Ticket

1. Create configuration file

The default data directory is /data/mingdao/script/volume/sso/sso.json, with the following contents:

Note: If 404 still appears after mounting, you can copy the content to json.cn to verify whether the json format is legal

{
  "mode": "common-ticket",
  "name": "ticket",
  "ticket": {
    "getUidUrl": "",
    "ticketParams": {
      "ticketParam": "ticket"
    },
    "getUserInfoUrl": "",    
    "params": {
      "UserId": "uid", 
      "Name": "name",
      "Email": "email",
      "Mobile": "mobilePhone"
     },
     "autoRegister": true,
     "projectId": ""
   }
}

Some parameters and explanations

Parameters	Type	Required	Explanation
ticket.getUidUrl	String	Yes	Get the user ID interface address; the parameters configured in ticketParams will be sent to this interface in Post mode to obtain the user ID; Interface requirements
ticket.ticketParams	Object	Yes	More custom parameters can be added to ticketParams as needed; this parameter is used to obtain the user id
ticket.ticketParams.ticketParam	String	Yes	The ticket parameter name carried in the URL; if configured as "ticketParam": "tkt", the configured address needs to be /ticket?tkt=xxx&.... Get the value correctly
ticket.getUserInfoUrl	String	Yes	The interface address for obtaining user information; Interface requirement
ticket.params	Object	Yes	Returns the user information field mapping rules, the key is a fixed field and the value is configured according to the actual user information; Parameter configuration method
autoRegister	Boolean	No	Whether to automatically create an account when the account does not exist; the default is true
projectId	String	Yes	HAP organization number; Organization Management (upper right corner) > Organization Information (page) > Organization Number ID; (Multi-organization single sign-on does not require configuring this parameter, see Step 3); such as 1x-2x-3x-4x-5x

Interaction diagram The interface for obtaining user ID needs to meet the following requirements:

• Support POST (application/json) method call (the request body is the parameters configured in ticketParams)
• The return value is in JSON format and must meet the following format:

{
  "code": "1",
  "message": "success",
  "data": "248289761" // user id
}

The interface for obtaining user information needs to meet the following requirements:

• Support POST (application/json) method call, the request parameters are as follows

{
  "userId": "248289761"
}

• The return value is in JSON format and must meet the following format:

{
  "code": "1",
  "message": "success",
  "data": {
    "uid": "248289761001",
    "name": "Jane Doe",
    "email": "janedoe@example.com",
    "mobilePhone": "123"
  }
}

As shown in the above return value, the configuration of params is:

"params": {
  "UserId": "uid",
  "Name": "name",
  "Email": "email",
  "Mobile": "mobilePhone"
}

2. Mount configuration file

Modify the docker-compose.yaml corresponding to the microservice application, the default path is /data/mingdao/script/docker-compose.yaml, add file mounting in volumes and restart the microservice application.

- ./volume/sso/sso.json:/usr/local/MDPrivateDeployment/sso/OptionFile/sso.json

Enable relationship search

If you need to bind a third-party association ID, you need to create the file extend.json. The default path is /data/mingdao/script/volume/sso/extend.json and the content is as follows

{
  "relation": true
}

Add mounting files

- ./volume/sso/extend.json:/usr/local/MDPrivateDeployment/sso/extend.json

tip

After the mounting configuration is completed, the microservice application needs to be restarted. After the restart is successful, you can access the {server}/orgsso/checkssoconfig interface through GET to check whether the configuration file is successfully mounted.

3. Single sign-on

Single Organization Browser access: {server}/orgsso/ticket?{ticketParams.ticketParam}={ticket}&returnUrl={returnUrl}

Multiple Organizations Browser access: {server}/orgsso/ticket?returnUrl={returnUrl}&appKey={appKey}&sign={sign}&timestamp={timestamp}&projectId={projectId}

For multi-organization projectId needs to be passed through parameters, and enterprise authorization authentication parameters are also required;

For enterprise authentication and authorization signature algorithm, please refer to: https://www.showdoc.com.cn/mingdao/15539798

note

{server} is the HAP system address, for example, it can be replaced with: http://192.168.10.20:8880

{returnUrl} is the jump address after successful login, does not need to be filled in; for example, if you need to jump to the application page, it can be replaced with: http://192.168.10.20:8880/app/cf595091-e3ac-4669 -a320-068e55533c33/64477b37df36209b5f36f1cf/64477b4f61655012a90ed994?from=insite

If an SSO Error prompt appears during the access process, you can log in to the HAP system through the administrator account, click the avatar in the upper right corner: System Configuration > Log; search for the service name as sso, and check the specific cause of the error.