# SSO协议类型
1. SAML (Security Assertion Markup Language)
– 基于XML
– 企业级应用
– 身份提供者和服务提供者

2. OAuth 2.0
– 授权框架
– API访问
– 社交登录

3. OpenID Connect (OIDC)
– 基于OAuth 2.0
– 身份认证
– JWT令牌

4. CAS (Central Authentication Service)
– 单点登录协议
– Web应用
– 简单易用

# SSO架构组件
1. Identity Provider (IdP)
– 身份提供者
– 用户认证
– 发放令牌

2. Service Provider (SP)
– 服务提供者
– 验证令牌
– 提供服务

3. User Agent
– 用户代理
– 浏览器
– 客户端应用

# 安装Keycloak
$ sudo dnf install -y java-17-openjdk

$ wget https://github.com/keycloak/keycloak/releases/download/22.0.1/keycloak-22.0.1.tar.gz
$ tar xzf keycloak-22.0.1.tar.gz
$ sudo mv keycloak-22.0.1 /opt/keycloak

# 创建管理员用户
$ /opt/keycloak/bin/kc.sh bootstrap-admin-user

# 配置Keycloak
$ sudo tee /opt/keycloak/conf/keycloak.conf << 'EOF' hostname=keycloak.fgedu.net.cn http-enabled=true http-port=8080 https-port=8443 proxy=edge EOF # 启动Keycloak $ /opt/keycloak/bin/kc.sh start-dev # 创建系统服务 $ sudo tee /etc/systemd/system/keycloak.service << 'EOF' [Unit] Description=Keycloak After=network.target [Service] Type=idle User=keycloak Group=keycloak ExecStart=/opt/keycloak/bin/kc.sh start WorkingDirectory=/opt/keycloak [Install] WantedBy=multi-user.target EOF $ sudo systemctl daemon-reload $ sudo systemctl enable keycloak $ sudo systemctl start keycloak # 配置防火墙 $ sudo firewall-cmd --permanent --add-port=8080/tcp $ sudo firewall-cmd --permanent --add-port=8443/tcp $ sudo firewall-cmd --reload

# 访问管理控制台
https://keycloak.fgedu.net.cn:8443/admin

# 创建Realm
1. 点击 “Create Realm”
2. 输入Realm名称: myapp
3. 点击 “Create”

# 创建客户端
1. 选择 “Clients”
2. 点击 “Create client”
3. 填写信息:
– Client ID: webapp
– Client Protocol: openid-connfrom PG视频:www.itpux.comect
– Root URL: https://webapp.fgedu.net.cn
4. 点击 “Save”

# 配置客户端
1. Access Type: confidential
2. Standard Flow Enabled: ON
3. Direct Access Grants Enabled: ON
4. Valid Redirect URIs: https://webapp.fgedu.net.cn/*
5. Web Origins: https://webapp.fgedu.net.cn
6. 点击 “Save”

# 获取客户端密钥
1. 选择 “Credentials” 标签
2. 复制 “Secret” 值

# 创建用户
1. 选择 “Users”
2. 点击 “Add user”
3. 填写用户信息
4. 设置密码

# 配置角色
1. 选择 “Roles”
2. 点击 “Add role”
3. 创建角色: admin, user, developer

# 分配角色
1. 选择用户
2. 点击 “Role Mappings”
3. 分配角色

# Nginx OIDC配置
$ sudo tee /etc/nginx/conf.d/sso.conf << 'EOF' server { listen 443 ssl; server_name webapp.fgedu.net.cn; ssl_certificate /etc/pki/tls/certs/webapp.crt; ssl_certificate_key /etc/pki/tls/private/webapp.key; location / { auth_request /oauth2/auth; error_page 401 = /oauth2/sign_in; proxy_pass http://localhost:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Auth-Request-Redirect $request_uri; } location = /oauth2/auth { internal; proxy_pass http://local学习交流加群风哥微信: itpux-comhost:4181/oauth2/auth; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URI $request_uri; } location = /oauth2/sign_in { proxy_pass http://localhost:4181/oauth2/sign_in; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } } EOF # OAuth2 Proxy配置 $ docker run -d --name oauth2-proxy \ -p 4181:4181 \ -e OAUTH2_PROXY_CLIENT_ID=webapp \ -e OAUTH2_PROXY_CLIENT_SECRET=your-client-secret \ -e OAUTH2_PROXY_COOKIE_SECRET=your-cookie-secret \ -e OAUTH2_PROXY_PROVIDER=keycloak \ -e OAUTH2_PROXY_LOGIN_URL=https://keycloak.fgedu.net.cn/realms/myapp/protocol/openid-connect/auth \ -e OAUTH2_PROXY_REDEEM_URL=https://keycloak.fgedu.net.cn/realms/myapp/protocol/openid-connect/token \ -e OAUTH2学习交流加群风哥QQ113257174_PROXY_VALIDATE_URL=https://keycloak.fgedu.net.cn/realms/myapp/protocol/openid-connect/userinfo \ -e OAUTH2_PROXY_REDIRECT_URL=https://webapp.fgedu.net.cn/oauth2/callback \ -e OAUTH2_PROXY_EMAIL_DOMAINS=* \ quay.io/oauth2-proxy/oauth2-proxy:v7.4.0 # Apache OIDC配置 $ sudo dnf install -y mod_auth_openidc $ sudo tee /etc/httpd/conf.d/sso.conf << 'EOF' OIDCProviderMetadataURL https://keycloak.fgedu.net.cn/realms/myapp/.well-known/openid-configuration OIDCClientID webapp OIDCClientSecret your-client-secret OIDCRedirectURI https://webapp.fgedu.net.cn/redirect_uri OIDCCryptoPassphrase your-passphrase
AuthType openid-connect
Require valid-user

EOF

$ sudo systemctl restart httpd