91 lines
3.7 KiB
Python
91 lines
3.7 KiB
Python
|
"""OIDC 配置模块"""
|
|||
|
|
import os
|
|||
|
|
from pydantic import BaseModel, Field
|
|||
|
|
|
|||
|
|
|
|||
|
|
class OIDCConfig(BaseModel):
|
|||
|
|
"""OIDC 配置模型"""
|
|||
|
|
|
|||
|
|
# 是否启用 OIDC 认证
|
|||
|
|
enabled: bool = Field(default=False, description="是否启用 OIDC 认证")
|
|||
|
|
|
|||
|
|
# OIDC Provider 配置
|
|||
|
|
issuer_url: str = Field(default="", description="OIDC Provider 的 issuer URL")
|
|||
|
|
client_id: str = Field(default="", description="OIDC Client ID")
|
|||
|
|
client_secret: str = Field(default="", description="OIDC Client Secret")
|
|||
|
|
|
|||
|
|
# 回调 URL（可选，默认自动构建）
|
|||
|
|
redirect_uri: str = Field(default="", description="OIDC 回调 URL")
|
|||
|
|
|
|||
|
|
# 授权端点（可选，自动从 discovery 获取）
|
|||
|
|
authorization_endpoint: str = Field(default="", description="授权端点 URL")
|
|||
|
|
token_endpoint: str = Field(default="", description="Token 端点 URL")
|
|||
|
|
userinfo_endpoint: str = Field(default="", description="UserInfo 端点 URL")
|
|||
|
|
end_session_endpoint: str = Field(default="", description="登出端点 URL")
|
|||
|
|
|
|||
|
|
# 认证源名称
|
|||
|
|
provider_name: str = Field(default="OIDC登录", description="认证源名称，显示在登录按钮上的文字")
|
|||
|
|
|
|||
|
|
# 请求的 scope
|
|||
|
|
scopes: str = Field(default="openid profile email", description="请求的 scope")
|
|||
|
|
|
|||
|
|
# 是否自动创建用户
|
|||
|
|
auto_create_user: bool = Field(default=True, description="是否自动创建用户")
|
|||
|
|
|
|||
|
|
# 默认角色
|
|||
|
|
default_role: str = Field(default="user", description="OIDC 用户的默认角色")
|
|||
|
|
|
|||
|
|
# 默认部门名称
|
|||
|
|
default_department: str = Field(default="OIDC用户", description="OIDC 用户的默认部门")
|
|||
|
|
|
|||
|
|
# 用户名映射字段
|
|||
|
|
username_claim: str = Field(default="preferred_username", description="用户名映射字段")
|
|||
|
|
|
|||
|
|
# 邮箱映射字段
|
|||
|
|
email_claim: str = Field(default="email", description="邮箱映射字段")
|
|||
|
|
|
|||
|
|
# 姓名映射字段
|
|||
|
|
name_claim: str = Field(default="name", description="姓名映射字段")
|
|||
|
|
|
|||
|
|
@classmethod
|
|||
|
|
def from_env(cls) -> "OIDCConfig":
|
|||
|
|
"""从环境变量加载配置"""
|
|||
|
|
enabled = os.environ.get("OIDC_ENABLED", "false").lower() == "true"
|
|||
|
|
|
|||
|
|
if not enabled:
|
|||
|
|
return cls(enabled=False)
|
|||
|
|
|
|||
|
|
return cls(
|
|||
|
|
enabled=enabled,
|
|||
|
|
provider_name=os.environ.get("OIDC_PROVIDER_NAME", "OIDC登录"),
|
|||
|
|
issuer_url=os.environ.get("OIDC_ISSUER_URL", ""),
|
|||
|
|
client_id=os.environ.get("OIDC_CLIENT_ID", ""),
|
|||
|
|
client_secret=os.environ.get("OIDC_CLIENT_SECRET", ""),
|
|||
|
|
redirect_uri=os.environ.get("OIDC_REDIRECT_URI", ""),
|
|||
|
|
authorization_endpoint=os.environ.get("OIDC_AUTHORIZATION_ENDPOINT", ""),
|
|||
|
|
token_endpoint=os.environ.get("OIDC_TOKEN_ENDPOINT", ""),
|
|||
|
|
userinfo_endpoint=os.environ.get("OIDC_USERINFO_ENDPOINT", ""),
|
|||
|
|
end_session_endpoint=os.environ.get("OIDC_END_SESSION_ENDPOINT", ""),
|
|||
|
|
scopes=os.environ.get("OIDC_SCOPES", "openid profile email"),
|
|||
|
|
auto_create_user=os.environ.get("OIDC_AUTO_CREATE_USER", "true").lower() == "true",
|
|||
|
|
default_role=os.environ.get("OIDC_DEFAULT_ROLE", "user"),
|
|||
|
|
default_department=os.environ.get("OIDC_DEFAULT_DEPARTMENT", "OIDC用户"),
|
|||
|
|
username_claim=os.environ.get("OIDC_USERNAME_CLAIM", "preferred_username"),
|
|||
|
|
email_claim=os.environ.get("OIDC_EMAIL_CLAIM", "email"),
|
|||
|
|
name_claim=os.environ.get("OIDC_NAME_CLAIM", "name"),
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
def is_configured(self) -> bool:
|
|||
|
|
"""检查配置是否完整"""
|
|||
|
|
if not self.enabled:
|
|||
|
|
return False
|
|||
|
|
return all([
|
|||
|
|
self.issuer_url,
|
|||
|
|
self.client_id,
|
|||
|
|
self.client_secret,
|
|||
|
|
])
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 全局配置实例
|
|||
|
|
oidc_config = OIDCConfig.from_env()
|