sso优化

src/Jiaowu.Api/Program.cs

@@ -104,12 +104,18 @@ if (ssoOptions.Enabled &&
      ssoAuthority.Scheme is not ("http" or "https") ||
      (ssoOptions.RequireHttpsMetadata && ssoAuthority.Scheme != "https") ||
      string.IsNullOrWhiteSpace(ssoOptions.UserNameClaim) ||
+     (!string.IsNullOrWhiteSpace(ssoOptions.CallbackUrl) &&
+      (!Uri.TryCreate(ssoOptions.CallbackUrl, UriKind.Absolute, out var callbackUrl) ||
+       callbackUrl.Scheme is not ("http" or "https") ||
+       !callbackUrl.AbsolutePath.EndsWith(
+           "/signin-keycloak",
+           StringComparison.OrdinalIgnoreCase))) ||
      (!string.IsNullOrWhiteSpace(ssoOptions.FrontendBaseUrl) &&
       (!Uri.TryCreate(ssoOptions.FrontendBaseUrl, UriKind.Absolute, out var frontendBaseUrl) ||
        frontendBaseUrl.Scheme is not ("http" or "https")))))
 {
     throw new InvalidOperationException(
-        "启用 Sso 时必须配置有效的 Authority、ClientId、UserNameClaim 和 FrontendBaseUrl；生产元数据地址必须使用 HTTPS。");
+        "启用 Sso 时必须配置有效的 Authority、ClientId、UserNameClaim、CallbackUrl 和 FrontendBaseUrl；CallbackUrl 必须以 /signin-keycloak 结尾，生产元数据地址必须使用 HTTPS。");
 }
 
 if (string.IsNullOrWhiteSpace(officialDocumentOptions.InstitutionName) ||
@@ -490,6 +496,12 @@ if (ssoOptions.Enabled)
             ssoOptions.UserNameClaim,
             ssoOptions.UserNameClaim);
         options.TokenValidationParameters.NameClaimType = ssoOptions.UserNameClaim;
+        options.Events.OnRedirectToIdentityProvider = context =>
+        {
+            if (!string.IsNullOrWhiteSpace(ssoOptions.CallbackUrl))
+                context.ProtocolMessage.RedirectUri = ssoOptions.CallbackUrl;
+            return Task.CompletedTask;
+        };
         options.Events.OnRemoteFailure = context =>
         {
             context.HandleResponse();