云原生丨一文教你轻松借助DEX实现单点登录！

version: "3"services:openldap:image: bitnami/openldap:latestports:- 1389:1389environment:- LDAP_ADMIN_USERNAME=admin- LDAP_ADMIN_PASSWORD=adminpassworddex:image: bitnami/dex:latestports:- 5556:5556- 5557:5557command:- serve- /dex/config.yamlvolumes:- config.yaml:/dex/config.yamlredis:image: redis:latestports:- 6379:6379

enablePasswordDB: true# dex服务地址issuer: http://localhost:5556/dexoauth2:# 可⽤的返回类型responseTypes: [ "code","token","id_token" ]skipApprovalScreen: truestaticClients:- id: app1name: app1redirectURIs:- http://localhost:8080/callbacksecret: app1-secret# trustedPeers表app2⽣成的token可⽤于app1的认证。trustedPeers:- app2- id: app2name: app2redirectURIs:- http://localhost:8081/callbacksecret: app2-secrettrustedPeers:- app1storage:type: sqlite3config:file: local-example/dex.dbweb:# http 接⼝地址http: 0.0.0.0:5556grpc:# grpc接⼝地址。⽀持通过grpc来扩充dex配置。addr: 0.0.0.0:5557# # Server certs. If TLS credentials aren't provided dex will run inplaintext (HTTP) mode.# tlsCert: /Users/liujian/work/006-yhplatform/code/yunhang-platformservice/cert/dex-server.crt# tlsKey: /Users/liujian/work/006-yhplatform/code/yunhang-platformservice/cert/dex-server.key## # Client auth CA.# tlsClientCA: /Users/liujian/work/006-yhplatform/code/yunhang-platformservice/cert/dex-client.crt# enable reflectionreflection: trueconnectors:# 指定账号连接器。这⾥配置的是openldap- type: ldapname: OpenLDAPid: ldapconfig:# The following configurations seem to work with OpenLDAP:## 1) Plain LDAP, without TLS:host: openldap:1389insecureNoSSL: true## 2) LDAPS without certificate validation:#host: localhost:636#insecureNoSSL: false#insecureSkipVerify: true## 3) LDAPS with certificate validation:#host: YOUR-HOSTNAME:636#insecureNoSSL: false#insecureSkipVerify: false#rootCAData: 'CERT'# ...where CERT="$( base64 -w 0 your-cert.crt )"# This would normally be a read-only user.bindDN: cn=admin,dc=example,dc=orgbindPW: adminpasswordusernamePrompt: LDAP ⽤户名userSearch:baseDN: ou=users,dc=example,dc=orgfilter: "(objectClass=person)"username: cn# "DN" (case sensitive) is a special attribute name. Itindicates that# this value should be taken from the entity's DN not anattribute on# the entity.idAttr: DNemailAttr: mailnameAttr: cngroupSearch:baseDN: ou=Groups,dc=example,dc=orgfilter: "(objectClass=groupOfNames)"userMatchers:# A user is a member of a group when their DN matches# the value of a "member" attribute on the group entity.- userAttr: DNgroupAttr: member# The group name should be the "cn" value.nameAttr: cn# 超时时间设置expiry:deviceRequests: "5m"signingKeys: "6h"idTokens: "24h"refreshTokens:reuseInterval: "30s"validIfNotUsedFor: "2160h" # 90 daysabsoluteLifetime: "3960h" # 165 days

curl http://localhost:5556/dex/auth/ldap?client_id=app1&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcallback&response_type=code&scope=openid+profile+email+federated:id+offline_access+audience:server:client_id:zadig+audience:server:client_id:app2&state=gHoisYYgsmpc

func TestAuthCode(t *testing.T) {ctx, cancel := context.WithTimeout(context.TODO(), time.Second*10)defer cancel()// 连接dexprovider, err := oidc.NewProvider(ctx, "http://localhost:5556/dex")if err != nil {t.Error(err)}oauth2Config := &oauth2.Config{ClientID: "app1",ClientSecret: "app1-secret",Endpoint: provider.Endpoint(),RedirectURL: "http://localhost:8080/callback",Scopes: []string{"openid", "profile", "email", "groups"},}// 请求dex的token端点获取tokenoauth2Token, err := oauth2Config.Exchange(ctx, authCode)if err != nil {t.Error(err)}rawIDToken, _ = oauth2Token.Extra("id_token").(string)t.Logf("accessToken:%v", oauth2Token.AccessToken)t.Logf("refreshToken:%v", oauth2Token.RefreshToken)t.Logf("idToken:%v", rawIDToken)}

func TestIDToken(t *testing.T) {// 连接dexprovider, err := oidc.NewProvider(ctx, "http://localhost:5556/dex")if err != nil {t.Error(err)}// 验证idTokenidTokenVerifier := provider.Verifier(&oidc.Config{ClientID: "app1"})idToken, err := idTokenVerifier.Verify(ctx, rawIDToken)if err != nil {t.Error(err)}ac := make(map[string]any)if err := idToken.Claims(ac); err != nil {t.Error(err)}t.Logf("claims:%v", ac)}

func TestSession(t *testing.T){sk := "xxxxx" // base64格式的pem私钥// ⽣成局部会话accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256,jwt.StandardClaims{Subject: "user1",ExpiresAt: time.Now().Add(time.Hour).Unix(), // Second})accessTokenStr, err := accessToken.SignedString([]byte(sk))if err != nil {t.Error(err)}refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256,jwt.StandardClaims{Subject: "user1",ExpiresAt: time.Now().Add(time.Hour*2).Unix(), // Second})refreshTokenStr, err := refreshToken.SignedString([]byte(sk))if err != nil {t.Error(err)}// 构建全局会话ctx, cancel := context.WithTimeout(context.TODO(), time.Second*10)defer cancel()sid := uuid.New().String()rc := redis.NewClient(&redis.Options{Addr: "localhost:6379", DB: 0})rc.Set(ctx, sid, map[string]any{"dex": map[string]any{ // 存储dex信息"accessToken": "xxxx","refreshToken": "xxxx","idToken": "xxxx",},"local": map[string]string { // 存储局部会话accessTokenStr: refreshTokenStr,},}.Hour)}

func TestRefreshToken(t *testing.T){sid := "xxxx" //全局会话refreshTokenLocal := "xxxxx" // 局部会话的refreshTokenrefreshTokenDex := "xxxxx" // dex的refreshToken// 解析局部会话的refreshToken中的jwt.Cl。重新⽣成accessToken...// 获取全局会话ctx, cancel := context.WithTimeout(context.TODO(), time.Second*10)defer cancel()sid := uuid.New().String()rc := redis.NewClient(&redis.Options{Addr: "localhost:6379", DB: 0})val := make(map[string]any)err := rc.Get(ctx, sid).Scan(val)if err != nil {t.Error(err)}// 更新dex的tokenoauth2Config := &oauth2.Config{ClientID: "app1",ClientSecret: "app1-secret",Endpoint: provider.Endpoint(),RedirectURL: "http://localhost:8080/callback",Scopes: []string{"openid", "profile", "email", "groups"},}oauth2Token, err := oauth2Config.TokenSource(ctx,&oauth2.Token{RefreshToken: ac.Metadata["refreshToken"]}).Token()if err != nil {t.Error(err)}rawIDToken, _ = oauth2Token.Extra("id_token").(string)newLocal := val["local"].(map[string]string)newLocal[newAccessTokenLocal] = newRefreshTokenLocal// 更新全局会话rc.Set(ctx, sid, map[string]any{"dex": map[string]any{ // 存储dex信息"accessToken": oauth2Token.AccessToken,"refreshToken": oauth2Token.RefreshToken,"idToken": rawIDToken,},"local": newLocal,}.Hour)}

func TestLogout(t *testing.T) {sid := "xxxxx" // 前端传⼊ctx, cancel := context.WithTimeout(context.TODO(), time.Second*10)defer cancel()rc := redis.NewClient(&redis.Options{Addr: "localhost:6379", DB: 0})rc.Set(ctx, sid, map[string]any{"accessToken": accessTokenStr,"refreshToken": refreshTokenStr,}, time.Hour)}