idP

e488d737 · jianan · 74801049 · e488d737 · e488d737 · e488d737
Commit e488d737 authored Oct 20, 2026 by jianan
10 changed files
--- a/yd-user-api/src/main/java/com/yd/user/api/controller/ApiClientUserController.java
+++ b/yd-user-api/src/main/java/com/yd/user/api/controller/ApiClientUserController.java
@@ -6,6 +6,7 @@ import com.yd.user.api.service.ApiClientUserService;
 import com.yd.user.feign.client.clientuser.ApiClientUserFeignClient;
 import com.yd.user.feign.request.clientuser.*;
 import com.yd.user.feign.response.clientuser.ApiClientUserDetailResponse;
+import com.yd.user.feign.response.clientuser.ApiClientUserIdpLoginResponse;
 import com.yd.user.feign.response.clientuser.ApiClientUserPageResponse;
 import com.yd.user.feign.response.clientuser.ApiClientUserSaveResponse;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -106,4 +107,12 @@ public class ApiClientUserController implements ApiClientUserFeignClient {
        return apiClientUserService.conditionList(request);
    }
+    /**
+     * 统一身份登录：按 IdP subject + 租户解析登录身份
+     */
+    @Override
+    public Result<ApiClientUserIdpLoginResponse> getByIdpSub(String tenantBizId, String idpSub) {
+        return apiClientUserService.getByIdpSub(tenantBizId, idpSub);
+    }
 }
--- a/yd-user-api/src/main/java/com/yd/user/api/service/ApiClientUserService.java
+++ b/yd-user-api/src/main/java/com/yd/user/api/service/ApiClientUserService.java
@@ -4,6 +4,7 @@ import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.yd.common.result.Result;
 import com.yd.user.feign.request.clientuser.*;
 import com.yd.user.feign.response.clientuser.ApiClientUserDetailResponse;
+import com.yd.user.feign.response.clientuser.ApiClientUserIdpLoginResponse;
 import com.yd.user.feign.response.clientuser.ApiClientUserPageResponse;
 import com.yd.user.feign.response.clientuser.ApiClientUserSaveResponse;
@@ -23,6 +24,8 @@ public interface ApiClientUserService {
    Result editOpenId(String clientUserBizId, String openId);
+    Result<ApiClientUserIdpLoginResponse> getByIdpSub(String tenantBizId, String idpSub);
    Result saveClientUserList(List<String> userBizIdList,
                              String tenantBizId,
                              String projectBizId);

--- a/yd-user-api/src/main/java/com/yd/user/api/service/impl/ApiClientUserServiceImpl.java
+++ b/yd-user-api/src/main/java/com/yd/user/api/service/impl/ApiClientUserServiceImpl.java
@@ -15,6 +15,7 @@ import com.yd.csf.feign.request.agentreferralrelation.ApiAgentReferralRelationSa
 import com.yd.user.api.service.ApiClientUserService;
 import com.yd.user.feign.request.clientuser.*;
 import com.yd.user.feign.response.clientuser.ApiClientUserDetailResponse;
+import com.yd.user.feign.response.clientuser.ApiClientUserIdpLoginResponse;
 import com.yd.user.feign.response.clientuser.ApiClientUserPageResponse;
 import com.yd.user.feign.response.clientuser.ApiClientUserSaveResponse;
 import com.yd.user.feign.response.sysuser.ApiSysUserPageResponse;
@@ -173,6 +174,24 @@ public class ApiClientUserServiceImpl implements ApiClientUserService {
    }
    /**
+     * 统一身份登录：按 IdP subject + 租户解析客户端用户登录身份。
+     */
+    @Override
+    public Result<ApiClientUserIdpLoginResponse> getByIdpSub(String tenantBizId, String idpSub) {
+        ClientUser clientUser = iClientUserService.getByIdpSub(tenantBizId, idpSub);
+        if (Objects.isNull(clientUser)) {
+            return Result.success(null);
+        }
+        ApiClientUserIdpLoginResponse response = new ApiClientUserIdpLoginResponse();
+        response.setClientUserBizId(clientUser.getClientUserBizId());
+        response.setTenantBizId(clientUser.getTenantBizId());
+        response.setIdpSub(clientUser.getIdpSub());
+        response.setStatus(clientUser.getStatus());
+        response.setApprovalStatus(clientUser.getApprovalStatus());
+        return Result.success(response);
+    }
+    /**
     * 同步sys_user系统用户，批量更新客户端用户表数据
     * @param userBizIdList
     * @param tenantBizId

--- a/yd-user-feign/src/main/java/com/yd/user/feign/client/clientuser/ApiClientUserFeignClient.java
+++ b/yd-user-feign/src/main/java/com/yd/user/feign/client/clientuser/ApiClientUserFeignClient.java
@@ -4,6 +4,7 @@ import com.yd.common.result.Result;
 import com.yd.user.feign.fallback.clientuser.ApiClientUserFeignFallbackFactory;
 import com.yd.user.feign.request.clientuser.*;
 import com.yd.user.feign.response.clientuser.ApiClientUserDetailResponse;
+import com.yd.user.feign.response.clientuser.ApiClientUserIdpLoginResponse;
 import com.yd.user.feign.response.clientuser.ApiClientUserSaveResponse;
 import io.swagger.v3.oas.annotations.Operation;
 import org.springframework.cloud.openfeign.FeignClient;
@@ -83,4 +84,17 @@ public interface ApiClientUserFeignClient {
     */
    @PostMapping("/condition/list")
    Result<List<ApiClientUserDetailResponse>> conditionList(@Validated @RequestBody ApiClientUserConditionListRequest request);
+    /**
+     * 统一身份登录：按 IdP subject + 租户解析客户端用户登录身份（不按项目过滤）。
+     *
+     * @param tenantBizId 所属租户唯一业务ID
+     * @param idpSub      统一身份提供方 subject（OIDC sub）
+     * @return 登录身份；查不到时 data 为 null
+     */
+    @GetMapping("/getByIdpSub")
+    @Operation(summary = "按IdP subject解析登录身份")
+    Result<ApiClientUserIdpLoginResponse> getByIdpSub(
+            @NotBlank(message = "租户业务ID不能为空") @RequestParam(value = "tenantBizId") String tenantBizId,
+            @NotBlank(message = "IdP subject不能为空") @RequestParam(value = "idpSub") String idpSub);
 }
--- a/yd-user-feign/src/main/java/com/yd/user/feign/fallback/clientuser/ApiClientUserFeignFallbackFactory.java
+++ b/yd-user-feign/src/main/java/com/yd/user/feign/fallback/clientuser/ApiClientUserFeignFallbackFactory.java
@@ -4,6 +4,7 @@ import com.yd.common.result.Result;
 import com.yd.user.feign.client.clientuser.ApiClientUserFeignClient;
 import com.yd.user.feign.request.clientuser.*;
 import com.yd.user.feign.response.clientuser.ApiClientUserDetailResponse;
+import com.yd.user.feign.response.clientuser.ApiClientUserIdpLoginResponse;
 import com.yd.user.feign.response.clientuser.ApiClientUserSaveResponse;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.cloud.openfeign.FallbackFactory;
@@ -58,6 +59,12 @@ public class ApiClientUserFeignFallbackFactory implements FallbackFactory<ApiCli
            public Result<List<ApiClientUserDetailResponse>> conditionList(ApiClientUserConditionListRequest request) {
                return null;
            }
+            @Override
+            public Result<ApiClientUserIdpLoginResponse> getByIdpSub(String tenantBizId, String idpSub) {
+                log.error("按IdP subject解析登录身份失败 tenantBizId={} idpSub={}", tenantBizId, idpSub, cause);
+                return null;
+            }
        };
    }
 }
--- a/yd-user-feign/src/main/java/com/yd/user/feign/response/clientuser/ApiClientUserIdpLoginResponse.java
+++ b/yd-user-feign/src/main/java/com/yd/user/feign/response/clientuser/ApiClientUserIdpLoginResponse.java
+package com.yd.user.feign.response.clientuser;
+import lombok.Data;
+/**
+ * 统一身份（OIDC）登录后，按 IdP subject 解析出的客户端用户登录身份。
+ *
+ * <p>仅携带资源服务器做认证与门禁所需的最小字段，不含任何证件/银行卡等敏感画像。</p>
+ */
+@Data
+public class ApiClientUserIdpLoginResponse {
+    /**
+     * 客户端用户表唯一业务ID（csf 行级数据归属键）
+     */
+    private String clientUserBizId;
+    /**
+     * 所属租户唯一业务ID
+     */
+    private String tenantBizId;
+    /**
+     * 统一身份提供方（Casdoor）的 subject
+     */
+    private String idpSub;
+    /**
+     * 状态(0:停用 1:启用)
+     */
+    private Integer status;
+    /**
+     * 审批状态（CG=成功/已审批 可登录）
+     */
+    private String approvalStatus;
+}
--- a/yd-user-service/src/main/java/com/yd/user/service/dto/ClientUserDto.java
+++ b/yd-user-service/src/main/java/com/yd/user/service/dto/ClientUserDto.java
@@ -37,4 +37,9 @@ public class ClientUserDto {
     * 用户唯一标识(sys_user系统用户表)列表
     */
    private List<String> userBizIdList;
+    /**
+     * 统一身份提供方（Casdoor）的 subject
+     */
+    private String idpSub;
 }
--- a/yd-user-service/src/main/java/com/yd/user/service/model/ClientUser.java
+++ b/yd-user-service/src/main/java/com/yd/user/service/model/ClientUser.java
@@ -157,6 +157,12 @@ public class ClientUser implements Serializable {
    private String openId;
    /**
+     * 统一身份提供方（Casdoor）的 subject，租户内唯一；未绑定为 null
+     */
+    @TableField("idp_sub")
+    private String idpSub;
+    /**
     * 通用备注
     */
    @TableField("remark")

--- a/yd-user-service/src/main/java/com/yd/user/service/service/IClientUserService.java
+++ b/yd-user-service/src/main/java/com/yd/user/service/service/IClientUserService.java
@@ -26,4 +26,9 @@ public interface IClientUserService extends IService<ClientUser> {
    List<ClientUser> queryList(ClientUserDto dto);
    ClientUser queryOne(String clientUserBizId);
+    /**
+     * 按统一身份 subject 与租户定位唯一客户端用户；不按项目过滤。
+     */
+    ClientUser getByIdpSub(String tenantBizId, String idpSub);
 }
--- a/yd-user-service/src/main/java/com/yd/user/service/service/impl/ClientUserServiceImpl.java
+++ b/yd-user-service/src/main/java/com/yd/user/service/service/impl/ClientUserServiceImpl.java
@@ -32,11 +32,12 @@ public class ClientUserServiceImpl extends ServiceImpl<ClientUserMapper, ClientU
    @Override
    public IPage<ApiClientUserPageResponse> page(Page<ApiClientUserPageResponse> page,
                                                 ApiClientUserPageRequest request) {
-        return baseMapper.page(page,request);
+        return baseMapper.page(page, request);
    }
    /**
     * 查询列表
+     *
     * @param dto
     * @return
     */
@@ -47,6 +48,7 @@ public class ClientUserServiceImpl extends ServiceImpl<ClientUserMapper, ClientU
                .eq(StringUtils.isNotBlank(dto.getProjectBizId()),ClientUser::getProjectBizId,dto.getProjectBizId())
                .eq(StringUtils.isNotBlank(dto.getClientUserBizId()),ClientUser::getClientUserBizId,dto.getClientUserBizId())
                .eq(StringUtils.isNotBlank(dto.getPhone()),ClientUser::getPhone,dto.getPhone())
+                .eq(StringUtils.isNotBlank(dto.getIdpSub()), ClientUser::getIdpSub, dto.getIdpSub())
                .in(!CollectionUtils.isEmpty(dto.getUserBizIdList()),ClientUser::getUserBizId,dto.getUserBizIdList())
        );
        return list;
@@ -54,11 +56,23 @@ public class ClientUserServiceImpl extends ServiceImpl<ClientUserMapper, ClientU
    /**
     * 查询单个对象
+     *
     * @param clientUserBizId
     * @return
     */
    @Override
    public ClientUser queryOne(String clientUserBizId) {
-        return this.getOne(new LambdaQueryWrapper<ClientUser>().eq(ClientUser::getClientUserBizId,clientUserBizId));
+        return this.getOne(new LambdaQueryWrapper<ClientUser>().eq(ClientUser::getClientUserBizId, clientUserBizId));
+    }
+    /**
+     * 按统一身份 subject 与租户定位唯一客户端用户；不按项目过滤，排除已删除行。
+     */
+    @Override
+    public ClientUser getByIdpSub(String tenantBizId, String idpSub) {
+        return this.getOne(new LambdaQueryWrapper<ClientUser>()
+                .eq(ClientUser::getTenantBizId, tenantBizId)
+                .eq(ClientUser::getIdpSub, idpSub)
+                .eq(ClientUser::getIsDeleted, 0), false);
    }
 }