边缘应用账号权限对接

1.对接目标

1.云端：提供云端的SDK API给到ISV用于管理态的应用权限和人员授权的管理。2.同步：平台通过云->边同步机制，把云端的应用的权限和人员的授权关系同步到边缘集群。3.边侧：提供边侧的SDK API给到ISV用于运行态的边侧人员权限校验。

2.接入构造说明

接入方是一个大租户（tenantId）每个项目是一个隔离（scopeId）每个项目会有个边缘集群（cluster）每个边缘集群会有多个应用（application）权限，人员，权限，空间等应用的数据都是tenantId+scopeId隔离内，云边同步的数据范围也是tenantId+scopeId

3.API接口调用

3.1 云端API

现有云端API文档：https://dev.iot.aliyun.com/api_center权限管理服务部分。

3.1.1 创建权限接口

接口描述

入参说明

具体复杂数组可参照接口文档：创建权限接口

出参列表

请求示例

     /**
     * 系统环境变量中获取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //设置api的版本
    request.setApiVer("0.0.3");


    //如果需要登录，设置当前的会话的token
    request.setIotToken("xxxxxxxxxxxxxxx");

  // 接口参数
    request.putParam("permissions","value1");

    //请求参数域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回结果示例 JSON

{
    "id": "c996a414-45ce-4010-b9a5-88038342d50a",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失败返回结果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.2 创建角色接口

接口描述

入参说明

具体复杂数组可参照接口文档：创建角色接口

出参列表

请求示例

     /**
     * 系统环境变量中获取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //设置api的版本
    request.setApiVer("0.0.3");


    //如果需要登录，设置当前的会话的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口参数
    request.putParam("roles","value1");

    //请求参数域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回结果示例 JSON

{
    "id": "d13e1f27-b24a-4be7-9c5e-b452da6f4430",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失败返回结果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.3 删除角色接口

接口描述

入参说明

具体复杂数组可参照接口文档：删除角色接口

出参列表

请求示例

     /**
     * 系统环境变量中获取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //设置api的版本
    request.setApiVer("0.0.3");


    //如果需要登录，设置当前的会话的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口参数
    request.putParam("roles","value1");

    //请求参数域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回结果示例 JSON

{
    "id": "6c8977f8-c31e-46ef-81da-9244759e13c6",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失败返回结果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.4 批量给角色关联权限接口

接口描述

入参说明

具体复杂数组可参照接口文档：批量给角色关联权限接口

出参列表

请求示例

     /**
     * 系统环境变量中获取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //设置api的版本
    request.setApiVer("0.0.3");


    //如果需要登录，设置当前的会话的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口参数
    request.putParam("roles","value1");
    request.putParam("permissions","value2");

    //请求参数域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回结果示例 JSON

{
    "id": "7a31b6a5-91f8-422c-907e-7434918f5869",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失败返回结果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.5 批量移除角色权限接口

接口描述

入参说明

具体复杂数组可参照接口文档：批量从identity移除权限接口

出参列表

请求示例

     /**
     * 系统环境变量中获取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //设置api的版本
    request.setApiVer("0.0.3");


    //如果需要登录，设置当前的会话的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口参数
   request.putParam("identityId","value1");
    request.putParam("permissions","value2");
    //请求参数域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回结果示例 JSON

{
    "id": "7a31b6a5-91f8-422c-907e-7434918f5869",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失败返回结果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.6 批量给identity授予角色接口

接口描述

入参说明

具体复杂数组可参照接口文档：批量给identity授予角色接口

出参列表

请求示例

     /**
     * 系统环境变量中获取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //设置api的版本
    request.setApiVer("0.0.3");


    //如果需要登录，设置当前的会话的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口参数
   request.putParam("identityId","value1");
    request.putParam("roles","value2");

    //请求参数域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回结果示例 JSON

{
    "id": "7a31b6a5-91f8-422c-907e-7434918f5869",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失败返回结果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.7 批量给identity移除角色接口

接口描述

入参说明

具体复杂数组可参照接口文档：批量从identity移除角色接口

出参列表

请求示例

     /**
     * 系统环境变量中获取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //设置api的版本
    request.setApiVer("0.0.3");


    //如果需要登录，设置当前的会话的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口参数
   request.putParam("identityId","value1");
    request.putParam("roles","value2");

    //请求参数域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回结果示例 JSON

{
    "id": "7a31b6a5-91f8-422c-907e-7434918f5869",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失败返回结果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

地产平台通过封装LP云边同步能力，对外开放如下API：1、获取边缘集群列表2、数据同步预检查3、触发数据同步4、数据同步结果查询

3.2.1接口定义

分页参数会出现在请求参数和返回结果中，用于下文中API调用参照。

• 在请求参数中代表请求分页的页数（pageNo）和每页的记录数（pageSize）；

• 在响应结果中的页数（pageNo）和每页的记录数（pageSize）与请求参数一致，同时还有total字段代表数据总数。

所有的分页接口除特殊说明外，都遵循下面的约束

获取集群列表

接口定义

入参

出参

分页数据对象ClusterDTOList

示例

请求示例

{
  "pageNo":1,
  "pageSize":20
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data":{
    "pageNo": 1,
    "pageSize": 20,
    "total": 10,
      "data":[{
        "id": "xxx",
      "name": "cluster01",
        "gmtCreate": "2020-03-04 18:00:00",
        "gmtModified": "2020-03-04 18:00:00"
        }]
    }
}

数据同步预检查

接口定义

入参

出参

示例

请求示例

{
  "clusterId": "xxx",
  "opsType": "SYNC_DATA",
  "dataTypeList": [
      "ACCOUNT",
    "SPACE"
    "RTPC"
    "ALARM"
  ]
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data": "XXX"
}

触发数据同步

接口定义

入参

出参

示例

请求示例

{
  "clusterId": "xxx",
  "opsType": "SYNC_DATA",
  "dataTypeList": [
      "ACCOUNT",
    "SPACE"
  ]
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data": "XXX"
}

根据数据同步请求查询结果

接口定义

入参

出参

示例

请求示例

{
  "clusterId": "xxx",
  "opsType": "SYNC_DATA",
  "dataTypeList": [
      "ACCOUNT",
    "SPACE"
  ]
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data": {
    "dataSyncStatus": "SUCCESS",
    "preCheckResult": "NO",
    "taskGroupId": "XXX"
  }
}

根据任务组查询数据同步结果

接口定义

入参

出参

示例

请求示例

{
  "clusterId": "xxx",
  "opsType": "SYNC_DATA",
  "dataTypeList": [
      "ACCOUNT",
    "SPACE"
  ]
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data": "SUCCESS"
}

3.3 边缘端API

变成服务对接，遵循服务模型API对接规范。

3.3.1 API对接规范

请求头

Host: ****.com
Date: Mon, 22 Aug 2016 11:21:04 GMT
User-Agent: Apache-HttpClient/4.1.2 (java 1.6)
Content-Type: application/json; charset=utf-8
//请求体类型，请根据实际请求体内容设置。
Accept: application/json 
//请求响应体类型，部分 API 可以根据指定的响应类型来返回对应数据格式，建议手动指定此请求头，如果不设置，部分 HTTP 客户端会设置默认值 */*，导致签名错误。
X-Ca-Request-Mode: debug 
//是否开启 Debug 模式，大小写不敏感，不设置默认关闭，一般 API 调试阶段可以打开此设置。
X-Ca-Signature-Headers: X-Ca-Request-Mode,X-Ca-Version,X-Ca-Stage,X-Ca-Key,X-Ca-Timestamp 
//参与签名的自定义请求头，服务端将根据此配置读取请求头进行签名，此处设置不包含 Content-Type、Accept、Content-MD5、Date 请求头，这些请求头已经包含在了基础的签名结构中，详情参照请求签名说明文档。
X-Ca-Key: 6002****  
//请求的 AppKey
X-Ca-Timestamp: 147186486**** 
//请求的时间戳，值为当前时间的毫秒数，也就是从1970年1月1日起至今的时间转换为毫秒，时间戳有效时间为15分钟。
X-Ca-Nonce:b931bc77-645a-4299-b24b-f3669be5****  
//请求唯一标识，15分钟内 AppKey+API+Nonce 不能重复，与时间戳结合使用才能起到防重放作用。
X-Ca-Signature: FJleSrCYPGCU7dMlLTG+UD3Bc5Elh3TV3CWHtSKh1Ys= 
//请求签名。

响应状态码

400  
//响应状态码，大于等于200小于300表示成功；大于等于400小于500为客户端错误；大于500为服务端错误。

响应头

Content-Type: application/json; charset=utf-8
//响应体类型，请根据实际请求体内容设置
X-Ca-Error-Message: Invalid Url  
//主要处理应用容器非业务异常的错误信息处理
X-Ca-Debug-Info: {"ServiceLatency":0}  
//当打开 Debug 模式后会返回 Debug 信息，此信息后期可能会有变更，仅用做联调阶段参考

请求Body部分

协议

request 属性

API示例

## API 名称删除人脸模型
## 名称：DeleteModel
## 路径：/facade/model/delete
## 版本：1.0.0
## 请求参数
{
    "request": {
        "apiVer": "1.0.0"
    },
    "id": "BRC-155193021****",
    "params": {
        "modelId": "d80c6c551cee4d78beb3f8259a3feba4"
    },
    "version": "1.0"
}

## 返回示例
{
    "id": "BRC-155193021****",
    "code": 200,
    "data": 2,
    "message": ""
}

代码请求示例：

public static void main(String[] args) throws UnsupportedEncodingException {
IoTApiClientBuilderParams ioTApiClientBuilderParams =
new IoTApiClientBuilderParams();
ioTApiClientBuilderParams.setAppKey("28282004");
ioTApiClientBuilderParams.setAppSecret("dcbab9388216c6479b69906565d28f93");
SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);
String path = "/app/user/info/get";
IoTApiRequest request = new IoTApiRequest();
request.setApiVer("1.0.0");
Map<String, Object> params = new HashMap<>(4);
// 接口参数
params.put("appId", "4febf37ae01048509cc8136f3ad19926");
params.put("tenantSubUserId", "");
params.put("userId", "2088954581022991");
request.setParams(params);
request.setVersion("1.0");
//请求参数域名、path、request
ApiResponse response = syncClient.postBody("api.link.aliyun.com",
path, request, true);
System.out.println("response code = " + response.getCode()
+ " response = " + new String(response.getBody(), "UTF-8"));

3.3.2 权限校验

API 权限验证名称：authenIdentityPerm路径：/user/rbac/identity/authenperm版本：1.0.0

请求参数

    {
        "request": {
            "apiVer": "1.0.0"
        },
        "id": "BRC-155193021****",
        "params": {
            "identityId":"身份ID",
            "actionCode":"资源操作-比如应用权限",
            "resCode":"资源ID-比如应用ID"
       },
     "version": "1.0"
    }

返回示例

    {
    "id": "BRC-155193021****",
    "code": 200,         #响应码, 200: 成功
    "message": "",     #错误消息
    "data": **true**     #是否有权限
}

3.3.3 查询账号所有权限

API 权限验证名称：queryIdentityAllPermission路径：/user/rbac/identity/queryallpermission版本：1.0.0

请求参数

    {
      "request": {
           "apiVer": "1.0.0"
       },
        "id": "BRC-155193021****",
        "params": {
           "identityId":"身份ID"
     },
    "version": "1.0"
}

返回示例

 {
    "id": "1718af5d-5528-4cc6-b0c5-eba636444091",
    "code": 200,
    "message": **null**,
    "localizedMsg": **null**,
    "data": [
       {
    "actionCode": "open",
    "actionDesc": "开",
    "cronExpression": "* * * ? * 1-5 *",
    "effectiveTime": 155801997****,
    "expireTime": 155802357****,
     "bizTag1": "标签A",
     "bizTag2": "标签B",
     "bizTag3": **null**,
    "permissionDesc": "备注",
    "permissionName": "园区正门开门权限",
    "resCode": "park_door",
    "resDesc": "园区正门"
       }
     ]
 }

4.登录查看账号进行登录

4.1 查看账号

单击账号管理>新建账号，添加“集群用户”（用户名、密码、手机号），其中，手机号必填且唯一，并提示用户，手机号是系统之间免登的凭据，如下图所示：

4.2 进行登录

登录成功后，可以查看到该账号对应的权限。（主要是运维管理中应用管理和主机监控的权限）单击运维管理>主机监控 可查看该集群下，已激活的主机资源配置详情，如下图所示：