feat(auth): support local username login mode
This commit is contained in:
mac
+6
-6
@@ -68,19 +68,18 @@ mysql -uroot -p < docs/mysql-init.sql
|
||||
|
||||
如果你使用的是 Docker Desktop、OrbStack、Colima 或容器里的 MySQL，应用访问 MySQL 时来源 IP 可能不是 `localhost`，而是类似 `192.168.65.1`。这时 MySQL 账号需要允许远程来源，`docs/mysql-init.sql` 已经包含 `'auth'@'%'`。
|
||||
|
||||
如果要自动创建本地管理员账号，在 `.env` 里设置：
|
||||
默认启用 SSO：
|
||||
|
||||
```bash
|
||||
BOOTSTRAP_ADMIN_USERNAME=admin
|
||||
BOOTSTRAP_ADMIN_PASSWORD='your-password'
|
||||
SSO_ENABLED=true
|
||||
```
|
||||
|
||||
也可以直接使用环境变量：
|
||||
如果只是本地开发测试，可以关闭 SSO，前端会显示用户名登录框。后端只校验用户名非空；用户不存在时会自动创建本地用户，第一位用户会自动成为管理员：
|
||||
|
||||
```bash
|
||||
MYSQL_DSN='auth:auth@tcp(127.0.0.1:3306)/authserver?charset=utf8mb4&parseTime=True&loc=Local' \
|
||||
JWT_SECRET='change-this-secret' \
|
||||
BOOTSTRAP_ADMIN_PASSWORD='your-password' \
|
||||
SSO_ENABLED=false \
|
||||
go run ./cmd/server
|
||||
```
|
||||
|
||||
@@ -151,7 +150,8 @@ bash scripts/restart-authserver.sh nginx
|
||||
|---|---|---|
|
||||
| `GET` | `/healthz` | 服务健康检查 |
|
||||
| `GET` | `/readyz` | 数据库连接检查 |
|
||||
| `POST` | `/api/v1/login` | 本地登录 |
|
||||
| `GET` | `/auth/api/v1/config` | 前端登录模式配置，返回 `sso_enabled` |
|
||||
| `POST` | `/auth/api/v1/login` | 本地开发测试登录，仅 `SSO_ENABLED=false` 时可用，只需用户名 |
|
||||
| `POST` | `/api/v1/login/ldap` | LDAP 登录预留 |
|
||||
| `GET` | `/api/v1/login/:provider` | SSO 跳转预留 |
|
||||
| `GET` | `/api/v1/login/:provider/callback` | SSO 回调预留 |
|
||||
|
||||
@@ -19,6 +19,7 @@ type Config struct {
|
||||
PublicBaseURL string
|
||||
MySQLDSN string
|
||||
AutoMigrate bool
|
||||
SSOEnabled bool
|
||||
JWTSecret string
|
||||
JWTIssuer string
|
||||
JWTTTLMinutes int
|
||||
@@ -68,6 +69,7 @@ func Load() Config {
|
||||
PublicBaseURL: publicBaseURL,
|
||||
MySQLDSN: env("MYSQL_DSN", "auth:auth@tcp(127.0.0.1:3306)/authserver?charset=utf8mb4&parseTime=True&loc=Local"),
|
||||
AutoMigrate: envBool("AUTO_MIGRATE", true),
|
||||
SSOEnabled: envBool("SSO_ENABLED", true),
|
||||
JWTSecret: env("JWT_SECRET", "change-this-secret"),
|
||||
JWTIssuer: env("JWT_ISSUER", "authserver"),
|
||||
JWTTTLMinutes: envInt("JWT_TTL_MINUTES", 120),
|
||||
|
||||
@@ -0,0 +1,78 @@
|
||||
package handler
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/1024XEngineer/xinfra/server/internal/config"
|
||||
"github.com/1024XEngineer/xinfra/server/internal/service"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
type AuthHandler struct {
|
||||
cfg config.Config
|
||||
auth *service.AuthService
|
||||
}
|
||||
|
||||
type localLoginRequest struct {
|
||||
Username string `json:"username"`
|
||||
}
|
||||
|
||||
func NewAuthHandler(cfg config.Config, authService *service.AuthService) *AuthHandler {
|
||||
return &AuthHandler{cfg: cfg, auth: authService}
|
||||
}
|
||||
|
||||
func (h *AuthHandler) Config(c *gin.Context) {
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"sso_enabled": h.cfg.SSOEnabled,
|
||||
})
|
||||
}
|
||||
|
||||
func (h *AuthHandler) LocalLogin(c *gin.Context) {
|
||||
if h.cfg.SSOEnabled {
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": "local login is disabled when sso is enabled"})
|
||||
return
|
||||
}
|
||||
|
||||
var req localLoginRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
result, err := h.auth.LocalLogin(strings.TrimSpace(req.Username), c.ClientIP(), c.Request.UserAgent())
|
||||
if err != nil {
|
||||
switch {
|
||||
case errors.Is(err, service.ErrInvalidCredential):
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||
case errors.Is(err, service.ErrUserDisabled):
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
|
||||
default:
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
http.SetCookie(c.Writer, &http.Cookie{
|
||||
Name: AuthSessionCookieName,
|
||||
Value: result.Token,
|
||||
Path: "/auth/",
|
||||
HttpOnly: true,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
MaxAge: int(time.Until(result.ExpiresAt).Seconds()),
|
||||
})
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"token": result.Token,
|
||||
"expires_in": int(h.cfg.JWTTTL().Seconds()),
|
||||
"user": gin.H{
|
||||
"id": result.User.ID,
|
||||
"username": result.User.Username,
|
||||
"display_name": result.User.DisplayName,
|
||||
"email": result.User.Email,
|
||||
"business_line": "",
|
||||
"is_admin": result.User.IsAdmin,
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -72,6 +72,7 @@ func registerAuthServerRoutes(r *gin.Engine, deps Dependencies) {
|
||||
wayneRoleBindingService := service.NewWayneRoleBindingService(deps.Config)
|
||||
|
||||
healthHandler := handler.NewHealthHandler(deps.DB)
|
||||
authHandler := handler.NewAuthHandler(deps.Config, authService)
|
||||
userHandler := handler.NewUserHandler()
|
||||
wayenHandler := handler.NewWayenHandler(deps.DB, wayenService, auditService)
|
||||
wayneRoleBindingHandler := handler.NewWayneRoleBindingHandler(wayneRoleBindingService, auditService)
|
||||
@@ -89,6 +90,8 @@ func registerAuthServerRoutes(r *gin.Engine, deps Dependencies) {
|
||||
|
||||
v1 := r.Group("/auth/api/v1")
|
||||
{
|
||||
v1.GET("/config", authHandler.Config)
|
||||
v1.POST("/login", authHandler.LocalLogin)
|
||||
v1.GET("/login/internal-sso", samlHandler.Login)
|
||||
v1.POST("/logout", samlHandler.Logout)
|
||||
v1.GET("/saml/metadata", samlHandler.Metadata)
|
||||
|
||||
@@ -39,6 +39,55 @@ func NewAuthService(cfg config.Config, db *gorm.DB, audit *AuditService) *AuthSe
|
||||
return &AuthService{cfg: cfg, db: db, audit: audit}
|
||||
}
|
||||
|
||||
func (s *AuthService) LocalLogin(username, clientIP, userAgent string) (*LoginResult, error) {
|
||||
username = strings.TrimSpace(username)
|
||||
if username == "" {
|
||||
return nil, ErrInvalidCredential
|
||||
}
|
||||
|
||||
var result *LoginResult
|
||||
err := s.db.Transaction(func(tx *gorm.DB) error {
|
||||
user, err := findOrCreateLocalUser(tx, username)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if user.Status != "active" {
|
||||
s.audit.Write(AuditEntry{ActorUserID: user.ID, ActorUsername: user.Username, ClientIP: clientIP, UserAgent: userAgent, Action: "local.login.failed", Decision: "deny", Reason: "user_disabled"})
|
||||
return ErrUserDisabled
|
||||
}
|
||||
|
||||
token, tokenID, expiresAt, err := auth.Sign(s.cfg.JWTSecret, s.cfg.JWTIssuer, s.cfg.JWTTTL(), user.ID, user.Username, user.Email, user.IsAdmin)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
now := time.Now()
|
||||
if err := tx.Model(&model.User{}).Where("id = ?", user.ID).Update("last_login_at", now).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tx.Create(&model.AccessToken{
|
||||
UserID: user.ID,
|
||||
TokenID: tokenID,
|
||||
TokenType: "access",
|
||||
ClientIP: clientIP,
|
||||
UserAgent: userAgent,
|
||||
ExpiresAt: expiresAt,
|
||||
}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
user.LastLoginAt = &now
|
||||
result = &LoginResult{Token: token, TokenID: tokenID, ExpiresAt: expiresAt, User: user}
|
||||
return nil
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
s.audit.Write(AuditEntry{ActorUserID: result.User.ID, ActorUsername: result.User.Username, ClientIP: clientIP, UserAgent: userAgent, Action: "local.login.success", Decision: "allow"})
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (s *AuthService) SAMLLogin(info *sso.SAMLDebugInfo, clientIP, userAgent string) (*LoginResult, error) {
|
||||
subject := strings.TrimSpace(info.NameID)
|
||||
email := firstSAMLAttribute(info.Attributes,
|
||||
@@ -119,6 +168,41 @@ func (s *AuthService) SAMLLogin(info *sso.SAMLDebugInfo, clientIP, userAgent str
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func findOrCreateLocalUser(tx *gorm.DB, username string) (model.User, error) {
|
||||
email := ""
|
||||
if looksLikeEmail(username) {
|
||||
email = username
|
||||
}
|
||||
|
||||
var user model.User
|
||||
query := tx.Where("username = ? AND deleted_at IS NULL", username)
|
||||
if email != "" {
|
||||
query = query.Or("email = ? AND deleted_at IS NULL", email)
|
||||
}
|
||||
if err := query.First(&user).Error; err == nil {
|
||||
return user, nil
|
||||
} else if !errors.Is(err, gorm.ErrRecordNotFound) {
|
||||
return model.User{}, err
|
||||
}
|
||||
|
||||
var count int64
|
||||
if err := tx.Model(&model.User{}).Where("deleted_at IS NULL").Count(&count).Error; err != nil {
|
||||
return model.User{}, err
|
||||
}
|
||||
user = model.User{
|
||||
Username: username,
|
||||
DisplayName: username,
|
||||
Email: email,
|
||||
Source: "local",
|
||||
Status: "active",
|
||||
IsAdmin: count == 0,
|
||||
}
|
||||
if err := tx.Create(&user).Error; err != nil {
|
||||
return user, err
|
||||
}
|
||||
return user, nil
|
||||
}
|
||||
|
||||
func findOrCreateSAMLUser(tx *gorm.DB, subject, email, displayName string) (model.User, error) {
|
||||
username := samlUsername(email, subject)
|
||||
if displayName == "" {
|
||||
|
||||
Reference in New Issue
Block a user