callbackLogic) {
+ this.callbackLogic = callbackLogic;
+ }
+
+ public Boolean getMultiProfile() {
+ return multiProfile;
+ }
+
+ public void setMultiProfile(final Boolean multiProfile) {
+ this.multiProfile = multiProfile;
+ }
+
+ public Boolean getSaveInSession() {
+ return saveInSession;
+ }
+
+ public void setSaveInSession(final Boolean saveInSession) {
+ this.saveInSession = saveInSession;
+ }
+
+ public Boolean getRenewSession() {
+ return renewSession;
+ }
+
+ public void setRenewSession(final Boolean renewSession) {
+ this.renewSession = renewSession;
+ }
+
+ public String getDefaultClient() {
+ return defaultClient;
+ }
+
+ public void setDefaultClient(final String client) {
+ this.defaultClient = client;
+ }
+
+ public Config getConfig() {
+ return config;
+ }
+
+ public void setConfig(final Config config) {
+ this.config = config;
+ }
+}
diff --git a/dinky-admin/src/main/java/org/dinky/sso/web/LogoutController.java b/dinky-admin/src/main/java/org/dinky/sso/web/LogoutController.java
new file mode 100644
index 0000000000..09f0aa0a17
--- /dev/null
+++ b/dinky-admin/src/main/java/org/dinky/sso/web/LogoutController.java
@@ -0,0 +1,66 @@
+package org.dinky.sso.web;
+
+import lombok.Data;
+import org.pac4j.core.config.Config;
+import org.pac4j.core.context.JEEContext;
+import org.pac4j.core.context.JEEContextFactory;
+import org.pac4j.core.context.session.JEESessionStore;
+import org.pac4j.core.context.session.SessionStore;
+import org.pac4j.core.engine.DefaultLogoutLogic;
+import org.pac4j.core.engine.LogoutLogic;
+import org.pac4j.core.http.adapter.HttpActionAdapter;
+import org.pac4j.core.http.adapter.JEEHttpActionAdapter;
+import org.pac4j.core.util.FindBest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * This controller handles the (application + identity provider) logout process.
+ *
+ * @author Jerome Leleu
+ * @since 1.0.0
+ */
+@Controller
+@Data
+public class LogoutController {
+
+ private LogoutLogic logoutLogic;
+
+ @Value("${sso.logout.defaultUrl:#{null}}")
+ private String defaultUrl;
+
+ @Value("${sso.logout.logoutUrlPattern:#{null}}")
+ private String logoutUrlPattern;
+
+ @Value("${sso.logout.localLogout:#{null}}")
+ private Boolean localLogout;
+
+ @Value("${sso.logout.destroySession:#{null}}")
+ private Boolean destroySession;
+
+ @Value("${sso.logout.centralLogout:#{null}}")
+ private Boolean centralLogout;
+
+ @Autowired
+ private Config config;
+
+ @RequestMapping("${sso.logout.path:/logout}")
+ public void logout(final HttpServletRequest request, final HttpServletResponse response) {
+
+ final SessionStore bestSessionStore = FindBest.sessionStore(null, config, JEESessionStore.INSTANCE);
+ final HttpActionAdapter bestAdapter = FindBest.httpActionAdapter(null, config, JEEHttpActionAdapter.INSTANCE);
+ final LogoutLogic bestLogic = FindBest.logoutLogic(logoutLogic, config, DefaultLogoutLogic.INSTANCE);
+
+ final JEEContext context = (JEEContext) FindBest.webContextFactory(null, config, JEEContextFactory.INSTANCE)
+ .newContext(request, response, bestSessionStore);
+ bestLogic.perform(context, config, bestAdapter, this.defaultUrl, this.logoutUrlPattern,
+ this.localLogout, this.destroySession, this.centralLogout);
+ }
+
+
+}
diff --git a/dinky-admin/src/main/java/org/dinky/sso/web/SecurityInterceptor.java b/dinky-admin/src/main/java/org/dinky/sso/web/SecurityInterceptor.java
new file mode 100644
index 0000000000..933c96d8ab
--- /dev/null
+++ b/dinky-admin/src/main/java/org/dinky/sso/web/SecurityInterceptor.java
@@ -0,0 +1,181 @@
+package org.dinky.sso.web;
+
+import org.pac4j.core.authorization.authorizer.Authorizer;
+import org.pac4j.core.config.Config;
+import org.pac4j.core.context.JEEContext;
+import org.pac4j.core.context.JEEContextFactory;
+import org.pac4j.core.context.session.JEESessionStore;
+import org.pac4j.core.context.session.SessionStore;
+import org.pac4j.core.engine.DefaultSecurityLogic;
+import org.pac4j.core.engine.SecurityLogic;
+import org.pac4j.core.http.adapter.HttpActionAdapter;
+import org.pac4j.core.http.adapter.JEEHttpActionAdapter;
+import org.pac4j.core.matching.matcher.Matcher;
+import org.pac4j.core.util.FindBest;
+import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.util.concurrent.atomic.AtomicInteger;
+
+/**
+ * This interceptor protects an url.
+ *
+ * @author Jerome Leleu
+ * @since 1.0.0
+ */
+public class SecurityInterceptor extends HandlerInterceptorAdapter {
+
+ private static final AtomicInteger internalNumber = new AtomicInteger(1);
+
+ private SecurityLogic securityLogic;
+
+ private String clients;
+
+ private String authorizers;
+
+ private String matchers;
+
+ private Boolean multiProfile;
+
+ private Config config;
+
+ private HttpActionAdapter httpActionAdapter;
+
+ public SecurityInterceptor(final Config config) {
+ this.config = config;
+ }
+
+ public SecurityInterceptor(final Config config, final String clients) {
+ this(config);
+ this.clients = clients;
+ }
+
+ public SecurityInterceptor(final Config config, final String clients, final HttpActionAdapter httpActionAdapter) {
+ this.clients = clients;
+ this.config = config;
+ this.httpActionAdapter = httpActionAdapter;
+ }
+
+ public SecurityInterceptor(final Config config, final String clients, final String authorizers) {
+ this(config, clients);
+ this.authorizers = authorizers;
+ }
+
+ public SecurityInterceptor(final Config config, final String clients, final Authorizer[] authorizers) {
+ this(config, clients);
+ this.authorizers = addAuthorizers(config, authorizers);
+ }
+
+ public SecurityInterceptor(final Config config, final String clients, final String authorizers, final String matchers) {
+ this(config, clients, authorizers);
+ this.matchers = matchers;
+ }
+
+ public SecurityInterceptor(final Config config, final String clients, final Authorizer[] authorizers, final Matcher[] matchers) {
+ this(config, clients, addAuthorizers(config, authorizers));
+ this.matchers = addMatchers(config, matchers);
+ }
+
+ private static String addAuthorizers(final Config config, final Authorizer[] authorizers) {
+ final int n = internalNumber.getAndAdd(1);
+ final int nbAuthorizers = authorizers.length;
+ final StringBuilder names = new StringBuilder("");
+ for (int i = 0; i < nbAuthorizers; i++) {
+ final String name = "$int_authorizer" + n + "." + i;
+ config.addAuthorizer(name, authorizers[i]);
+ if (i > 0) {
+ names.append(",");
+ }
+ names.append(name);
+ }
+ return names.toString();
+ }
+
+ private static String addMatchers(final Config config, final Matcher[] matchers) {
+ final int n = internalNumber.getAndAdd(1);
+ final int nbMatchers = matchers.length;
+ final StringBuilder names = new StringBuilder("");
+ for (int i = 0; i < nbMatchers; i++) {
+ final String name = "$int_matcher" + n + "." + i;
+ config.addMatcher(name, matchers[i]);
+ if (i > 0) {
+ names.append(",");
+ }
+ names.append(name);
+ }
+ return names.toString();
+ }
+
+ @Override
+ public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
+
+ final SessionStore bestSessionStore = FindBest.sessionStore(null, config, JEESessionStore.INSTANCE);
+ final HttpActionAdapter bestAdapter = FindBest.httpActionAdapter(httpActionAdapter, config, JEEHttpActionAdapter.INSTANCE);
+ final SecurityLogic bestLogic = FindBest.securityLogic(securityLogic, config, DefaultSecurityLogic.INSTANCE);
+
+ final JEEContext context = (JEEContext) FindBest.webContextFactory(null, config, JEEContextFactory.INSTANCE)
+ .newContext(request, response, bestSessionStore);
+ final Object result = bestLogic.perform(context, config, (ctx, profiles, parameters) -> true, bestAdapter, clients, authorizers, matchers, multiProfile);
+ if (result == null) {
+ return false;
+ }
+ return Boolean.parseBoolean(result.toString());
+ }
+
+ public SecurityLogic getSecurityLogic() {
+ return securityLogic;
+ }
+
+ public void setSecurityLogic(final SecurityLogic securityLogic) {
+ this.securityLogic = securityLogic;
+ }
+
+ public String getClients() {
+ return clients;
+ }
+
+ public void setClients(final String clients) {
+ this.clients = clients;
+ }
+
+ public String getAuthorizers() {
+ return authorizers;
+ }
+
+ public void setAuthorizers(final String authorizers) {
+ this.authorizers = authorizers;
+ }
+
+ public String getMatchers() {
+ return matchers;
+ }
+
+ public void setMatchers(final String matchers) {
+ this.matchers = matchers;
+ }
+
+ public Boolean getMultiProfile() {
+ return multiProfile;
+ }
+
+ public void setMultiProfile(final Boolean multiProfile) {
+ this.multiProfile = multiProfile;
+ }
+
+ public Config getConfig() {
+ return config;
+ }
+
+ public void setConfig(final Config config) {
+ this.config = config;
+ }
+
+ public HttpActionAdapter getHttpActionAdapter() {
+ return httpActionAdapter;
+ }
+
+ public void setHttpActionAdapter(final HttpActionAdapter httpActionAdapter) {
+ this.httpActionAdapter = httpActionAdapter;
+ }
+}
diff --git a/dinky-common/src/main/java/org/dinky/data/enums/Status.java b/dinky-common/src/main/java/org/dinky/data/enums/Status.java
index 8616a5c292..13cf94bc53 100644
--- a/dinky-common/src/main/java/org/dinky/data/enums/Status.java
+++ b/dinky-common/src/main/java/org/dinky/data/enums/Status.java
@@ -251,6 +251,11 @@ public enum Status {
DS_TASK_TYPE_NOT_SUPPORT(17008, "ds.task.type.not.support"),
DS_WORK_FLOW_DEFINITION_NOT_EXIST(17009, "ds.work.flow.definition.not.exist"),
DS_PROCESS_DEFINITION_UPDATE(17010, "ds.work.flow.definition.process.update"),
+ /**
+ * SSO About *
+ */
+ USER_TYPE_ERROR(22001, "sso.user.type.error"),
+ NOT_MATCHED_PRINCIPAL_NAME_ATTRIBUTE(22002,"sso.user.type.error" ),
/**
* LDAP About *
@@ -440,8 +445,8 @@ public enum Status {
PROCESS_SUBMIT_BUILDCONFIG(193, "process.submit.buildConfig"),
PROCESS_SUBMIT_EXECUTECOMMSQL(194, "process.submit.execute.commSql"),
PROCESS_SUBMIT_EXECUTEFLINKSQL(195, "process.submit.execute.flinkSql"),
- PROCESS_REGISTER_EXITS(196, "process.register.exits"),
- ;
+ PROCESS_REGISTER_EXITS(196, "process.register.exits");
+
private final int code;
private final String key;
diff --git a/dinky-common/src/main/java/org/dinky/data/enums/UserType.java b/dinky-common/src/main/java/org/dinky/data/enums/UserType.java
index 68241c259c..865aeae52b 100644
--- a/dinky-common/src/main/java/org/dinky/data/enums/UserType.java
+++ b/dinky-common/src/main/java/org/dinky/data/enums/UserType.java
@@ -21,7 +21,8 @@
public enum UserType {
LDAP(1, "LDAP"),
- LOCAL(0, "LOCAL");
+ LOCAL(0, "LOCAL"),
+ SSO(2, "LOCAL");
private final int code;
private final String type;
From ddc20d7142b5626d820052e15038790dc758285c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=A8=E6=B3=BD=E7=BF=B0?= <627617031@qq.com>
Date: Tue, 9 Apr 2024 16:28:01 +0800
Subject: [PATCH 02/21] Add sso support for github oauth
---
.../src/main/java/org/dinky/configure/AppConfig.java | 9 +++++++--
.../main/java/org/dinky/controller/SsoCpntroller.java | 7 +++++--
.../src/main/java/org/dinky/data/enums/Status.java | 1 +
3 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/dinky-admin/src/main/java/org/dinky/configure/AppConfig.java b/dinky-admin/src/main/java/org/dinky/configure/AppConfig.java
index 313a0e582a..1b018c4268 100644
--- a/dinky-admin/src/main/java/org/dinky/configure/AppConfig.java
+++ b/dinky-admin/src/main/java/org/dinky/configure/AppConfig.java
@@ -31,6 +31,7 @@
import org.pac4j.core.http.adapter.JEEHttpActionAdapter;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.LocaleResolver;
@@ -51,7 +52,9 @@
@Configuration
public class AppConfig implements WebMvcConfigurer {
@Autowired
- Config config;
+ private Config config;
+ @Value("${sso.enabled:false}")
+ private boolean ssoEnabled;
/**
* Cookie
*
@@ -94,7 +97,9 @@ public void addInterceptors(InterceptorRegistry registry) {
}))
.addPathPatterns("/api/**", "/openapi/**")
.excludePathPatterns("/api/login", "/api/ldap/ldapEnableStatus", "/download/**", "/druid/**");
- registry.addInterceptor(buildInterceptor("GitHubClient")).addPathPatterns("/sso/*");
+ if (ssoEnabled){
+ registry.addInterceptor(buildInterceptor("GitHubClient")).addPathPatterns("/sso/*");
+ }
registry.addInterceptor(new TenantInterceptor())
.addPathPatterns("/api/**")
.excludePathPatterns("/api/login", "/api/ldap/ldapEnableStatus")
diff --git a/dinky-admin/src/main/java/org/dinky/controller/SsoCpntroller.java b/dinky-admin/src/main/java/org/dinky/controller/SsoCpntroller.java
index 4a56db8497..d07a53a8f5 100644
--- a/dinky-admin/src/main/java/org/dinky/controller/SsoCpntroller.java
+++ b/dinky-admin/src/main/java/org/dinky/controller/SsoCpntroller.java
@@ -31,6 +31,8 @@
@NoArgsConstructor
@ConfigurationProperties(prefix = "pac4j")
public class SsoCpntroller {
+ @Value("${sso.enabled:false}")
+ private Boolean ssoEnabled;
@@ -65,8 +67,9 @@ protected void afterPropertiesSet() {
@GetMapping ("/sso/token")
public Result token() throws AuthException {
-
- System.out.println(config);
+ if (!ssoEnabled){
+ return Result.failed(Status.SINGLE_LOGIN_DISABLED);
+ }
List all = profileManager.getAll(true);
String username = all.get(0).getAttribute(principalNameAttribute).toString();
if (username == null){
diff --git a/dinky-common/src/main/java/org/dinky/data/enums/Status.java b/dinky-common/src/main/java/org/dinky/data/enums/Status.java
index 13cf94bc53..d3cbfa91a0 100644
--- a/dinky-common/src/main/java/org/dinky/data/enums/Status.java
+++ b/dinky-common/src/main/java/org/dinky/data/enums/Status.java
@@ -256,6 +256,7 @@ public enum Status {
*/
USER_TYPE_ERROR(22001, "sso.user.type.error"),
NOT_MATCHED_PRINCIPAL_NAME_ATTRIBUTE(22002,"sso.user.type.error" ),
+ SINGLE_LOGIN_DISABLED(22003, "sso.not.enabled"),
/**
* LDAP About *
From e5bbc742c0dda679a65a75c3112d3064bded4b74 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=A8=E6=B3=BD=E7=BF=B0?= <627617031@qq.com>
Date: Tue, 9 Apr 2024 16:36:35 +0800
Subject: [PATCH 03/21] Add sso support for github oauth
---
.../src/main/resources/application.yml | 27 +++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/dinky-admin/src/main/resources/application.yml b/dinky-admin/src/main/resources/application.yml
index 1d1488222a..d97c22e383 100644
--- a/dinky-admin/src/main/resources/application.yml
+++ b/dinky-admin/src/main/resources/application.yml
@@ -142,3 +142,30 @@ knife4j:
crypto:
enabled: false
encryption-password:
+
+#################################################################################################################
+################################################# SSO Config ####################################################
+#################################################################################################################
+#see https://github.com/pac4j/spring-webmvc-pac4j-boot-demo/blob/master/src/main/resources/application.properties
+sso:
+ enabled: false #enable sso
+ logout:
+ destroySession: true
+ defaultUrl: /?defaulturlafterlogout
+ centralLogout:
+ defaultUrl: http://localhost:8888/?defaulturlafterlogoutafteridp
+ logoutUrlPattern: http://localhost:8888/.*
+
+#################################################################################################################
+################################################# pac4j Config ####################################################
+#################################################################################################################
+pac4j:
+ callbackUrl: http://localhost:8888/callback # The callback URL
+ # Put all parameters under `properties`
+ # Check supported sso config parameters for different authentication clients from the below link
+ # https://github.com/pac4j/pac4j/blob/master/documentation/docs/config-module.md
+ properties:
+ principalNameAttribute: login #Authenticate user principal
+ github.id: #Authentication client id
+ github.secret: #Authentication client secret
+
From 2b842850e5e0c859fa22295e6467a20fa015d131 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=A8=E6=B3=BD=E7=BF=B0?= <627617031@qq.com>
Date: Tue, 9 Apr 2024 17:00:24 +0800
Subject: [PATCH 04/21] mvn -T 4C spotless:apply
---
dinky-admin/pom.xml | 4 +-
.../java/org/dinky/configure/AppConfig.java | 10 ++--
.../org/dinky/controller/SsoCpntroller.java | 48 +++++++++++++-----
.../java/org/dinky/data/dto/LoginDTO.java | 9 ++--
.../dinky/service/impl/UserServiceImpl.java | 5 +-
.../sso/annotation/AnnotationConfig.java | 21 +++++++-
.../dinky/sso/annotation/CommonAspect.java | 23 ++++++++-
.../sso/annotation/ui/RequireAllRoles.java | 19 +++++++
.../sso/annotation/ui/RequireAnyRole.java | 19 +++++++
.../sso/annotation/ui/UIAnnotationAspect.java | 22 +++++++-
.../sso/annotation/ws/RequireAllRoles.java | 19 +++++++
.../sso/annotation/ws/RequireAnyRole.java | 19 +++++++
.../sso/annotation/ws/WSAnnotationAspect.java | 22 +++++++-
.../dinky/sso/component/ComponentConfig.java | 25 ++++++++--
.../org/dinky/sso/web/CallbackController.java | 45 ++++++++++++++---
.../org/dinky/sso/web/LogoutController.java | 45 +++++++++++++----
.../dinky/sso/web/SecurityInterceptor.java | 50 +++++++++++++++----
.../src/main/resources/application-mysql.yml | 6 +--
.../src/main/resources/application.yml | 8 +--
.../java/org/dinky/data/enums/Status.java | 2 +-
20 files changed, 351 insertions(+), 70 deletions(-)
diff --git a/dinky-admin/pom.xml b/dinky-admin/pom.xml
index 3826d9a64d..d507a0d6bb 100644
--- a/dinky-admin/pom.xml
+++ b/dinky-admin/pom.xml
@@ -32,9 +32,9 @@
provided
- 42.5.1
4.2.0
+ 42.5.1
@@ -61,8 +61,6 @@