BARON-SSO 로그인 연동
This commit is contained in:
root
@@ -0,0 +1,170 @@
|
||||
<?php
|
||||
require_once __DIR__ . '/common.php';
|
||||
|
||||
auth_session_start_if_needed();
|
||||
|
||||
$error = trim((string) ($_GET['error'] ?? ''));
|
||||
$state = trim((string) ($_GET['state'] ?? ''));
|
||||
$code = trim((string) ($_GET['code'] ?? ''));
|
||||
|
||||
$fallbackSite = 'egbim';
|
||||
|
||||
if ($error !== '') {
|
||||
auth_script_redirect('BARON-SSO 로그인에 실패했습니다: ' . $error, auth_site_base_url($fallbackSite) . '/index.php');
|
||||
}
|
||||
|
||||
if ($state === '' || $code === '') {
|
||||
auth_script_redirect('BARON-SSO 응답값이 올바르지 않습니다.', auth_site_base_url($fallbackSite) . '/index.php');
|
||||
}
|
||||
|
||||
$statePayload = auth_consume_baron_state($state);
|
||||
if ($statePayload === null) {
|
||||
auth_script_redirect('BARON-SSO state 검증에 실패했습니다.', auth_site_base_url($fallbackSite) . '/index.php');
|
||||
}
|
||||
|
||||
$site = ($statePayload['site'] ?? 'egbim') === 'eng' ? 'eng' : 'egbim';
|
||||
$redirectUrl = $statePayload['return_url'] ?? auth_site_qna_url($site);
|
||||
$config = auth_baron_config();
|
||||
|
||||
if (!auth_baron_is_configured()) {
|
||||
auth_script_redirect('BARON-SSO 설정이 아직 완료되지 않았습니다.', auth_site_base_url($site) . '/index.php');
|
||||
}
|
||||
|
||||
$tokenRequestData = [
|
||||
'grant_type' => 'authorization_code',
|
||||
'redirect_uri' => auth_baron_redirect_uri(),
|
||||
'code' => $code,
|
||||
];
|
||||
|
||||
$basicAuthUser = null;
|
||||
$basicAuthPassword = null;
|
||||
|
||||
if ($config['client_auth_method'] === 'post') {
|
||||
$tokenRequestData['client_id'] = $config['client_id'];
|
||||
$tokenRequestData['client_secret'] = $config['client_secret'];
|
||||
} else {
|
||||
$tokenRequestData['client_id'] = $config['client_id'];
|
||||
$basicAuthUser = $config['client_id'];
|
||||
$basicAuthPassword = $config['client_secret'];
|
||||
}
|
||||
|
||||
$tokenResponse = auth_http_post_form(
|
||||
$config['token_endpoint'],
|
||||
$tokenRequestData,
|
||||
[],
|
||||
$basicAuthUser,
|
||||
$basicAuthPassword
|
||||
);
|
||||
|
||||
if ($tokenResponse['error'] !== '') {
|
||||
auth_script_redirect('BARON-SSO 토큰 요청에 실패했습니다.', auth_site_base_url($site) . '/index.php');
|
||||
}
|
||||
|
||||
$tokenData = json_decode($tokenResponse['body'], true);
|
||||
if ($tokenResponse['http_code'] < 200 || $tokenResponse['http_code'] >= 300 || !is_array($tokenData)) {
|
||||
if (auth_is_local_debug()) {
|
||||
$debugMessage = sprintf(
|
||||
'BARON token error HTTP %d | body=%s',
|
||||
$tokenResponse['http_code'],
|
||||
auth_compact_debug_value((string) $tokenResponse['body'])
|
||||
);
|
||||
auth_script_redirect($debugMessage, auth_site_base_url($site) . '/index.php');
|
||||
}
|
||||
|
||||
auth_script_redirect('BARON-SSO 토큰 응답을 처리할 수 없습니다.', auth_site_base_url($site) . '/index.php');
|
||||
}
|
||||
|
||||
$claims = [];
|
||||
$idToken = trim((string) ($tokenData['id_token'] ?? ''));
|
||||
if ($idToken !== '') {
|
||||
$claims = auth_jwt_payload($idToken);
|
||||
}
|
||||
|
||||
if ($config['userinfo_endpoint'] !== '' && !empty($tokenData['access_token'])) {
|
||||
$userInfoResponse = auth_http_get_json($config['userinfo_endpoint'], (string) $tokenData['access_token']);
|
||||
$userInfoData = json_decode($userInfoResponse['body'], true);
|
||||
if ($userInfoResponse['http_code'] >= 200 && $userInfoResponse['http_code'] < 300 && is_array($userInfoData)) {
|
||||
$claims = array_merge($claims, $userInfoData);
|
||||
}
|
||||
}
|
||||
|
||||
$user = auth_baron_user_from_claims($claims);
|
||||
if (empty($user['userId']) || empty($user['loginIds'])) {
|
||||
auth_script_redirect('BARON-SSO 사용자 정보를 확인할 수 없습니다.', auth_site_base_url($site) . '/index.php');
|
||||
}
|
||||
|
||||
$normalizedUser = auth_apply_user_session($user, 'baron', [
|
||||
'baron_access_token' => (string) ($tokenData['access_token'] ?? ''),
|
||||
'baron_id_token' => $idToken,
|
||||
]);
|
||||
|
||||
setcookie('descope_login_id', '', auth_cookie_options(time() - 42000));
|
||||
setcookie('descope_user_id', '', auth_cookie_options(time() - 42000));
|
||||
setcookie('descope_user_name', '', auth_cookie_options(time() - 42000));
|
||||
setcookie('descope_user_email', '', auth_cookie_options(time() - 42000));
|
||||
setcookie('descope_user_phone', '', auth_cookie_options(time() - 42000));
|
||||
setcookie('descope_custom_attributes', '', auth_cookie_options(time() - 42000));
|
||||
setcookie('descope_role_names', '', auth_cookie_options(time() - 42000));
|
||||
auth_set_descope_session_cookies($normalizedUser);
|
||||
auth_set_baron_session_cookies($normalizedUser, $claims);
|
||||
|
||||
$clientSessionPayload = [
|
||||
'loginId' => (string) ($normalizedUser['loginIds'][0] ?? ''),
|
||||
'descopeUserId' => (string) ($normalizedUser['userId'] ?? ''),
|
||||
'userName' => (string) ($normalizedUser['name'] ?? ''),
|
||||
'phone' => (string) ($normalizedUser['phone'] ?? ''),
|
||||
'company' => (string) ($normalizedUser['customAttributes']['company'] ?? ''),
|
||||
'familyCompany' => (string) ($normalizedUser['customAttributes']['familyCompany'] ?? ''),
|
||||
'team' => (string) ($normalizedUser['customAttributes']['team'] ?? ''),
|
||||
'position' => (string) ($normalizedUser['customAttributes']['position'] ?? ''),
|
||||
'familyUniqueKey' => (string) ($normalizedUser['customAttributes']['familyUniqueKey'] ?? ''),
|
||||
'userRole' => (string) (($normalizedUser['roleNames'][0] ?? '')),
|
||||
'authProvider' => 'baron',
|
||||
'sessionJwt' => $idToken !== '' ? $idToken : (string) ($tokenData['access_token'] ?? ''),
|
||||
'baronClaims' => json_encode($claims, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
|
||||
];
|
||||
|
||||
$jsonPayload = json_encode($clientSessionPayload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
|
||||
$jsonRedirectUrl = json_encode($redirectUrl, JSON_UNESCAPED_SLASHES);
|
||||
|
||||
header('Content-Type: text/html; charset=UTF-8');
|
||||
echo <<<HTML
|
||||
<!doctype html>
|
||||
<html lang="ko">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="Cache-Control" content="no-store, no-cache, must-revalidate">
|
||||
<meta http-equiv="Pragma" content="no-cache">
|
||||
<meta http-equiv="Expires" content="0">
|
||||
<title>Signing in...</title>
|
||||
</head>
|
||||
<body>
|
||||
<script>
|
||||
(function () {
|
||||
var payload = {$jsonPayload} || {};
|
||||
var redirectUrl = {$jsonRedirectUrl};
|
||||
|
||||
Object.keys(payload).forEach(function (key) {
|
||||
var value = payload[key];
|
||||
if (typeof value === 'string' && value !== '') {
|
||||
sessionStorage.setItem(key, value);
|
||||
localStorage.setItem(key, value);
|
||||
} else {
|
||||
sessionStorage.removeItem(key);
|
||||
}
|
||||
});
|
||||
|
||||
try {
|
||||
window.dispatchEvent(new CustomEvent('descope-auth-changed', {
|
||||
detail: { loginId: payload.loginId || '' }
|
||||
}));
|
||||
} catch (e) {}
|
||||
|
||||
window.location.replace(redirectUrl);
|
||||
})();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
HTML;
|
||||
exit;
|
||||
?>
|
||||
Reference in New Issue
Block a user