*/
	@RequestMapping(value = "/logout", method = RequestMehtod.GET)
	public BaseResponse logout() {
		boolean ret = loginService.logout();
		if (ret) {
			return BaseResponse.buildSuccessfulResponse(null);
		}
		return BaseResponse.buildFailedResponse("登出失败");
	}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

public interface LoginService {
	
	/**
	* IAM 登录获取用户信息
	* @param accessTokenUrl
	* @param oaUserLoginUrl
	*/
	OaLoginDTO oaLogin(String accessTokenUrl, String oaUserLoginUrl);
	
	/**
	* 用户登出
	*/
	boolean logout();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

@Service
@Slf4j
public class LoginServiceImpl implements LoginService {

	@Override
	public boolean logout() {
		try {
			SecurityUtils.getSubject().logout();
		} catch (Exception e) {
			return false;
		}
		return true;
	}
	
	@Override
	public OaLoginDTO oaLogin(String accessTokenUrl, String oaUserLoginUrl) {
	
		log.info("accessTokenUrl : {}", accessTokenUrl);
		log.info("oaUserLoginUrl : {}", oaUserLoginUrl);
		// 1. 调用 iam access_token认证查询，返回 access_token
		Map<String, String> httpHeaderMap = new HashMap();
		httpHeaderMap.put("Accept", "application/json");
		String res = HttpUtil.doPost(accessTokenUrl, httpHeaderMap, "");
		log.info("iam access-token认证查询响应内容: {}", res);
		
		JSONObject resObj = JSONObject.parseObject(res);
		String accessToken = new String();
		accessToken = resObj.getString("access_token");
		// 处理错误响应
		if (!StringUtils.hasLength(accessToken)) {
			String errCode = new String();
			String message = new String();
			if (resObj.getString("code") != null) {
				errCode = resObj.getString("code");
				message = resObj.getString("message");
			} else {
				errCode = resObj.getString("errcode");
				message = resObj.getString("msg");
			}
			return OaLoginDTO.builder()
						.errCode(errCode)
						.message(message)
						.apiName("获取access_token接口")
						.build();
		}
		// 2. 获取用户信息查询，查询工号
		oaUserLoginUrl = oaUserLoginUrl.replace("{accessToken}", accessToken);
		res = HttpUtil.doGet(oaUserLoginUrl, httpHeaderMap, null);
		log.info("获取用户信息查询响应内容: {}", res);
		resObj = JSONObject.parseObject(res);
		String loginName = resObj.getString("loginName");
		if (!StringUtils.hasLength()) {
			String errCode = new String();
			String message = new String();
			if (resObj.getString("code") != null) {
				errCode = resObj.getString("code");
				message = resObj.getString("message");
			} else {
				errCode = resObj.getString("errcode");
				message = resObj.getString("msg");
			}
			return OaLoginDTO.builder()
						.errCode(errCode)
						.message(message)
						.apiName("获取用户信息接口")
						.build();
		}
		// 返回 loginName 即为工号，具体参考接口文档
		return OaLoginDTO.builder()
				.data(loginName)
				.build();
	}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

@Data
@Builder
public class OaLoginDTO {
	
	private String data;
	
	private String apiName;
	
	private String message;
	
	private String errCode;
}