Repository navigation
feat: support ClientAssertion authentication for ISV apps - #178
Open
SadMemories wants to merge 2 commits into
Open
SadMemories wants to merge 2 commits into
SadMemories wants to merge 2 commits into
Conversation
Reuse existing OAuth exchanges for ISV tenant tokens with client_credentials and tenant_key, and enable existing UAT flows. Preserve cache and retry behavior, add scoped failure logs, regression tests, and usage documentation. Change-Id: If787253e21d439e679320127fb6ae4d23dfc9f78
Change-Id: I72a453cca86d273cb05c0aaa9a1f329151d3f8d5
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| msg += f", error: {resp['error']}" | ||
| if resp.get("error_description"): | ||
| msg += f", error_description: {resp['error_description']}" | ||
| logger.warning("ISV tenant token exchange failed, aud:%s, status:%s, code:%s, msg:%s", aud, raw.status_code, resp.get("code", 0), msg) |
| msg += f", error: {resp['error']}" | ||
| if resp.get("error_description"): | ||
| msg += f", error_description: {resp['error_description']}" | ||
| logger.warning("ISV tenant token exchange failed, aud:%s, status:%s, code:%s, msg:%s", aud, raw.status_code, resp.get("code", 0), msg) |
| msg += f", error: {resp['error']}" | ||
| if resp.get("error_description"): | ||
| msg += f", error_description: {resp['error_description']}" | ||
| logger.warning("ISV tenant token exchange failed, aud:%s, status:%s, code:%s, msg:%s", aud, raw.status_code, resp.get("code", 0), msg) |
| msg = "access_token is empty" | ||
| elif int(resp.get("expires_in") or 0) <= 0: | ||
| msg = "expires_in must be positive" | ||
| logger.warning("invalid ISV tenant token response, aud:%s, msg:%s", aud, msg) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
商店应用配置 ClientAssertionProvider 后，可在调用业务 API 时使用 tenant_key 自动兑换并缓存 TAT，无需 AppSecret、AppTicket 或 AppAccessToken。
使用现有 OAuth 地址、aud 和代理路由，通过
/oauth/v3/token发送client_credentials请求，并按租户和 OAuth 地址隔离缓存。新增 ISV 响应检查；业务错误信息同时包含error和error_description，响应字段校验失败时说明具体原因，避免将无效 Token 写入缓存。复用已有 UAT 获取与刷新流程，保持自建应用、AppSecret 模式及各语言原有缓存和重试行为。
验证：运行 ClientAssertion token manager、auth、access token 三组测试，39 项通过。覆盖租户缓存隔离、代理路由、错误透出、失败响应不缓存及现有 UAT 流程。
未执行真实 Token 兑换或发送消息。