{"id":532,"date":"2026-06-15T02:00:51","date_gmt":"2026-06-15T02:00:51","guid":{"rendered":"https:\/\/hyc.eshachem.com\/program\/?page_id=532"},"modified":"2026-06-15T09:55:25","modified_gmt":"2026-06-15T09:55:25","slug":"sso-%e5%96%ae%e4%b8%80%e7%99%bb%e5%85%a5%e6%8a%80%e8%a1%93%e6%96%87%e4%bb%b6-springboot","status":"publish","type":"page","link":"https:\/\/hyc.eshachem.com\/program\/birc\/sso-%e5%96%ae%e4%b8%80%e7%99%bb%e5%85%a5%e6%8a%80%e8%a1%93%e6%96%87%e4%bb%b6-springboot\/","title":{"rendered":"SpringBoot – SSO in BIRC"},"content":{"rendered":"\n

\u672c\u6587\u4ef6\u900f\u904e\u5546\u696d\u667a\u6167\u7814\u7a76\u4e2d\u5fc3 \u2013 \u667a\u6167\u6821\u5712:\u6d3b\u52d5\u7cfb\u7d71\u4f86\u8aaa\u660e\u5546\u667a\u4e2d\u5fc3\u7684SSO\u67b6\u69cb<\/strong>\u3002<\/p>\n\n\n\n

\u5546\u667a\u4e2d\u5fc3\u7684SSO\u70ba\u81ea\u67b6\u4f3a\u670d\u5668\uff0c\u975e<\/strong>Google SSO\uff0c\u4f46\u539f\u7406\u5927\u540c\u5c0f\u7570\u3002<\/p>\n\n\n\n

\u8a72\u6587\u7ae0\u6240\u8ff0\u7a0b\u5f0f\u78bc\u7686\u63d0\u4f9b\u65bc\u6587\u7ae0\u6700\u4e0b\u65b9GitHub\u4e2d\u3002<\/p>\n\n\n\n

\n

\u7248\u672c\uff1a0.1.0
\u6700\u5f8c\u66f4\u65b0\u6642\u9593\uff1a06\/10\/2026
\u6700\u5f8c\u66f4\u65b0\u4eba\u54e1\uff1a\u9673\u6cd3\u6bd3<\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

\u6982\u8ff0<\/h2>\n\n\n\n

\u63a1\u7528 \u6388\u6b0a\u78bc\uff08Authorization Code\uff09\u4ea4\u63db<\/strong> \u6a21\u5f0f\u8655\u7406\u4e26\u9a57\u8b49\u6191\u8b49\uff1a<\/p>\n\n\n\n

\u89d2\u8272<\/th>\u8aaa\u660e<\/th><\/tr><\/thead>
SSO \u767b\u5165\u4e2d\u5fc3<\/strong><\/td>\u96c6\u4e2d\u5f0f\u8eab\u5206\u9a57\u8b49\u670d\u52d9\uff0c\u8ca0\u8cac Google \u7b49\u5916\u90e8 IdP \u767b\u5165\u3001\u6838\u767c\u4e00\u6b21\u6027\u6388\u6b0a\u78bc<\/td><\/tr>
\u7cfb\u7d71\u524d\u7aef<\/strong><\/td>\u5c0e\u5411 SSO \u767b\u5165\u3001\u63a5\u6536\u56de\u50b3\u7684 code<\/code>\u3001\u8f49\u4ea4\u5f8c\u7aef\u4ea4\u63db JWT<\/td><\/tr>
\u7cfb\u7d71\u5f8c\u7aef<\/strong><\/td>\u4ee5 Client Secret<\/code> \u5411 SSO \u9a57\u8b49 code<\/code>\u3001\u5efa\u7acb\/\u66f4\u65b0\u672c\u5730\u4f7f\u7528\u8005\u3001\u6838\u767c\u61c9\u7528\u7a0b\u5f0f JWT<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

\u8a2d\u8a08\u539f\u5247\uff1a<\/strong> Client Secret<\/code> \u50c5\u5b58\u65bc\u5f8c\u7aef\uff0c\u524d\u7aef\u6c38\u9060\u4e0d\u61c9\u76f4\u63a5\u547c\u53eb SSO \u7684 \/sso\/verify-code<\/code>\u3002(\u907f\u514d\u88abXSS)<\/p>\n\n\n\n

\n

JWT\u53ef\u53c3\u8003: https:\/\/hyc.eshachem.com\/program\/291-2\/<\/a><\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

\u6574\u9ad4\u767b\u5165\u6d41\u7a0b<\/h2>\n\n\n\n
sequenceDiagram\n    participant User as \u4f7f\u7528\u8005\n    participant FE as \u524d\u7aef\u61c9\u7528\n    participant SSO as SSO \u767b\u5165\u4e2d\u5fc3\n    participant BE as Campus Activity \u5f8c\u7aef\n    participant DB as \u8cc7\u6599\u5eab\n\n    User->>FE: \u9ede\u64ca\u300c\u767b\u5165\u300d\n    FE->>SSO: GET \/sso\/prelogin?redirect_url=[\u524d\u7aef\u56de\u547c\u7db2\u5740]\n    SSO->>User: \u986f\u793a\u767b\u5165\u9801\uff08Google \u7b49\uff09\n    User->>SSO: \u5b8c\u6210\u8eab\u5206\u9a57\u8b49\n    SSO->>FE: 302 \u8df3\u8f49\u81f3 redirect_url?code=[\u4e00\u6b21\u6027\u6388\u6b0a\u78bc]\n    FE->>BE: POST \/api\/auth-tokens\/exchange<br\/>(Header: X-Client-Token: code)\n    BE->>SSO: POST \/sso\/verify-code<br\/>(Header: X-Client-Id, X-Client-Secret | Body: code)\n    SSO-->>BE: \u50b3\u56de\u4f7f\u7528\u8005\u8cc7\u6599 (email, name, picture)\n    BE->>DB: \u67e5\u8a62\u6216\u5efa\u7acb\u4f7f\u7528\u8005\n    BE-->>FE: 200 OK<br\/>(Header: X-Auth-Token: JWT)\n    FE->>BE: \u5f8c\u7e8c API \u8acb\u6c42<br\/>(Header: Authorization: Bearer JWT)<\/pre><\/div>\n\n\n\n
\n\n\n\n
API\u8aaa\u660e<\/h2>\n\n\n\n
SSO \u767b\u5165\u5546\u667a\u4e2d\u5fc3<\/h3>\n\n\n\n
\u7aef\u9ede<\/th>\u65b9\u6cd5<\/th>\u8aaa\u660e<\/th><\/tr><\/thead>
\/sso\/prelogin<\/code><\/td>GET<\/td>\u767c\u8d77\u767b\u5165\uff0c\u53c3\u6578 redirect_url<\/code> \u70ba\u767b\u5165\u6210\u529f\u5f8c\u7684\u524d\u7aef\u56de\u547c\u7db2\u5740<\/td><\/tr>
\/sso\/verify-code<\/code><\/td>POST<\/td>\u4ee5\u6388\u6b0a\u78bc\u63db\u53d6\u4f7f\u7528\u8005\u8cc7\u8a0a\uff08\u50c5\u9650\u5f8c\u7aef\u547c\u53eb\uff09<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
verify-code \u8acb\u6c42\u683c\u5f0f\uff1a<\/strong><\/p>\n\n\n
POST {SSO_BASE_URL}\/sso\/verify-code\nContent-Type: text\/plain\nX-Client-Id: {client-id}\nX-Client-Secret: {client-secret}\n\n{code}<\/code><\/span><\/pre>\n\n\n
\u6210\u529f\u56de\u61c9\u7bc4\u4f8b\uff1a<\/strong><\/p>\n\n\n
{\n  \"email\"<\/span>: \"s12345678@ntub.edu.tw\"<\/span>,\n  \"name\"<\/span>: \"\u738b\u5c0f\u660e\"<\/span>,\n  \"picture\"<\/span>: \"https:\/\/...\"<\/span>\n}<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
\u5931\u6557\u56de\u61c9\u7bc4\u4f8b\uff1a<\/strong><\/p>\n\n\n
{\n  \"error\"<\/span>: \"invalid_or_expired_code\"<\/span>\n}<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
\u7cfb\u7d71\u5f8c\u7aef\u8655\u7406<\/h3>\n\n\n\n
API\uff1a\u4ea4\u63db Token<\/strong><\/p>\n\n\n
POST \/api\/auth-tokens\/exchange\nX-Client-Token: {SSO \u56de\u50b3\u7684 code}<\/code><\/span><\/pre>\n\n\n
\u9805\u76ee<\/th>\u8aaa\u660e<\/th><\/tr><\/thead>
\u8a8d\u8b49\u9700\u6c42<\/td>\u4e0d\u9700\u8981 Bearer Token\uff08\u516c\u958b\u7aef\u9ede\uff09<\/td><\/tr>
\u8acb\u6c42 Header<\/td>X-Client-Token<\/code>\uff1aSSO \u56de\u50b3\u7684\u4e00\u6b21\u6027\u6388\u6b0a\u78bc<\/td><\/tr>
\u6210\u529f\u56de\u61c9 Header<\/td>X-Auth-Token<\/code>\uff1a\u672c\u7cfb\u7d71\u6838\u767c\u7684 JWT<\/td><\/tr>
\u6210\u529f\u56de\u61c9 Body<\/td>{ \"message\": \"\u767b\u5165\u6210\u529f\", ... }<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u5be6\u4f5c\u4f4d\u7f6e\uff1aAuthController.exchangeToken()<\/code> \u2192 AuthServiceImpl.ssoLogin()<\/code><\/p>\n\n\n\n
\u8655\u7406\u908f\u8f2f<\/strong><\/p>\n\n\n\n
    \n
  1. \u9a57\u8b49 code<\/code> \u4e0d\u70ba\u7a7a<\/li>\n\n\n\n
  2. \u5411 SSO \/sso\/verify-code<\/code> \u767c\u9001 POST \u8acb\u6c42<\/li>\n\n\n\n
  3. \u89e3\u6790\u56de\u61c9\uff0c\u53d6\u5f97 email<\/code>\u3001name<\/code>\u3001picture<\/code><\/li>\n\n\n\n
  4. \u4f9d schoolEmail<\/code> \u67e5\u8a62\u672c\u5730\u4f7f\u7528\u8005\uff1a<\/li>\n<\/ol>\n\n\n\n