Since API version 6.1.0(23), enterprise authentication and enterprise app token obtaining are supported.
Enterprise Space Kit provides the enterprise account authentication capability for enterprise apps. Enterprise user account authentication is implemented during the initialization of the enterprise space. In addition, the capability of obtaining enterprise app tokens is supported.
For details about these APIs, please refer to the API Reference.
| API | Description |
|---|---|
| authenticate(enterpriseAuthInfo: WorkspaceDomainInfo, credential: Uint8Array): Promise<AuthResult> | Authenticates an enterprise account and returns the result. |
| getAccessToken(businessParams: Record<string, string>): Promise<Uint8Array> | Obtains an enterprise app token and returns the result. |
import { spaceManager } from '@kit.EnterpriseSpaceKit';
import { hilog } from '@kit.PerformanceAnalysisKit'; const TAG = '[Sample_SpaceManagerSample]';
const DOMAIN = 0xF811;
export class WorkspaceCertificationApi {
static async authenticate(enterpriseAuthInfo: spaceManager.WorkspaceDomainInfo,
credential: Uint8Array): Promise<spaceManager.AuthResult | undefined> {
try {
const authResult: spaceManager.AuthResult = await spaceManager.authenticate(enterpriseAuthInfo, credential);
hilog.info(DOMAIN, TAG, `Succeeded in authenticating. Auth result is: ` + JSON.stringify(authResult));
return authResult;
} catch (err) {
hilog.error(DOMAIN, TAG, `Failed to authenticate. Code: ${err.code}, message: ${err.message}`);
return undefined;
}
}
static async getAccessToken(params: Record<string, string>): Promise<Uint8Array | undefined> {
try {
const result: Uint8Array = await spaceManager.getAccessToken(params);
hilog.info(DOMAIN, TAG, `Succeeded in getting access token. Result is: ` + JSON.stringify(result));
return result;
} catch (err) {
hilog.error(DOMAIN, TAG,`Failed to get access token. Code: ${err.code}, message: ${err.message}`);
return undefined;
}
}
} import { router } from '@kit.ArkUI';
import { osAccount } from '@kit.BasicServicesKit';
import { spaceManager } from '@kit.EnterpriseSpaceKit';
import { hilog } from '@kit.PerformanceAnalysisKit';
import { WorkspaceCertificationApi } from '../api/WorkspaceCertificationApi' const TAG = '[Sample_SpaceManagerSample]';
const DOMAIN = 0xF811;
enum AuthModeType {
SASL = 'SASL',
}
enum CertifiedProtocolType {
GSSAPI = 'GSSAPI/Kerberos',
OAUTH2 = 'OAuth 2.0',
}
enum LdapEncryptMode {
LDAP = 'LDAP',
LDAPS = 'LDAPS',
LDAP_STARTTLS = 'LDAP STARTTLS',
}
enum ServerType {
NONE = '',
LDAP = 'LDAP',
AD = 'AD',
IDaaS = 'IDaaS',
}
type ADConfig = Record<string, string>;
type LDAPConfig = Record<string, string>;
type OAuthConfig = Record<string, string>;
type IDaaSConfig = Record<string, string | OAuthConfig>;
type ServerConfigParams = Record<string, string | ADConfig | LDAPConfig | IDaaSConfig>;
type ServerConfig = Record<string, string | ServerConfigParams>;
@Entry
@Component
struct WorkspaceCertificationPage {
/**
* Obtain the IDaaS server configuration.
* @returns
*/
public getIDaaSServerConfig(): ServerConfig {
const idaasConfigData: IDaaSConfig = {
'authProtocol': 'OAuth 2.0',
'oauthConfig': {
'userAuthenRequestUri': 'iDaaSUserAuthUrl',
'authorizationRequestUri': 'iDaaSAuthUrl',
'tokenRequestUri': 'iDaaSTokenUrl',
'userInfoRequestUri': 'iDaaSUserUrl',
'clientId': 'iDaaSClientID',
'clientSecret': 'iDaaSClientSecret',
'scope': 'iDaaSScope',
'accountIdAttributeName': 'iDaaSAccountID',
'accountNameAttributeName': 'iDaaSAccountName',
},
};
const parameters: ServerConfigParams = {
'serverType': ServerType.IDaaS,
'idaasConfig': idaasConfigData,
};
const serverConfig: ServerConfig = {
'parameters': parameters,
};
return serverConfig;
}
/**
* Obtaining the LDAP server configuration.
* @returns
*/
private getLDAPServerConfig(): ServerConfig {
const ldapConfig: LDAPConfig = {
'authServerAddress': 'domainName',
'authenMode': AuthModeType.SASL,
'authenProtocol': CertifiedProtocolType.GSSAPI,
'kdcAddress': 'kdcAddress',
'accountIdAttributeName': 'accountId',
'accountNameAttributeName': 'accountName',
'encryptMode': LdapEncryptMode.LDAP,
'ldapPort': 'portNum',
'baseDN': 'baseDN',
};
if (ldapConfig['encryptMode'] !== LdapEncryptMode.LDAP) {
ldapConfig['kdcAddress'] = '';
}
const parameters: ServerConfigParams = {
'ldapConfig': ldapConfig,
};
const serverConfig: ServerConfig = {
'authServerName': ldapConfig['authServerAddress'],
'parameters': parameters,
};
return serverConfig;
}
/**
* Obtain the AD server configuration.
* @returns
*/
private getADServerConfig(): ServerConfig {
const adConfig: ADConfig = {
'adDomain': 'domainName',
'authenMode': AuthModeType.SASL,
};
const parameters: ServerConfigParams = {
'adConfig': adConfig,
};
const serverConfig: ServerConfig = {
'authServerName': 'domainName',
'parameters': parameters,
};
return serverConfig;
}
private getServiceConfig(serverType: string): ServerConfig {
let serverConfig: ServerConfig;
if (serverType === ServerType.IDaaS) {
serverConfig = this.getIDaaSServerConfig();
} else if (serverType === ServerType.LDAP) {
serverConfig = this.getLDAPServerConfig();
} else {
serverConfig = this.getADServerConfig();
}
return serverConfig;
}
async authenticate() {
let serverType = ServerType.AD;
let serverConfig: ServerConfig = this.getServiceConfig(serverType); // Set the configuration parameters of the corresponding domain server.
let serverConfigId: string = 'serverConfigId';
try {
//Bind a domain server.
await osAccount.DomainServerConfigManager.addServerConfig(serverConfig);
//Obtain the domain server ID.
let servers: osAccount.DomainServerConfig[] = await osAccount.DomainServerConfigManager.getAllServerConfigs();
servers.forEach((server) => {
// Filter out non-target servers.
serverConfigId = server.id;
});
} catch (err) {
hilog.error(DOMAIN, TAG, `Failed to config domain server. Code: ${err.code}, message: ${err.message}`);
}
const enterpriseAuthInfo: spaceManager.WorkspaceDomainInfo = {
domain: 'testDomain', // Domain name.
workspaceName: 'testAccountName', // Workspace domain account name.
serverConfigId: serverConfigId // Server configuration ID of the workspace domain, which is generated locally after the domain server is bound.
};
const credential = new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0]); // Example: ASCII code of an employee password.
const authResult: spaceManager.AuthResult | undefined =
await WorkspaceCertificationApi.authenticate(enterpriseAuthInfo, credential);
if (authResult === undefined) {
// Handle exceptions.
hilog.error(DOMAIN, TAG, 'Failed to authenticate!');
return;
}
// Process the post-logic.
}
async getAccessToken() {
const params: Record<string, string> = {
'clientId': 'test1' // Service parameter, which is customized by the service provider based on the request protocol. It is the unique identifier of an enterprise app on the domain server.
};
const result: Uint8Array | undefined =
await WorkspaceCertificationApi.getAccessToken(params); // One-time authorization code obtained from the domain server. The authorization code can be used to directly interact with the domain server.
if (result === undefined) {
// Handle exceptions.
hilog.error(DOMAIN, TAG, 'Failed to get access token!');
return;
}
// Process the post-logic.
}
build() {
Column() {
Row() {
Button($r('app.string.authenticate'))
.buttonCommonStyle()
.onClick(() => {
this.authenticate();
})
}
Row() {
Button($r('app.string.getAccessToken'))
.buttonCommonStyle()
.onClick(() => {
this.getAccessToken();
})
}
Row() {
Button($r('app.string.back'))
.buttonCommonStyle()
.onClick(() => {
router.back();
})
}
}
}
}
@Extend(Button)
function buttonCommonStyle() {
.width(200)
.height(50)
.backgroundColor('#6366F1')
.fontColor('#FFFFFF')
.fontSize(14)
.margin({ left: 20, bottom: 5 })
}