2024-12-25 16:28:18 +08:00
|
|
|
|
<!-- Space: qifu -->
|
|
|
|
|
|
<!-- Parent: 后端技术&知识&规范 -->
|
|
|
|
|
|
<!-- Parent: 技术方案 -->
|
|
|
|
|
|
<!-- Parent: 基建 -->
|
2025-02-10 09:21:02 +08:00
|
|
|
|
<!-- Parent: 02-技术方案 -->
|
2024-12-25 16:28:18 +08:00
|
|
|
|
<!-- Title: 20241224-元盟全域SSO方案 -->
|
|
|
|
|
|
|
|
|
|
|
|
<!-- Macro: :anchor\((.*)\):
|
|
|
|
|
|
Template: ac:anchor
|
|
|
|
|
|
Anchor: ${1} -->
|
|
|
|
|
|
<!-- Macro: \!\[.*\]\((.+)\)\<\!\-\- width=(.*) \-\-\>
|
|
|
|
|
|
Template: ac:image
|
|
|
|
|
|
Url: ${1}
|
|
|
|
|
|
Width: ${2} -->
|
|
|
|
|
|
<!-- Macro: \<\!\-\- :toc: \-\-\>
|
|
|
|
|
|
Template: ac:toc
|
|
|
|
|
|
Printable: 'false'
|
|
|
|
|
|
MinLevel: 2
|
|
|
|
|
|
MaxLevel: 4 -->
|
|
|
|
|
|
<!-- Include: 杂项/声明文件.md -->
|
|
|
|
|
|
|
|
|
|
|
|
<!-- :toc: -->
|
|
|
|
|
|
|
|
|
|
|
|
# 元盟全域SSO方案
|
|
|
|
|
|
|
|
|
|
|
|
## 一、现状
|
|
|
|
|
|
|
|
|
|
|
|
### 业务背景
|
|
|
|
|
|
|
|
|
|
|
|
为了统一账号登录，减少由于平台账号密码不同导致的割裂。
|
|
|
|
|
|
采用统一的SSO，使用企微进行登录，方便开发人员各平台使用，减少各个平台的割裂
|
|
|
|
|
|
|
|
|
|
|
|
## 二、需求
|
|
|
|
|
|
|
|
|
|
|
|
### 业务需求
|
|
|
|
|
|
|
|
|
|
|
|
需要统一的SSO方案来达到一个账户或者企微账户直接登录的效果
|
|
|
|
|
|
|
|
|
|
|
|
## 三、设计目标
|
|
|
|
|
|
|
|
|
|
|
|
### 实现的功能
|
|
|
|
|
|
|
|
|
|
|
|
- 通过企业微信登录各个平台
|
|
|
|
|
|
- 平台列表
|
|
|
|
|
|
- Gitlab
|
|
|
|
|
|
- Jenkins
|
|
|
|
|
|
- Confluence
|
|
|
|
|
|
- kubesphere
|
|
|
|
|
|
- kibana
|
|
|
|
|
|
- grafana
|
|
|
|
|
|
- Skywalking
|
|
|
|
|
|
- Nacos
|
|
|
|
|
|
- Graylog
|
|
|
|
|
|
- Yarning
|
|
|
|
|
|
- Harbor
|
|
|
|
|
|
- Nexus sonatype
|
|
|
|
|
|
- 产研协同平台
|
|
|
|
|
|
|
|
|
|
|
|
## 四、整体设计
|
|
|
|
|
|
|
|
|
|
|
|
### 整体架构
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### 交互流程
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## 五、详细设计
|
|
|
|
|
|
|
|
|
|
|
|
### 功能模块设计
|
|
|
|
|
|
|
|
|
|
|
|
- 产研协同平台
|
|
|
|
|
|
- 对接 keycloak 实现企微登录
|
|
|
|
|
|
- 方案一：
|
|
|
|
|
|
- 企赋网关对接 Keycloak
|
|
|
|
|
|
- 产研协同平台对接企赋网关
|
|
|
|
|
|
- 方案二：
|
|
|
|
|
|
- 产研协同平台直接对接 Keycloak
|
|
|
|
|
|
|
|
|
|
|
|
- Jenkins SSO（已验证）
|
|
|
|
|
|
- 安装插件 SAML：插件市场直接安装
|
|
|
|
|
|
- [整合Keycloak教程](https://github.com/jenkinsci/saml-plugin/blob/main/doc/CONFIGURE_KEYCLOAK.md)
|
|
|
|
|
|
- Gitlab SSO
|
|
|
|
|
|
- [SAML](https://docs.gitlab.com/ee/integration/saml.html)
|
|
|
|
|
|
- Confluence SSO
|
|
|
|
|
|
- [SAML](https://www.selinux.tech/architecture/cas/cas-gitlab)
|
|
|
|
|
|
- kubesphere SSO
|
|
|
|
|
|
- [OIDC](https://blog.csdn.net/zpf17671624050/article/details/144296801)
|
|
|
|
|
|
- kibana SSO
|
|
|
|
|
|
- [SAML](https://docs.authing.cn/v2/integration/)
|
|
|
|
|
|
- grafana SSO
|
|
|
|
|
|
- [配置](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/)
|
|
|
|
|
|
- [配置参考](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/)
|
|
|
|
|
|
- Skywalking SSO
|
|
|
|
|
|
- [CAS](https://blog.csdn.net/qq_42536474/article/details/108669351)
|
|
|
|
|
|
- Nacos SSO
|
|
|
|
|
|
- 暂时不支持，可以搞插件开发
|
|
|
|
|
|
- Graylog
|
|
|
|
|
|
- [需要plugin支持，并且不支持新版本](https://community.graylog.org/t/single-sign-on-authentication-plugin/22804)
|
|
|
|
|
|
- Yarning sso
|
|
|
|
|
|
- [OIDC](https://github.com/cookieY/Yearning/pull/608)
|
|
|
|
|
|
- Harbor
|
|
|
|
|
|
- [OIDC](https://docs.authing.cn/v2/integration/harbor/)
|
|
|
|
|
|
- Nexus sonatype SSO
|
|
|
|
|
|
- [Nexus sonatype](https://help.sonatype.com/en/user-authentication.html)
|
|
|
|
|
|
- [SAML](https://help.sonatype.com/en/saml.html)
|
|
|
|
|
|
|
|
|
|
|
|
### 潜在风险
|
|
|
|
|
|
|
|
|
|
|
|
## 六、工作量和排期
|
|
|
|
|
|
|
|
|
|
|
|
### 开发时间
|
|
|
|
|
|
|
|
|
|
|
|
### 联调时间
|
|
|
|
|
|
|
|
|
|
|
|
### 提测时间
|
|
|
|
|
|
|
|
|
|
|
|
### 上线时间
|
|
|
|
|
|
|
|
|
|
|
|
## 七、设计评审意见
|
|
|
|
|
|
|
|
|
|
|
|
## 八、参考文档
|
|
|
|
|
|
|
|
|
|
|
|
- [Okta](https://www.okta.com/)
|
|
|
|
|
|
- [CAS 单点登录部署](https://blog.csdn.net/xu_guo_jie/article/details/104209452)
|
|
|
|
|
|
- [集成文档参考](https://docs.authing.cn/v2/integration/?category=all&page=2)
|
|
|
|
|
|
- [CAS Server](https://github.com/apereo/cas)
|
|
|
|
|
|
- [CAS 整合 LDAP](https://www.doc88.com/p-0774845211878.html)
|
|
|
|
|
|
- [CAS](https://zhuanlan.zhihu.com/p/610470663)
|
|
|
|
|
|
- [OIDC](https://zhuanlan.zhihu.com/p/539297736)
|
|
|
|
|
|
- [LDAP](https://zhuanlan.zhihu.com/p/608437013)
|
|
|
|
|
|
- [IAM单点登录之CAS协议分析](https://zhuanlan.zhihu.com/p/627920220)
|
|
|
|
|
|
- [Keycloak](https://www.keycloak.org/)
|
2024-12-26 19:01:48 +08:00
|
|
|
|
- [Keycloak OIDC](https://www.keycloak.org/securing-apps/oidc-layers)
|
|
|
|
|
|
- [Keycloak 默认 Provider 配置](https://www.keycloak.org/docs/latest/server_admin/index.html#default_identity_provider)
|
|
|
|
|
|
- [Keycloak custom theme](https://springdoc.cn/spring-keycloak-custom-themes/)
|
|
|
|
|
|
- [Keycloak custom theme](https://blog.csdn.net/q1ngqingsky/article/details/123417611)
|
