一、概述

本指南旨在为“浙里办”单点登录组件提供接入指南，“浙里办”单点登陆组件，上架在IRS，为上架在IRS的应用，提供统一的单点登录解决方案，现阶段仅支持微信端的接入。

二、服务创建

3、应用接入“浙里办”单点登录组件前，需要先获取AK&SK。

三、接入说明

四、接入规范

1. 接入“浙里办”微信小程序的 H5 应用（以下简称应用）， 应当符合“同源发布”及无障碍适老化等要求。
2. 应用应当在浙江省一体化数字资源系统（以下简称 IRS）发布，并使用统一的域名 https://mapi.zjzwfw.gov.cn/，作为接入微信小程序的前置条件。应用上架 IRS，应遵循 IRS 相关规范。
3. 应用接入“浙里办”微信小程序，应当按照本指南操作步骤与注意事项，进行微信端的兼容适配。

五、操作步骤

“浙里办”微信小程序接入工作流程图：

1、单点登录适配 

Java代码案例：

（1）Constants  定义所有常量

/*** @author jie.chen* @date 2022-03-30 15:24*/
public interface Constants {/*** 单点登录 ticketId换token的地址*/
//    String ACCESS_TOKEN_URL = "https://bcdsg.zj.gov.cn:8443/restapi/prod/IC33000020220329000007/uc/sso/access_token";政务外网//互联网String ACCESS_TOKEN_URL = "https://ibcdsg.zj.gov.cn:8443/restapi/prod/IC33000020220329000007/uc/sso/access_token";/*** 单点登录 token获取用户信息地址*/
//    String GET_USER_INFO_URL = "https://bcdsg.zj.gov.cn:8443/restapi/prod/IC33000020220329000008/uc/sso/getUserInfo";政务外网//互联网String GET_USER_INFO_URL = "https://ibcdsg.zj.gov.cn:8443/restapi/prod/IC33000020220329000008/uc/sso/getUserInfo";/*** IRS请求携带的请求头*/String X_BG_HMAC_ACCESS_KEY = "X-BG-HMAC-ACCESS-KEY";String X_BG_HMAC_SIGNATURE = "X-BG-HMAC-SIGNATURE";String X_BG_HMAC_ALGORITHM = "X-BG-HMAC-ALGORITHM";String X_BG_DATE_TIME = "X-BG-DATE-TIME";/*** IRS签名算法*/String DEFAULT_HMAC_SIGNATURE = "hmac-sha256";/*** 应用ID*/String APP_ID = "20******33";/*** 微信端固定值为weixin*/String WEIXIN_ENDPOINT_TYPE = "weixin";/*** IRS 申请组件生成的AK*/String IRS_AK = "********************************";/*** IRS 申请组件生成的SK*/String IRS_SK = "********************************";String TOKEN_SESSION_KEY = "sessionAccessToken";String USER_INFO_KEY = "sessionUserInfo";}

（2）IrsUtils

/*** @author jie.chen* @date 2022-03-30 15:28*/
public class IrsUtils {@SneakyThrowspublic static IrsSignRes sign(String url, String method) {UriComponents uriComponents = UriComponentsBuilder.fromHttpUrl(url).build();uriComponents = uriComponents.encode();List queryArr = new ArrayList<>();MultiValueMap queryParams = uriComponents.getQueryParams();for (Map.Entry> next : queryParams.entrySet()) {for (String va : next.getValue()) {if (va == null) {queryArr.add(next.getKey() + "=");} else {queryArr.add(next.getKey() + "=" + va);}}}//按照字典排序Collections.sort(queryArr);///Tue, 09 Nov 2021 08:49:20 GMTDateFormat dateFormat = new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss z", Locale.US);dateFormat.setTimeZone(TimeZone.getTimeZone("GMT"));String dateTime = dateFormat.format(new Date());String signStr = method.toUpperCase() + "\n" +//拼接url pathuriComponents.getPath() + "\n" +//拼接url queryString.join("&", queryArr) + "\n" +Constants.IRS_AK + "\n" +dateTime + "\n";String sign = hmacSha256Base64(signStr, Constants.IRS_SK);IrsSignRes res = new IrsSignRes();res.setSignature(sign);res.setAccessKey(Constants.IRS_AK);res.setDateTime(dateTime);res.setAlgorithm(Constants.DEFAULT_HMAC_SIGNATURE);return res;}@SneakyThrowsprivate static String hmacSha256Base64(String content, String key) {Mac hmacSHA256 = Mac.getInstance("HmacSHA256");SecretKeySpec secretKey = new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256");hmacSHA256.init(secretKey);byte[] bytes = hmacSHA256.doFinal(content.getBytes(StandardCharsets.UTF_8));return Base64.getEncoder().encodeToString(bytes);}public static void main(String[] args) {System.out.println(sign("https://bcdsg.zj.gov.cn:8443/restapi/prod/IC33000020220329000007/uc/sso/getUserInfo", "POST"));}}

（3）IrsSignRes

/*** @author jie.chen* @date 2022-03-30 15:28*/
@Data
public class IrsSignRes {private String accessKey;private String signature;private String algorithm;private String dateTime;
}

（4）AuthService 业务实现类

/*** @author jie.chen* @date 2022-03-30 15:49*/
@Component
public class AuthService {@Autowiredprivate RestTemplateBuilder restTemplateBuilder;private RestTemplate restTemplate;@PostConstructvoid init() {restTemplate = restTemplateBuilder.build();}public String getTokenByTicketId(String ticketId) {HttpHeaders headers = getHttpHeaders(Constants.ACCESS_TOKEN_URL);JSONObject body = new JSONObject();body.put("appId", Constants.APP_ID);body.put("ticketId", ticketId);HttpEntity> request = new HttpEntity<>(body, headers);ResponseEntity stringResponseEntity = restTemplate.postForEntity(Constants.ACCESS_TOKEN_URL, request, String.class);return checkResponse(stringResponseEntity).getJSONObject("data").getString("accessToken");}public JSONObject getUserInfoByToken(String accessToken) {HttpHeaders headers = getHttpHeaders(Constants.GET_USER_INFO_URL);JSONObject body = new JSONObject();body.put("token", accessToken);HttpEntity> request = new HttpEntity<>(body, headers);ResponseEntity stringResponseEntity = restTemplate.postForEntity(Constants.GET_USER_INFO_URL, request, String.class);return checkResponse(stringResponseEntity).getJSONObject("data");}private JSONObject checkResponse(ResponseEntity stringResponseEntity) {if (!stringResponseEntity.getStatusCode().is2xxSuccessful()) {//请求失败throw new RuntimeException("status:" + stringResponseEntity.getStatusCodeValue() + " " + stringResponseEntity.getBody());}JSONObject result = JSON.parseObject(stringResponseEntity.getBody());if (result.containsKey("errorCode") && result.getString("errorCode") != null && !result.getBooleanValue("success")) {//业务错误throw new RuntimeException(result.toString());}return result;}private HttpHeaders getHttpHeaders(String url) {IrsSignRes res = IrsUtils.sign(url, "POST");HttpHeaders headers = new HttpHeaders();headers.add(Constants.X_BG_HMAC_ACCESS_KEY, res.getAccessKey());headers.add(Constants.X_BG_HMAC_ALGORITHM, res.getAlgorithm());headers.add(Constants.X_BG_HMAC_SIGNATURE, res.getSignature());headers.add(Constants.X_BG_DATE_TIME, res.getDateTime());return headers;}

（5）LoginController 接口测试

/*** @author hejun* @since 2022-02-22 10:46:11*/
@RestController
@RequestMapping("/user")
@Api(tags="用户登录")
@Slf4j
public class LoginController extends ProBaseController {@GetMapping(value = "zlbWxLoginTest")@ApiOperation(value = "测试浙里办微信小程序登录接口", notes = "测试浙里办微信小程序登录接口后端接口")public String zlbWxLoginTest(@RequestParam @ApiParam(name = "st", value = "浙里办 ticketId", required = true)String st) {try {return buildResultStr(buildSuccessResultData(userService.getUserBeanByTicketId(st)));}catch (Exception e) {logError(log, e);return buildResultStr(buildErrorResultData(e.getMessage()));}}
}

(6) UserServiceImpl 浙里办用户体系转换

/*** 用户表(User)表服务实现类** @author hejun* @since 2022-02-22 10:02:16*/
@Service("userService")
@Slf4j
public class UserServiceImpl implements UserService {@Autowiredprivate AuthService authService;@Overridepublic UserBean getUserBeanByTicketId(String ticketId){UserBean userBean = new UserBean();//1. 通过ticketId 换取 accessTokenString token = authService.getTokenByTicketId(ticketId);//3. 通过accessToken 获取用户信息JSONObject userInfo = authService.getUserInfoByToken(token);JSONObject personInfo = userInfo.getJSONObject("personInfo");String phone = personInfo.get("phone").toString();userBean.setMobile(phone);userBean.setUsername(personInfo.get("userName").toString());userBean.setIdnum(personInfo.get("idNo").toString());userBean.setUserid(personInfo.get("userId").toString());String login = null;if (StringUtils.isNotNullString(phone)){login = this.login(phone);userBean.setToken(login);log.info("token------------------------------", login);}return userBean;}/*** 通过手机号登录** @return token*/@Overridepublic String login(String phone) {User user = this.getUserByPhone(phone);if (user == null){user = new User();user.setMobile(phone);this.insert(user);}//生成tokenString token = getUserRsid(phone);token = token.replaceAll("/","_");//token放入缓存JedisUtils.setObject(token,user,portalRsidCacheSeconds);//返回tokenreturn token;}}

六、接口调用方式

请以POST方式提交请求，参数以application/json形式提交。

1. 1. 鉴权参数说明

“浙里办”单点登录，HTTP请求都必须在请求头（HTTP Header）中设置如下4个参数：

其中X-BG-HMAC-SIGNATURE的计算公式为：

各字段解释如下：

1. secret_key为接口申请完成后获取到的secret_key
2. signing_string由请求方法、URI、请求参数等拼接获得，具体如下：

参数解释如下图，详细代码可参考签名计算代码

• 接口说明
  1. 基于单点登录票据换取请求token

1. 1. 请求地址

 /uc/sso/access_token

1. 1. 入参

1. 1. 出参

1. 1. 错误码

1. 1. 基于token获取用户信息
2. 请求地址

/uc/sso/getUserInfo

1. 入参

1. 出参

1. 错误码