docs: Casdoor SSO 部署运维手册 + 泛化 E2E 检查脚本（沉淀 31.23 踩坑）

2026-09-01 19:31:08 +08:00
parent f8c605b858
commit 20a1c8b569
2 changed files with 183 additions and 0 deletions
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# DeepData × Casdoor SSO 全链路 E2E 检查（在能同时访问网关与 Casdoor 的机器上运行）
+#
+# 用法:
+#   GW_BASE=https://deepdata.yhdd.apescale.com:1014 \
+#   CASDOOR_BASE=http://192.168.31.23:1013 \
+#   SSO_CLIENT_ID=<clientId> SSO_CLIENT_SECRET=<secret> \
+#   LOCAL_ADMIN_PASSWORD=*** \
+#   bash e2e-check.sh
+#
+# 可选环境变量（有默认值，按实际部署修改）:
+#   SSO_APP_NAME=DataMate            Casdoor 应用名
+#   SSO_APP_OWNER=admin              Casdoor 应用 owner（grant-consent 需 owner/name 全名）
+#   SSO_ORG=datamate                 Casdoor 组织名（登录用）
+#   SSO_REDIRECT_URI=$GW_BASE/api/user/oauth/callback
+#   SSO_TEST_USERS="dmin:Dmin@2026:admin viewer1:Viewer1@2026:viewer"   用户名:密码:期望角色
+#   LOCAL_ADMIN=admin                本地管理员（验证本地登录共存）
+set -u
+
+GW="${GW_BASE:?GW_BASE required, e.g. https://deepdata.yhdd.apescale.com:1014}"
+CD="${CASDOOR_BASE:?CASDOOR_BASE required, e.g. http://192.168.31.23:1013}"
+APP="${SSO_APP_NAME:-DataMate}"
+APP_FULL="${SSO_APP_OWNER:-admin}/$APP"
+ORG="${SSO_ORG:-datamate}"
+REDIR="${SSO_REDIRECT_URI:-$GW/api/user/oauth/callback}"
+CLIENT_ID="${SSO_CLIENT_ID:?SSO_CLIENT_ID required}"
+ADMIN_U="${LOCAL_ADMIN:-admin}"
+ADMIN_P="${LOCAL_ADMIN_PASSWORD:*** LOCAL_ADMIN_PASSWORD required}"
+
+TMPD=$(mktemp -d); trap 'rm -rf "$TMPD"' EXIT
+fail=0
+ck() { if [ "$1" = "0" ]; then echo "PASS: $2"; else echo "FAIL: $2"; fail=1; fi; }
+
+echo "=== [1] /sso/casdoor/config ==="
+CFG=$(curl -sk "$GW/sso/casdoor/config")
+echo "$CFG"
+echo "$CFG" | grep -q '"enabled":true' && ck 0 "enabled=true" || ck 1 "enabled"
+# clientSecret 不得出现在公开配置里
+if [ -n "${SSO_CLIENT_SECRET:-}" ] && echo "$CFG" | grep -q "$SSO_CLIENT_SECRET"; then
+  ck 1 "clientSecret 泄漏"; else ck 0 "无 secret 泄漏"; fi
+
+echo "=== [2] 本地登录 $ADMIN_U（accountOnly 已移除，本地登录与 SSO 共存）==="
+LOGIN=$(curl -sk -X POST "$GW/api/user/login" -H 'Content-Type: application/json' \
+  -d "{\"username\":\"$ADMIN_U\",\"password\":\"$ADMIN_P\"}")
+TOK=$(echo "$LOGIN" | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
+[ -n "$TOK" ] && ck 0 "本地登录拿 token" || { echo "$LOGIN"; ck 1 "本地登录"; }
+ME=$(curl -sk "$GW/api/user/me" -H "Authorization: Bearer $TOK")
+echo "$ME"
+
+# SSO 单用户链路: 网关登录页 → casdoor JSON 登录 → grant-consent 取 code → 网关 callback → /me
+sso_test() {
+  local U="$1" P="$2" EXPECT="$3"
+  local GJ="$TMPD/gw_$U" CJ="$TMPD/cd_$U" HDRS AUTHURL STATE LR CODE CB FINAL SSTOK ME2
+  HDRS=$(curl -sk -c "$GJ" -D - -o /dev/null "$GW/api/user/oauth/login?next=/sso/callback.html")
+  AUTHURL=$(echo "$HDRS" | grep -i '^location:' | tr -d '\r' | awk '{print $2}')
+  STATE=$(echo "$AUTHURL" | sed -n 's/.*state=\([^&]*\).*/\1/p')
+  [ -n "$AUTHURL" ] && [ -n "$STATE" ] && ck 0 "$U 拿到 authorize URL" || { echo "authurl=$AUTHURL"; ck 1 "$U authorize"; return; }
+  LR=$(curl -s -c "$CJ" -X POST -H 'Content-Type: application/json' \
+    -d "{\"type\":\"login\",\"application\":\"$APP\",\"username\":\"$U\",\"password\":\"$P\",\"organization\":\"$ORG\",\"autoSignin\":true}" \
+    "$CD/api/login")
+  echo "$LR" | grep -q '"status": *"ok"' && ck 0 "$U casdoor 登录" || { echo "$LR"; ck 1 "$U casdoor 登录"; return; }
+  CODE=$(curl -s -b "$CJ" -X POST -H 'Content-Type: application/json' \
+    -d "{\"application\":\"$APP_FULL\",\"clientId\":\"$CLIENT_ID\",\"provider\":\"\",\"signinMethod\":\"\",\"responseType\":\"code\",\"redirectUri\":\"$REDIR\",\"scope\":\"openid profile email\",\"state\":\"$STATE\",\"nonce\":\"\",\"challenge\":\"\",\"resource\":\"\"}" \
+    "$CD/api/grant-consent" | sed -n 's/.*"data": *"\([^"]*\)".*/\1/p')
+  [ -n "$CODE" ] && ck 0 "$U 拿到 authorization code" || { ck 1 "$U grant-consent"; return; }
+  CB=$(curl -sk -b "$GJ" -D - -o /dev/null "$GW/api/user/oauth/callback?code=$CODE&state=$STATE")
+  FINAL=$(echo "$CB" | grep -i '^location:' | tr -d '\r' | awk '{print $2}')
+  echo "final: $FINAL"
+  SSTOK=$(echo "$FINAL" | sed -n 's/.*sso_token=//p')
+  [ -n "$SSTOK" ] && ck 0 "$U 拿到 sso_token" || { echo "$CB" | head -5; ck 1 "$U sso_token"; return; }
+  ME2=$(curl -sk "$GW/api/user/me" -H "Authorization: Bearer $SSTOK")
+  echo "$ME2"
+  echo "$ME2" | grep -q "\"role\":\"$EXPECT\"" && ck 0 "$U 角色=$EXPECT" || ck 1 "$U 角色（期望 $EXPECT）"
+}
+
+i=3
+for entry in ${SSO_TEST_USERS:-}; do
+  U="${entry%%:*}"; rest="${entry#*:}"; P="${rest%%:*}"; EXPECT="${rest#*:}"
+  echo "=== [$i] SSO $U → $EXPECT ==="
+  sso_test "$U" "$P" "$EXPECT"
+  i=$((i+1))
+done
+
+echo ""
+echo "=== 汇总 fail=$fail ==="
+exit "$fail"