diff --git a/document/content/guide/admin/sso.en.mdx b/document/content/guide/admin/sso.en.mdx index d9ae848e6f5c..9d829a2c8f0f 100644 --- a/document/content/guide/admin/sso.en.mdx +++ b/document/content/guide/admin/sso.en.mdx @@ -32,7 +32,7 @@ Deploy using docker-compose: ```yaml fastgpt-sso: - image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.9.0 # This version must match the FastGPT image version + image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:latest container_name: fastgpt-sso restart: always networks: @@ -258,6 +258,11 @@ fastgpt-sso: ### WeCom + + After the WeCom member sync logic is updated, redeploy the `fastgpt-sso-service` relay service + using the published `latest` image. + + #### 1. Get Parameters 1. Enterprise CorpID @@ -272,7 +277,7 @@ fastgpt-sso: a. Get the app's AgentID and Secret - b. Ensure the app's visibility scope is set to all (i.e., root department) + b. The app's visibility scope determines the WeCom member sync scope. Include at least the departments that should be synchronized; to synchronize the entire enterprise, select the root department (all visible). ![](/imgs/sso8.png) @@ -310,11 +315,22 @@ fastgpt-sso: ![](/imgs/sso14.png) -#### 2. yml Configuration Example +#### 2. Use the latest image to deploy the fastgpt-sso relay service + +WeCom SSO login uses the app Secret, while member synchronization uses the Contact Sync Assistant Secret. Pull the published `latest` image and recreate the service: + +```bash +docker compose pull fastgpt-sso +docker compose up -d --force-recreate fastgpt-sso +``` + +#### 3. yml Configuration Example + +#### 3. yml Configuration Example ```yaml fastgpt-sso: - image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.9.0 + image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:latest container_name: fastgpt-sso restart: always networks: @@ -346,6 +362,13 @@ fastgpt-sso: - WECOM_SYNC_SECRET= ``` +#### 4. WeCom member sync rules + +- `/org/list` returns departments visible to the WeCom app. +- `/user/list` still retrieves members through the Contact Sync Assistant, but keeps only members who belong to at least one department visible to the app. +- A member's department list is filtered to visible departments; a member who belongs only to invisible departments is not synchronized to FastGPT. +- After changing the app visibility scope or image version, run member synchronization again. You can also call the endpoints below to verify the result first. + ### Standard OAuth 2.0 We provide OAuth 2.0 integration support using the authorization code grant from RFC 6749. @@ -501,10 +524,10 @@ LDAP_MEMBERSHIP_MODE supports four modes: | Mode | Relationship | Main configuration | | ---------------- | --------------------------------------------------------------- | ------------------------ | -| user_attribute | A user attribute, usually ou, points to an organization | LDAP_USER_ATTRIBUTE_* | -| group_member_dn | A group attribute, usually member, contains user DNs | LDAP_GROUP_MEMBER_DN_* | -| user_member_of | A user attribute, usually memberOf, contains group DNs | LDAP_USER_MEMBER_OF_* | -| posix_member_uid | A group attribute, usually memberUid, contains user identifiers | LDAP_POSIX_MEMBER_UID_* | +| user_attribute | A user attribute, usually ou, points to an organization | LDAP*USER_ATTRIBUTE*\* | +| group_member_dn | A group attribute, usually member, contains user DNs | LDAP*GROUP_MEMBER_DN*\* | +| user_member_of | A user attribute, usually memberOf, contains group DNs | LDAP*USER_MEMBER_OF*\* | +| posix_member_uid | A group attribute, usually memberUid, contains user identifiers | LDAP*POSIX_MEMBER_UID*\* | **1. user_attribute: user attribute points to an organization** diff --git a/document/content/guide/admin/sso.mdx b/document/content/guide/admin/sso.mdx index c84500fee2a8..b8436edc97b8 100644 --- a/document/content/guide/admin/sso.mdx +++ b/document/content/guide/admin/sso.mdx @@ -32,7 +32,7 @@ FastGPT-SSO-Service 是为了聚合不同来源的 SSO 和成员同步接口， ```yaml fastgpt-sso: - image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.14.16 # 目前sso最新版本，可直接使用当前版本 + image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:latest container_name: fastgpt-sso restart: always networks: @@ -256,6 +256,11 @@ fastgpt-sso: ### 企业微信 + + 企微成员同步逻辑更新后，必须重新部署 `fastgpt-sso-service` 中转服务，并使用已发布的 `latest` + 镜像。 + + #### 1. 参数获取 1. 企业的 CorpID @@ -270,7 +275,7 @@ fastgpt-sso: a. 获取应用的 AgentID 和 Secret - b. 保证这个应用的可见范围为全部（也就是根部门） + b. 应用的可见范围决定企微成员同步范围。请至少覆盖需要同步的部门；如果需要同步整个企业，请设置为根部门（全部可见）。 ![](/imgs/sso8.png) @@ -308,11 +313,20 @@ fastgpt-sso: ![](/imgs/sso14.png) -#### 2. yml 配置示例 +#### 2. 使用 latest 镜像部署 fastgpt-sso 中转服务 + +企微 SSO 登录使用应用的 Secret，成员同步使用“通讯录同步助手”的 Secret。请拉取已发布的 `latest` 镜像并重新创建服务： + +```bash +docker compose pull fastgpt-sso +docker compose up -d --force-recreate fastgpt-sso +``` + +#### 3. yml 配置示例 ```yaml fastgpt-sso: - image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.14.16 + image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:latest container_name: fastgpt-sso restart: always networks: @@ -344,6 +358,13 @@ fastgpt-sso: - WECOM_SYNC_SECRET= ``` +#### 4. 企微成员同步规则 + +- `/org/list` 返回企微应用可见范围内的部门。 +- `/user/list` 仍通过“通讯录同步助手”获取成员，但只保留至少属于一个应用可见部门的成员。 +- 成员所属部门会同步过滤为应用可见部门；只属于不可见部门的成员不会同步到 FastGPT。 +- 修改企微应用可见范围或镜像版本后，请重新执行一次成员同步；也可以先调用下方接口检查返回结果。 + ### 标准 OAuth2.0 我们提供一套 RFC 6749 中鉴权码模式的 OAuth2.0 接入支持。参考： diff --git a/pro b/pro index 1ed762aa9316..26544a3004ff 160000 --- a/pro +++ b/pro @@ -1 +1 @@ -Subproject commit 1ed762aa93161d90e92448e5a73132626798fefe +Subproject commit 26544a3004ff56b22bdc39d703a7a0340f5b2644