This action will force synchronization from 符节开源/jap, which will overwrite any changes that you have made since you forked the repository, and can not be recovered!!!
Synchronous operation will process in the background and will refresh the page when finishing processing. Please be patient.
AbstractJapStrategy
的子类增加构造函数,支持自定义 JapUserStore
。(Gitee Issue #I4BHBJ)hutool
的版本为 5.7.14JustAuth
的版本为 1.16.5AbstractJapStrategy
, support custom JapUserStore
. (Gitee Issue #I4BHBJ)hutool
to 5.7.14
JustAuth
to 1.16.5
jap-http-api
module. (Gitee Issue #I43ZS7)jap-ids-web
module. Package the filter of ids as a separate component.kisso
to 3.7.7, Solve the vulnerability of jackson.googleauth
to 1.5.0, Solve the vulnerability of apache httpclient.simple-http
to 1.0.5.JustAuth
to 1.16.4.Note [1]:
In versions prior to version 1.0.5 of jap, rely on the HttpServletRequest
, Cookie
, HttpServletResponse
,
and HttpSession
under the javax.servlet.http
package in jakarta-servlet
, such as:
// Interface provided by jap
public interface JapStrategy {
default JapResponse authenticate(AuthenticateConfig config, HttpServletRequest request, HttpServletResponse response) {
return null;
}
}
// Use jap in spring framework
XxJapStrategy.authenticate(config,request,response);
In order to improve the adaptability of the framework, since version 1.0.5, JAP removed the dependency
of jakarta-servlet
and adopted a new set of interfaces (reference: jap-http ).
The developer needs to adapt the original request when calling the JAP interface.
For example, if the developer uses jakarta-servlet
, then the HttpServletRequest
needs to be adapted:
// Use 1.0.5 or higher version of jap in spring framework
XxJapStrategy.authenticate(config,new JakartaRequestAdapter(request),new JakartaResponseAdapter(response));
jap-http-api
模块。 (Gitee Issue #I43ZS7)jap-ids-web
模块。 将 jap-ids
的过滤器打包为一个单独的组件。scope
在各个流程中都更改为可选,遵循 RFC6749 规范。kisso
的版本为 3.7.7, 解决 jackson 的漏洞。googleauth
的版本为 1.5.0, 解决 apache httpclient 的漏洞。simple-http
的版本为 1.0.5.JustAuth
的版本为 1.16.4.注[1]:
在 1.0.5 以前版本,jap 中依赖 jakarta-servlet
中 javax.servlet.http
包下的 HttpServletRequest
、Cookie
、HttpServletResponse
、HttpSession
,比如:
// jap 提供的接口
public interface JapStrategy {
default JapResponse authenticate(AuthenticateConfig config, HttpServletRequest request, HttpServletResponse response) {
return null;
}
}
// 在spring框架中使用 jap
XxJapStrategy.authenticate(config,request,response);
为了提高框架适配性,自 1.0.5 版本开始,JAP 去掉了 jakarta-servlet
依赖,采用了一套全新的接口(参考:jap-http),开发者在调用
JAP 接口时需要对原 request 进行适配。
比如,开发者使用了 jakarta-servlet
,那么需要对 HttpServletRequest
进行适配处理:
// 在spring框架中使用 1.0.5 或更高级版本的 jap
XxJapStrategy.authenticate(config,new JakartaRequestAdapter(request),new JakartaResponseAdapter(response));
IdsConfig#enableDynamicIssuer
is true
, custom context-path
is supported.Oauth2Strategy
supports the following methods: refreshToken
, revokeToken
, getUserInfo
JapCache
and AuthStateCache
of SocialStrategy
at the same time. (
Github#6)client_secret
,适配多种场景,如:BCrypt 等。 (
Gitee#I44032)IdsConfig#enableDynamicIssuer
时,支持自定义 context-path
Oauth2Strategy
支持使用以下方法: refreshToken
、revokeToken
、getUserInfo
SocialStrategy
的 JapCache
and AuthStateCache
.(
Github#6)userId
为空时 NPE 异常. (Github#5)jap-ids
enableDynamicIssuer
in IdsConfig
. When enableDynamicIssuer=true
, jap ids will automatically
extract issuer
from the currently requested domain name.loginPageUrl
in IdsConfig
:
loginPageUrl
: login form page urlloginUrl
: The api url for loginexternalLoginPageUrl
in IdsConfig
. when the login page is not provided by an authorized service (the
login page is hosted by other services), you need to enable this configuration.externalConfirmPageUrl
in IdsConfig
. When the authorization confirmation page is not provided by an
authorized service (the authorization confirmation page is hosted by other services), you need to enable this
configuration.authorizeAutoApproveUrl
in IdsConfig
. When the authorize url contains autoapprove=true
, it will not
jump to the confirmPageUrl
, but will jump directly to the authorizeAutoApproveUrl
.profile
, address
, read
and write
.uid
in the OauthUtil#createAuthorizeUrl(String, IdsRequestParam)
.IdsUserStoreService
interface to support custom operations on user data after login.IdsPipeline
interface, developers can customize the process, currently only supports the process of
customizing IdsxxFilter
and LoginEndpoint
.SPI
plugin mechanismjap-social
SocialStrategy
provides methods of refreshToken
, revokeToken
, and getUserInfo
jap
javax.servlet-api
-> jakarta.servlet-api
jap-ids
IdsConfig.confirmUrl
to confirmPageUrl
.ApprovalEndpoint#getAuthClientInfo(HttpServletRequest)
to IdsResponse<String, Map<String, Object>>
.Ap provalEndpoint#authorize(HttpServletRequest)
to IdsResponse<String, String>
.AuthorizationEndpoint#agree(HttpServletRequest)
to IdsResponse<String, String>
.LoginEndpoint#signin(HttpServletRequest)
to IdsResponse<String, String>
.LogoutEndpoint#logout(HttpServletRequest)
to IdsResponse<String, String>
.ClientDetail
.IdsResponse#getData()
to the specified generic.IdsScopeProvider#initScopes(List<IdsScope>)
.response_type=id_token
, the resulting Claims are returned in the ID Token.UserInfoEndpoint#getCurrentUserInfo(HttpServletRequest)
, Response UserInfo Claims using
Scope Values.loginByUsernameAndPassword
and getByName
methods of the IdsUserService
interface, and add
the clientId
parameter, which can be used to distinguish multi-tenant scenarioscom.fujieid.jap.core.util.RequestUtil
jap-ids
module, and provide oauth services externally based on jap-ids
code
, token
, id token
, id token token
, code id token
, code token
, code id token token
For more details about the use of jap-ids
, please refer to the sample
project: jap-ids-demo, or refer to the
document: IDS OAuth 2.0 服务端
OidcStrategy#authenticate
method, cache the OidcDiscoveryDto
, and reduce unnecessary http
requestsOidcUtil
, fix known bugscom.fujieid.jap.core.cache.JapLocalCache
, implement timer manually, clean local cache regularlyJapErrorCode
JapTokenHelper
JapErrorCode
enumeration class to manage exception codes and exception promptsJapResponse
class to standardize interface return contentJapTokenHelper
class to manage user tokens uniformlyJapContext
class to maintain jap context informationJapAuthentication
class, unified management of login status information and jap context informationAuthenticateConfig
, JapConfig
to com.fujieid.jap.core.config
packageJapUtil
to com.fujieid.jap.core.util
packageJapCacheContextHolder
JapUserStoreContextHolder
AbstractJapStrategy
, introduced JapContext
and JapAuthentication
classesJapConfig
class, only retain the sso
and ssoConfig
attributes, and add the tokenExpireTime
and cacheExpireTime
attributes at the same timeJapCacheConfig
to 7 daysJapUserService
interface classvoid remove key( string key)
method to JapCache
errorCode
and errorMessage
attributes in JapException
to facilitate the processing of exception
information into unified format return datatoken
attribute to JapUser
, and the jap token will be automatically returned after loginJapStrategy
interface, the return type of the authenticate
method is changed to JapResponse
, and the
strategy methods of all modules return data in a unified formatredirect
method with @Deprecated
in the JapUtil
class, and it may be deleted in the future. At the
same time add the createToken
methodauthenticate
method of Oauth2Strategy
to return JapResponse
authenticate
method of OidcStrategy
to return JapResponse
authenticate
method of SimpleStrategy
to return JapResponse
authenticate
method of SocialStrategy
to return JapResponse
JapSsoHelper#login
method to the jap token of the current userJapSsoUtil
japSsoConfig
class, delete the login url
and logout url
attributesjap-mfa
module to realize TOTP verificationlogout
method is added to the JapUserStoreContextHolder
to support clearing cookies and sessionsjap.sh
, support a variety of common commandsoptions
attribute in JapConfig
is deleted, and the justathConfig
attribute is added to SocialConfig
RemberMeDetailsUtils
to RembermeUtils
Oauth2Strategy#checkOauthConfig()
and Oauth2Strategy#isCallback()
to the Oauth2Util
SimpleConfig
, and move the unnecessary configuration items and business logic to
the RememberMeUtils
com.fujieid.jap.core.cache.JapCache
jap-oauth2
package-info.java
simple-json
to 0.0.2
JA Plus(JAP) is an open source authentication middleware, it is highly decoupled from business code and has good modularity and flexiblity. Developers could integrate JAP into web applications effortlessly.
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。