统一身份认证
前端的工作很简单:
js
bootstrapLogin() {
const idpKey = this.$route.query && this.$route.query.idp_key;
const forceLocal = this.$route.query && (this.$route.query.local === '1' || this.$route.query.local === 'true');
// 1 带回 idp_key → 换 Token 登录
if (idpKey) {
this.loading = true;
this.$store.dispatch("IdpLogin", idpKey).then(() => {
this.$router.replace({ path: this.redirect || "/" }).catch(() => {});
}).catch(() => {
this.loading = false;
this.$message.error("统一身份登录失败，请重试或使用本地账号登录");
this.$router.replace({ path: "/login", query: { local: "1" } }).catch(() => {});
this.showLocalLogin();
});
return;
}
// 2 强制本地登录
if (forceLocal) {
this.showLocalLogin();
return;
}
// 3 无 idp_key：若开启 SSO 则跳统一身份
getIdpConfig().then(res => {
const data = res.data || res;
if (data && data.authEnabled) {
const loginUrl = data.loginUrl || "/idp/login";
// 整页跳转到后端，由 AccessEnforcer 拉起统一身份
window.location.href = process.env.VUE_APP_BASE_API + loginUrl;
} else {
this.showLocalLogin();
}
}).catch(() => {
this.showLocalLogin();
});
}后端的工作
- 请求统一身份认证中心
踩坑
1. 「分离式外置配置 + 外置 lib 依赖包」的 SpringBoot 打包 pom 配置
报错: unable write .............ruoyi-admin!
原因: 认证中心会往服务器的文件下写两个xml文件，如果打成一整个jar包，那么会导致认证中心写不进去。
<build>
<finalName>${project.artifactId}</finalName>
<resources>
<resource>
<directory>src/main/resources</directory>
</resource>
<resource>
<directory>src/main/java</directory>
<includes>
<include>**/*.xml</include>
</includes>
<excludes>
<exclude>**/*.java</exclude>
</excludes>
</resource>
</resources>
<defaultGoal>install</defaultGoal>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<configuration>
<includeSystemScope>true</includeSystemScope>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<configuration>
<!--这些配置将写入到MANIFEST.MF文件中-->
<archive>
<!--指定程序入口-->
<manifest>
<addClasspath>true</addClasspath>
<classpathPrefix>lib/</classpathPrefix>
<mainClass>com.ruoyi.RuoYiApplication</mainClass>
</manifest>
<!-- (配置文件外置目录) -->
<manifestEntries>
<Class-Path>conf/</Class-Path>
</manifestEntries>
</archive>
<excludes>
<exclude>**/*.yml</exclude>
<exclude>**/*.xml</exclude>
<exclude>**/*.properties</exclude>
</excludes>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<executions>
<execution>
<id>copy-lib</id>
<phase>prepare-package</phase>
<goals>
<goal>copy-dependencies</goal>
</goals>
<configuration>
<outputDirectory>${project.build.directory}/lib</outputDirectory>
<overWriteReleases>false</overWriteReleases>
<overWriteSnapshots>false</overWriteSnapshots>
<overWriteIfNewer>true</overWriteIfNewer>
<includeScope>runtime</includeScope>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-resources-plugin</artifactId>
<executions>
<execution>
<id>copy-config</id>
<phase>package</phase>
<goals>
<goal>copy-resources</goal>
</goals>
<configuration>
<outputDirectory>${project.build.directory}/conf</outputDirectory>
<resources>
<resource>
<directory>src/main/resources</directory>
<includes>
<include>**/*.xml</include>
<include>**/*.yml</include>
<include>**/*.properties</include>
</includes>
<filtering>true</filtering>
</resource>
</resources>
<encoding>UTF-8</encoding>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>2. 配置文件添加id-config：
xml
idp-config:
authEnabled: true
authRedisEnabled: true
mqEnabled: false
#在Java中使用response.sendRedirect时，总是默认使用部署的http协议，负载均衡使用的https协议，只能通过配置取主机头
entityId: https://10.213.119.242/sysmanager
frontendUrl: http://localhost:8800
jwt-auth:
host: jwt.siam.sinopec.com
singleFactorAuthurl: https://jwt2.uat.siam.sinopec.com/jwt2/jwtauth
twoFactorAuthurl: https://jwt2.uat.siam.sinopec.com/jwtauth_userpwdotp
authorization: Bearer
content-type: application/x-www-form-urlencoded; charset=UTF-8
#应用程序ID
appId: 7624
#应用连接账号ID
account-name: sinopec_jwt_7624
#应用密码
account-pwd: sinopec_jwt_7624