diff --git a/apps/routers/auth.py b/apps/routers/auth.py index cb611d50b0cb7cea3ea05b2d36e24560dcccbdae..c4bba6e772f3005f455e4c870c83cc595c900bec 100644 --- a/apps/routers/auth.py +++ b/apps/routers/auth.py @@ -262,9 +262,30 @@ async def logout( @router.get("/redirect", response_model=OidcRedirectRsp) -async def oidc_redirect() -> JSONResponse: +async def oidc_redirect(action: str = "login") -> JSONResponse: """OIDC重定向URL""" - redirect_url = await oidc_provider.get_redirect_url() + if action == "settings": + # 直接读取配置中的redirect_settings_url + from apps.common.config import Config + config = Config().get_config() + + if hasattr(config.login.settings, 'redirect_settings_url') and config.login.settings.redirect_settings_url: + # 直接使用配置文件中的redirect_settings_url + redirect_url = config.login.settings.redirect_settings_url + else: + # 如果无法获取配置,返回特定响应提示 + return JSONResponse( + status_code=status.HTTP_200_OK, + content=ResponseData( + code=status.HTTP_400_BAD_REQUEST, + message="当前鉴权服务暂无用户主页", + result={}, + ).model_dump(exclude_none=True, by_alias=True), + ) + else: + # 默认返回登录URL + redirect_url = await oidc_provider.get_redirect_url() + return JSONResponse( status_code=status.HTTP_200_OK, content=OidcRedirectRsp( diff --git a/apps/schemas/config.py b/apps/schemas/config.py index 0af68005272ee667be5cea204c0ebcf546f1c5fe..cceed9c2923828951978a3e7ebc620830ca0d6d3 100644 --- a/apps/schemas/config.py +++ b/apps/schemas/config.py @@ -37,6 +37,7 @@ class OIDCConfig(BaseModel): login_api: str = Field(description="EulerCopilot登录API") app_id: str = Field(description="OIDC AppID") app_secret: str = Field(description="OIDC App Secret") + redirect_settings_url: str | None = Field(description="用户设置页面重定向URL", default=None) class AutheliaConfig(BaseModel): @@ -48,6 +49,14 @@ class AutheliaConfig(BaseModel): redirect_uri: str = Field(description="重定向URI") enable_pkce: bool = Field(description="是否启用PKCE", default=True) pkce_challenge_method: str = Field(description="PKCE挑战方法", default="S256") + redirect_settings_url: str | None = Field(description="用户设置页面重定向URL", default=None) + + +class OpenEulerConfig(BaseModel): + """OpenEuler认证配置""" + + host: str = Field(description="OpenEuler服务路径") + redirect_settings_url: str | None = Field(description="用户设置页面重定向URL", default=None) class FixedUserConfig(BaseModel): @@ -61,7 +70,7 @@ class LoginConfig(BaseModel): provider: Literal["authhub", "openeuler", "authelia", "disable"] = Field( description="OIDC Provider", default="authhub") - settings: OIDCConfig | AutheliaConfig | FixedUserConfig = Field( + settings: OIDCConfig | AutheliaConfig | OpenEulerConfig | FixedUserConfig = Field( description="OIDC 配置") diff --git a/deploy/chart/euler_copilot/configs/framework/config-authelia.toml b/deploy/chart/euler_copilot/configs/framework/config-authelia.toml index a484ca4e0b63ea6cb061ed14568ceea3a7a372c2..ba5a7bb17a5618a1127ff81cdcaa5ee56d90aed8 100644 --- a/deploy/chart/euler_copilot/configs/framework/config-authelia.toml +++ b/deploy/chart/euler_copilot/configs/framework/config-authelia.toml @@ -37,6 +37,9 @@ scopes = 'openid profile email groups' response_type = 'code' response_mode = 'form_post' +# 用户设置页面重定向URL配置 +redirect_settings_url = '{{ $autheliaDomain }}/authenticated' + # OIDC 高级配置 enable_pkce = true pkce_challenge_method = 'S256' diff --git a/deploy/chart/euler_copilot/configs/framework/config.toml b/deploy/chart/euler_copilot/configs/framework/config.toml index d955b42b5096b43fa897142ee8e370cb08c4e833..bd93bb48c0a190216a3614ecc10d95e86ee75894 100644 --- a/deploy/chart/euler_copilot/configs/framework/config.toml +++ b/deploy/chart/euler_copilot/configs/framework/config.toml @@ -13,24 +13,18 @@ data_dir = '/app/data' [login] provider = '{{ .Values.login.provider | default "authhub" }}' -{{- if eq (.Values.login.provider | default "authhub") "authelia" }} -{{- $eulerCopilotDomain := .Values.domain.euler_copilot | default "http://127.0.0.1:30080" }} -{{- $autheliaDomain := .Values.domain.authelia }} -{{- if not $autheliaDomain }} +{{- if eq (.Values.login.provider | default "authhub") "openeuler" }} +{{- $openeulerDomain := .Values.domain.openeuler }} +{{- if not $openeulerDomain }} + {{- $eulerCopilotDomain := .Values.domain.euler_copilot | default "http://127.0.0.1:30080" }} {{- $baseHost := regexReplaceAll "^https?://|:[0-9]+$" $eulerCopilotDomain "" }} {{- $protocol := regexFind "^https?://" $eulerCopilotDomain }} - {{- $autheliaPort := .Values.ports.authelia | default 30091 | toString }} - {{- $autheliaDomain = printf "%s%s:%s" $protocol $baseHost $autheliaPort }} + {{- $openeulerPort := .Values.ports.openeuler | default 30082 | toString }} + {{- $openeulerDomain = printf "%s%s:%s" $protocol $baseHost $openeulerPort }} {{- end }} [login.settings] -host = '{{ $autheliaDomain }}' -client_id = '{{ .Values.login.authelia.client_id | default "euler-copilot" }}' -client_secret = '{{ .Values.login.authelia.client_secret | default "your-client-secret-here" }}' -redirect_uri = '{{ $eulerCopilotDomain }}/api/auth/login' -authorization_endpoint = '{{ $autheliaDomain }}/api/oidc/authorization' -token_endpoint = '{{ $autheliaDomain }}/api/oidc/token' -userinfo_endpoint = '{{ $autheliaDomain }}/api/oidc/userinfo' -scopes = 'openid profile email' +host = '{{ $openeulerDomain }}' +redirect_settings_url = '{{ $openeulerDomain }}/my/zh/settings' {{- else }} [login.settings] {{- $eulerCopilotDomain := .Values.domain.euler_copilot | default "http://127.0.0.1:30080" }}