24601aa66f
* feat(auth): init auth package & collection * feat(auth): register * feat(auth): use authenticator * feat(auth): mapRoles * feat(auth): refactor * feat(auth): base auth class * feat(auth): add plugin * chore(auth): test * chore(auth): add test cases * feat(auth): authenticators pane * chore(auth): custom hook useAuthTypes * feat(auth): authenticator pane * chore(auth): store options schema using context * feat(auth): signInPage provider * feat(auth): signUpPage provider * chore(auth): solve build errors * chore(auth): add dependency * chore(auth): remove dependency cycles * chore(auth): add plugin-auth to preset * chore(auth): fix test * feat(auth): authenticator enable status * fix(test): fix test using new authentication * feat(auth): migration, set up basic auth * chore(auth): can set options ui by component * fix(test): workflow manunal.test * fix(test): typo * feat(auth): support multi-language * chore(auth): imporve code * chore(auth): hide button if no configuration * chore(auth): readme * chore(auth): remove allowSignup prop * chore(auth): move configure pane to edit form * fix(auth): jwt options bug * feat(auth): init sms-auth * chore(auth): at least authenticator required * chore(auth): add test * feat(auth): support sms auth * fix(auth): fix test * chore(auth): move findOrCreateUser to AuthModel * chore(auth): history compatible processing * feat(auth): support SAML auth * chore(auth): saml auth list * chore(saml-auth): improve ui * Merge branch 'main' into feat/authentication * chore(auth): improve code * fix(saml-auth): fix bug * fix(saml-auth): fix saml options * chore(saml-auth): compatible processing && ut * fix(auth): signin page bug * chore(auth): saml compatible processing * feat(auth): oidc-auth * fix(oidc-auth): bug * fix(oidc-auth): bug * fix(auth): fix test * chore(auth): filter enabled authenticator * chore(oidc): add field map * chore(auth): update readme * docs(auth): create sms-auth readme * feat(auth): allow signup config * test(auth): fix test * feat(auth): allow saml and oidc use http * chore(oidc-auth): extends timeout * docs(auth): update readme * feat(auth): support sort * docs(saml): update readme * feat(auth): support sort all authenticator * Merge branch 'main' into feat/authentication * Merge branch 'main' into feat/authentication * feat: improve code * docs(auth): add doc * Merge branch 'main' into feat/authentication * chore: update yarn.lock * feat: improve code * chore(acl): write role to acl if it exists in database and not found … (#2001) * chore(acl): write role to acl if it exists in database and not found in acl * fix: test * fix: eager load with nested association (#2002) * chore: upgrade vitest * chore: edit * refactor: auth class * fix: set options * chore(acl): write role to acl if it exists in database and not found … (#2001) * chore(acl): write role to acl if it exists in database and not found in acl * fix: test * fix: eager load with nested association (#2002) * chore: upgrade vitest * chore: add migrations * test: fix api-client test * chore: add sms-auth * feat: avoid no permission after auth type disabled * fix: translation --------- Co-authored-by: chenos <chenlinxh@gmail.com>
55 lines
1.6 KiB
Markdown
55 lines
1.6 KiB
Markdown
# SAML
|
||
|
||
提供SAML2.0 SSO登录功能。
|
||
|
||
## 依赖
|
||
|
||
- `@nocobase/auth` 认证插件，提供认证相关功能，表、模型、函数复用等。
|
||
|
||
## 使用方法
|
||
|
||
> 以Google WorkSpace IdP为例
|
||
|
||
### 将Google设置为IdP
|
||
|
||
[Google管理控制台](https://admin.google.com/) - 应用 - Web应用和移动应用
|
||
|
||
<img src="https://s2.loli.net/2023/05/18/O7UYh9pjePrKzTq.png" width="800px" />
|
||
|
||
|
||
进行应用设置之后，复制**SSO网址**、**实体ID**和**证书**。
|
||
|
||
<img src="https://s2.loli.net/2023/05/18/Mpwk3dAIvShmUCe.png" width="800px"/>
|
||
|
||
### 在Nocobase上新增认证器
|
||
|
||
插件设置 - 认证 - 新增 - SAML
|
||
|
||
<img src="https://s2.loli.net/2023/05/18/EpXsJ1BM5lju2mY.png" width="800px" />
|
||
|
||
将刚才复制的信息依次进行填写
|
||
- SSO URL: SSO网址
|
||
- Public Certificate: 证书
|
||
- idP Issuer: 实体id
|
||
- http: 如果是本地http测试可以勾选
|
||
|
||
之后复制`Usage`中的`SP Issuer/EntityID`和`ACS URL`.
|
||
|
||
### 在Google上填写SP信息
|
||
|
||
回到Google控制台，在**服务提供商详细信息**页面，输入刚才复制的ACS网址和实体ID，并勾选**已签署响应**。
|
||
|
||
在**属性映射**位置，添加映射，映射对应属性，Nocobase可供映射的字段有：
|
||
|
||
- email（必填）
|
||
- phone (仅对scope支持phone的平台生效，如阿里云)
|
||
- nickname
|
||
- username
|
||
- firstName
|
||
- lastName
|
||
|
||
用户名使用规则优先级: `nickname` > `username` > `firstName lastName` > `nameID`
|
||
|
||
`nameID`为SAML协议携带，无需映射，将作为用户唯一标识保存。
|
||
|
||
在有email或nameID为email的情况下，登录时将尝试匹配已有用户，否则创建新用户。 |