Repository navigation
fix: adapt custom protocol to jms2:// for JumpServer v5 - #384
Closed
zy84338719 wants to merge 1 commit into
Closed
zy84338719 wants to merge 1 commit into
zy84338719 wants to merge 1 commit into
Conversation
JumpServer v5 moved the custom scheme from `jms` to `jms2`. The server registers `jms2://auth/callback` as the only OAuth redirect URI and ships it in ALLOWED_REDIRECT_URI_SCHEMES, so `jms://auth/callback` is rejected with `invalid_request / Mismatching redirect URI`. The redirect/confirm endpoint also treats `jms://` as an invalid next url, and connection links are now issued as `jms2://<base64>`. With the client still emitting `jms://`, OAuth login cannot complete against a v5 server, and connection links issued by the server never reach the app because the `jms` protocol handler is not registered. Changes: - `oauth_redirect_uri()` now returns `jms2://auth/callback` in release. - `tauri.conf.json` registers `jms2` as the deep-link scheme, so the OS routes `jms2://` links to the app. - `is_auth_callback` and the single-instance argv filter accept both schemes, so links already persisted by older installs still resolve. - Windows installers register `jms2` and remove the stale `jms` registration and its UserChoice cache on upgrade. - `awaken` (Go) trims either scheme prefix. - READMEs document `jms2://`.
Member
|
No，新版本客户端在 https://github.com/jumpserver/luna 中，当前只适用于 v4 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
The client cannot complete OAuth login against a JumpServer v5 server, and connection links issued by the server never reach the app.
Reproduced against
JumpServer CE v5.0.0-ce:根因
JumpServer v5 changed the custom scheme from
jmstojms2, but the client still emits and registersjms:jumpserver/settings/libs.pyOAUTH2_PROVIDER_CLIENT_REDIRECT_URI = 'jms2://auth/callback'ALLOWED_REDIRECT_URI_SCHEMES['https', 'jms2']authentication/api/connection_token.py'url': 'jms2://{}'.format(protocol_data)jumpserver/tests/test_redirect_confirm.pyjms://auth/callback列为 非法 next urldjango-oauth-toolkit 3.4.1 校验
redirect_uri时先查 scheme 白名单、再要求与注册的 URI 完全相等，两道关都只放行jms2，因此客户端发出的jms://auth/callback必然被拒。同时，因为客户端只注册了
jms协议，服务端下发的jms2://<base64>连接链接系统也无法路由到应用。改动
src-tauri/src/service/oauth.rs— release 模式oauth_redirect_uri()返回jms2://auth/callbacksrc-tauri/tauri.conf.json— deep-link 注册的 scheme 改为jms2，使系统把jms2://链接交给应用src-tauri/src/utils.rs—is_auth_callback改为按 scheme 列表判断；新增is_deep_link供 single-instance 过滤使用，两者同时接受jms2与jmssrc-tauri/src/lib.rs— single-instance 的 argv 过滤改用is_deep_linksrc-tauri/windows/hooks.nsh、fragments/user-data-and-protocol.wxs— 注册jms2，并在升级时清理残留的jms注册项与 UserChoice 缓存（先确认该jms注册确实指向本安装目录再删，避免误删其他应用接管的注册）go-client/cmd/awaken/awaken.go—trimDeepLinkScheme剥离任一 scheme 前缀README.md/README_CN.md— 文档更新为jms2://保留
jms解析是为了向后兼容：用户升级前浏览器书签、脚本里已有的jms://链接仍能唤醒应用，而服务端 v5 不会再下发新的jms://连接链接。验证
go build ./cmd/awaken/通过（CGO_ENABLED=0 GOOS=darwin GOARCH=arm64）rustc --edition 2021编译并运行，13 个用例全部通过（覆盖jms2/jms双 scheme、大小写 host、非 scheme 链接、畸形输入）rustfmt --check通过；tauri.conf.jsonJSON 校验通过redirect_uri=jms2://auth/callback返回 302 并正常进入授权确认页，jms://返回 400cargo check：构建环境无法为 git 依赖创建仓库模板（libgit2hooks/README.sample权限受限），与本次改动无关。CI 会覆盖完整编译。