texousliu/keyfil
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

✨ [2024-12-25] 添加SSO方案
All checks were successful
Publish to Confluence / confluence (push) Successful in 59s
Details

Browse Source
This commit is contained in:
liuxiaohua 2024-12-25 16:28:18 +08:00
parent a6456aae0d
commit 62fb4fb208
6 changed files with 1559 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
任务/今日任务.md
View File

@ -13,10 +13,28 @@
- [X] github ci/cd 文档发布
## 20241219 - 20241227
- [Okta](https://www.okta.com/)
- [CAS 单点登录部署](https://blog.csdn.net/xu_guo_jie/article/details/104209452)
- [集成文档参考](https://docs.authing.cn/v2/integration/?category=all&page=2)
- [ ] Soular 平台部署
- [X] Soular 平台部署
- [X] 调研SSO（查看能效平台调研）
- [X] 开源知识库
- [BookStack](https://gitee.com/dromara/zyplayer-doc)
- 支持代码高亮
- 支持图标插件
-
- Affine
- [zyplayer-doc](https://gitee.com/dromara/zyplayer-doc)
- [ ] 开源支持SSO的管理后台
- [ ] 开源 IAM
- [keycloak](https://blog.csdn.net/qq_31532979/article/details/140794828)
- [Keycloak Doc](https://keycloak.java.net.cn/guides)
- [X] Keycloak 集成 LDAP
- [X] jenkins 整合 Keycloak 实现 SSO
- [ ] 企业微信登录集成（产研平台）
- [ ] SSO 技术方案编写
- [ ] Gitlab webhook merge 集成企业微信推送
- [ ] Keycloak 集成企微登录可能性调研
- [使用企业微信登录Keycloak](https://www.kkzxak47.com/2019/07/30/%E4%BD%BF%E7%94%A8%E4%BC%81%E4%B8%9A%E5%BE%AE%E4%BF%A1%E7%99%BB%E5%BD%95keycloak/)
- [Keycloak开发](https://wener.me/notes/service/auth/keycloak/dev)
## 20241216 - 20241220
- [X] Track123 对接

15
任务/周报.md Normal file
View File

@ -0,0 +1,15 @@
## 20241216-20241220
- [X] 能效平台调研
- [调研报告](http://confluence.qifu.com/pages/viewpage.action?pageId=38507017)
- [X] 能效平台门户搭建
- http://10.168.2.234:9999/
- admin/Admin123456
- [X] Confluence 知识库支持绘图
- ![](https://picture.texous.cn/blog/20241220100602538.png)
- [X] 现有工具库 SSO 支持调研
- http://confluence.qifu.com/pages/viewpage.action?pageId=38507017
- [X] tiklab 本地搭建及演示
- [Tiklab](https://github.com/tiklab-project)
- [X] Keycloak 集成 LDAP（验证完成）
- [X] jenkins 整合 Keycloak 实现 SSO（验证完成）

48
方案/20241220-效能平台单点登录整合.md Normal file
View File

@ -0,0 +1,48 @@
# 效能平台调研
## SSO 支撑调研
### 一些参考
- [Okta](https://www.okta.com/)
- [CAS 单点登录部署](https://blog.csdn.net/xu_guo_jie/article/details/104209452)
- [集成文档参考](https://docs.authing.cn/v2/integration/?category=all&page=2)
- [CAS Server](https://github.com/apereo/cas)
- [CAS 整合 LDAP](https://www.doc88.com/p-0774845211878.html)
- [CAS](https://zhuanlan.zhihu.com/p/610470663)
- [OIDC](https://zhuanlan.zhihu.com/p/539297736)
- [LDAP](https://zhuanlan.zhihu.com/p/608437013)
- [IAM单点登录之CAS协议分析](https://zhuanlan.zhihu.com/p/627920220)
- [Keycloak](https://www.keycloak.org/)
### 平台调研
- [X] 已有平台 SSO 调研
- Gitlab SSO
- [SAML](https://docs.gitlab.com/ee/integration/saml.html)
- Jenkins SSO
- 安装插件 SAML
- [整合Keycloak教程](https://github.com/jenkinsci/saml-plugin/blob/main/doc/CONFIGURE_KEYCLOAK.md)
- Confluence SSO
- [SAML](https://www.selinux.tech/architecture/cas/cas-gitlab)
- kubesphere SSO
- [OIDC](https://blog.csdn.net/zpf17671624050/article/details/144296801)
- kibana SSO
- [SAML](https://docs.authing.cn/v2/integration/)
- grafana SSO
- [配置](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/)
- [配置参考](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/)
- Skywalking SSO
- [CAS](https://blog.csdn.net/qq_42536474/article/details/108669351)\
- Nacos SSO
- 暂时不支持，可以搞插件开发
- Graylog
- [需要plugin支持，并且不支持新版本](https://community.graylog.org/t/single-sign-on-authentication-plugin/22804)
- Yarning sso
- [OIDC](https://github.com/cookieY/Yearning/pull/608)
- Harbor
- [OIDC](https://docs.authing.cn/v2/integration/harbor/)
- Nexus sonatype SSO
- [Nexus sonatype](https://help.sonatype.com/en/user-authentication.html)
- [SAML](https://help.sonatype.com/en/saml.html)
### 建议
- 部署自己的 [CAS 服务](https://github.com/apereo/cas)
- 集成各个服务

134
方案/20241224-元盟全域SSO方案.md Normal file
View File

@ -0,0 +1,134 @@
<!-- Space: qifu -->
<!-- Parent: 后端技术&知识&规范 -->
<!-- Parent: 技术方案 -->
<!-- Parent: 基建 -->
<!-- Title: 20241224-元盟全域SSO方案 -->
<!-- Macro: :anchor\((.*)\):
Template: ac:anchor
Anchor: ${1} -->
<!-- Macro: \!\[.*\]\((.+)\)\<\!\-\- width=(.*) \-\-\>
Template: ac:image
Url: ${1}
Width: ${2} -->
<!-- Macro: \<\!\-\- :toc: \-\-\>
Template: ac:toc
Printable: 'false'
MinLevel: 2
MaxLevel: 4 -->
<!-- Include: 杂项/声明文件.md -->
<!-- :toc: -->
# 元盟全域SSO方案
## 一、现状
### 业务背景
为了统一账号登录，减少由于平台账号密码不同导致的割裂。
采用统一的SSO，使用企微进行登录，方便开发人员各平台使用，减少各个平台的割裂
## 二、需求
### 业务需求
需要统一的SSO方案来达到一个账户或者企微账户直接登录的效果
## 三、设计目标
### 实现的功能
- 通过企业微信登录各个平台
- 平台列表
- Gitlab
- Jenkins
- Confluence
- kubesphere
- kibana
- grafana
- Skywalking
- Nacos
- Graylog
- Yarning
- Harbor
- Nexus sonatype
- 产研协同平台
## 四、整体设计
### 整体架构
![](https://picture.texous.cn/blog/20241224121425565.png)
### 交互流程
![](https://picture.texous.cn/blog/20241224142653277.png)
## 五、详细设计
### 功能模块设计
- 产研协同平台
- 对接 keycloak 实现企微登录
- 方案一：
- 企赋网关对接 Keycloak
- 产研协同平台对接企赋网关
- 方案二：
- 产研协同平台直接对接 Keycloak
- Jenkins SSO（已验证）
- 安装插件 SAML：插件市场直接安装
- [整合Keycloak教程](https://github.com/jenkinsci/saml-plugin/blob/main/doc/CONFIGURE_KEYCLOAK.md)
- Gitlab SSO
- [SAML](https://docs.gitlab.com/ee/integration/saml.html)
- Confluence SSO
- [SAML](https://www.selinux.tech/architecture/cas/cas-gitlab)
- kubesphere SSO
- [OIDC](https://blog.csdn.net/zpf17671624050/article/details/144296801)
- kibana SSO
- [SAML](https://docs.authing.cn/v2/integration/)
- grafana SSO
- [配置](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/)
- [配置参考](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/)
- Skywalking SSO
- [CAS](https://blog.csdn.net/qq_42536474/article/details/108669351)
- Nacos SSO
- 暂时不支持，可以搞插件开发
- Graylog
- [需要plugin支持，并且不支持新版本](https://community.graylog.org/t/single-sign-on-authentication-plugin/22804)
- Yarning sso
- [OIDC](https://github.com/cookieY/Yearning/pull/608)
- Harbor
- [OIDC](https://docs.authing.cn/v2/integration/harbor/)
- Nexus sonatype SSO
- [Nexus sonatype](https://help.sonatype.com/en/user-authentication.html)
- [SAML](https://help.sonatype.com/en/saml.html)
### 潜在风险
## 六、工作量和排期
### 开发时间
### 联调时间
### 提测时间
### 上线时间
## 七、设计评审意见
## 八、参考文档
- [Okta](https://www.okta.com/)
- [CAS 单点登录部署](https://blog.csdn.net/xu_guo_jie/article/details/104209452)
- [集成文档参考](https://docs.authing.cn/v2/integration/?category=all&page=2)
- [CAS Server](https://github.com/apereo/cas)
- [CAS 整合 LDAP](https://www.doc88.com/p-0774845211878.html)
- [CAS](https://zhuanlan.zhihu.com/p/610470663)
- [OIDC](https://zhuanlan.zhihu.com/p/539297736)
- [LDAP](https://zhuanlan.zhihu.com/p/608437013)
- [IAM单点登录之CAS协议分析](https://zhuanlan.zhihu.com/p/627920220)
- [Keycloak](https://www.keycloak.org/)
- [Keycloak OIDC](https://www.keycloak.org/securing-apps/oidc-layers)

1336
绘图/20241224-元盟全域SSO方案.excalidraw Normal file
View File

File diff suppressed because it is too large Load Diff

4
绘图/20241224-元盟全域SSO流程.svg Normal file
View File

File diff suppressed because one or more lines are too long
Side by Side

After

Width:  |  Height:  |  Size: 54 KiB