Tars management platform provides the ability to interface with user system (including single sign on system and authority system). If the user does not have corresponding system, tars can provide a simple user system module for the user to choose. The user system module provides the function of single sign on and registration, as well as the authority control ability to the service level. Users can also choose to use only one of these functions
If users want to use the default user system module, they need to install the user system management platform module in the web first. Corresponding: Database Name: db_user_system The installation steps are the same as those of the tars management platform, which will not be described in detail.
1) Default login module: provide basic registration and login page, external interface getUidByTicket to obtain user information and interface validate to verify whether to log in, getUidByTicket interface receives a ticket parameter, returns uid validate interface to receive ticket parameter and uid parameter, and returns result (true or false);
2）Default permission module: there are three fields in the permission module database table, which are flag, role and uid, respectively corresponding to flags (in the tars platform, "application + service" means a flag), roles and users.
The permission module provides six interfaces, detail
/auth/addAuth： Add permission interface in batch, the input parameter is [{flag: “”，role: “”，uid: “”}],
/auth/deleteAuth：Delete the permission interface. The input parameter is flag. Delete all permission information under the flag
/auth/updateAuth：Update permission，the input parameter is:flag，role，uid，Where uid is the user list, which means updating all user information under a certain flag and role.
/auth/getAuthListByUid：Get a list of all permissions a user has，the input parameter is: uid
/auth/getAuth：Judge whether the user has permission the input parameter is: flag，role，uid。
/auth/getAuthListByFlag：Get the user information with a certain flag permission, the input parameter is:flag
Note: the default permission module, in order to ensure the system security, the above six interfaces of the column must be accessed in the way of white list, and cannot be called by others at will. The management page auth.html needs to be used by the system administrator. Related configurations of whitelist and administrator can be configured in /config/authconf.js.
Tars is associated with the third-party login system or the default user system login module through the configuration file /config/loginconf.js to provide the ability to allow users to log in. The login profile details are as follows:
{
enableLogin: true, //Enable login authentication or not
defaultLoginUid: 'admin', //If login authentication is not enabled, the default user is admin
redirectUrlParamName: 'redirect_url', //The name of the original URL parameter when you jump to the login URL，for example:***/login?service=***，default is: redirect_url
baseUserCenterUrl: 'http://localhost:3001', //Login jump URL (to replace localhost in the code)
baseLoginUrl: 'http://localhost:3001/login.html', //Login jump UR(userCenterUrl + loginUrl)
userCenterUrl: '', //User center login jump URL
loginUrl: '', //login url(baseLoginUrl:localhost)
logoutUrl: '',
logoutredirectUrlParamName: 'url',
ticketCookieName: 'ticket', //The name of the cookie in which the ticket information is stored
uidCookieName: 'uid', //The name of the cookie in which user information is stored
cookieDomain: '', //Domain corresponding to cookie value
ticketParamName: 'ticket', //When the third party logs in to the service callback, the URL indicates the domain corresponding to the cookie value of the ticket's parameter name
getUidByTicket: getUidByTicket, //Check and get the URL of basic user information from CAS server through ticket, or get the method of basic user information
getUidByTicketParamName: 'ticket', //Parameter name of ticket when calling get user information interface
uidKey: 'data.uid', //Results the location of the user name is taken out in JSON. Only when the user name is taken can it be considered successful. It can be multi-level
validate: validate, //URL or method to verify whether key and user name match through token and user name to CAS server
validateTicketParamName: 'ticket', //Verify the name of the ticket parameter passed in by the interface
validateUidParamName: 'uid', //Verify the user parameter name passed in by the interface
validateMatch: [
['data.result', true]
], //
ignore: ['/static'], //
ignoreIps: [], //access white ip list
apiPrefix: ['/pages/server/api'], //
apiNotLoginMes: '#common.noLogin#', //
}
Tars is associated with the third-party permission system or the default user system permission module through the configuration file /config/authconf.js to provide the ability of permission control. The details of the permission profile are as follows (the interface in and out participation in the user system permission module of point 1 above are consistent):
{
/**
* Enable custom permission module
*/
enableAuth: false,
/**
* addAuthUrl add auth
* input parameter
* @param {Array} auth auth list: {"flag": "app-server", "role": "operator", "uid": "username"}
*/
/**
* return parameter
* @param {Number} ret_code 200: succ
* @param {String} err_msg error message
*/
addAuthUrl: 'http://localhost/api/auth/addAuth',
/**
* deleteAuthUrl Delete permission URL, used to delete the permission when the service is offline
* input parameter
* @param {String} flag Permission unit, which is "application.servername" in tars
*/
/**
* return parameter
* @param {Number} ret_code 200: succ
* @param {String} err_msg error message
*/
deleteAuthUrl: 'http://localhost/api/auth/deleteAuth',
/**
* updateAuthUrl update auth url
* input parameter
* @param {String} flag Permission unit, which is "application.servername" in tars
* @param {String} role role: operator or developer
* @param {String} uid user id
*/
/**
* return parameter
* @param {Number} ret_code 200: succ
* @param {String} err_msg error message
*/
updateAuthUrl: 'http://localhost/api/auth/updateAuth',
/**
* getAuthListByUidUrl get auth list by user id
* input parameter
* @param {String} uid user id
*/
/**
* return parameter
* @param {Array} data server list
* @param {String} flag Permission unit, which is "application.servername" in tars
* @param {String} role role: operator or developer
* @param {String} uid user id
* @param {Number} ret_code 200: succ
* @param {String} err_msg error message
*/
getAuthListByUidUrl: 'http://localhost/api/auth/getAuthListByUid',
/**
* getAuthListByFlagUrl get user list by auth flag
* input parameter
* @param {String} flag Permission unit, which is "application.servername" in tars
*/
/**
* return parameter
* @param {Array} data server list
* @param {String} flag Permission unit, which is "application.servername" in tars
* @param {String} role role: operator or developer
* @param {String} uid user id
* @param {Number} ret_code 200: succ
* @param {String} err_msg error message
*/
getAuthListByFlagUrl: 'http://localhost/api/auth/getAuthListByFlag',
/**
* getAuthUrl Judge whether the user has the operation authority of the corresponding role
* @param {String} flag Permission unit, which is "application.servername" in tars
* @param {String} role role: operator or developer
* @param {String} uid user id
*/
/**
* return parameter
* @param {Object} data auth list
* @param {Boolean} result permission
* @param {Number} ret_code 200: succ
* @param {String} err_msg
*/
getAuthUrl: 'http://localhost/api/auth/getAuth'
}