
sa-token-sso
Sa-Token SSO 单点登录专项技能。覆盖三种SSO模式完整方案:模式一(同域+同Redis/Cookie共享)、模式二(跨域+同Redis/URL重定向)、模式三(跨域+跨Redis/Http ticket)。 SSO-Server认证中心搭建、SSO-Client接入、单点注销、自定义登录页面、前后端分离SSO(H5方案)、消息推送、匿名Client、域名校验、NoSdk非Java接入、自定义API路由、平台中心跳转。 当用户需要多系统统一登录/注销、搭建单点登录认证中心、跨域SSO集成时使用。 基础登录认证请先使用 sa-token 技能。
- Installs
- 76
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-sso- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads sa-token-sso automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Sa-Token SSO 单点登录
基于 sa-token-doc/sso/ 全部 18 个文档。基础认证使用 sa-token 技能。
Capability Boundaries
✅ Strong Suits
- SSO模式一(同域+Cookie) — 同前端域名+同Redis,共享Cookie同步会话
- SSO模式二(跨域+重定向) — 不同前端域名+同Redis,URL重定向传播会话
- SSO模式三(跨域+Http ticket) — 不同Redis+不同网络,Http请求获取ticket
- SSO-Server搭建 — 认证中心统一登录/注销
- SSO-Client接入 — 应用系统接入SSO
- 单点注销 — 一处注销所有系统同时下线
- 前后端分离SSO — H5方案适配SPA应用
- 自定义登录页面 — 定制化Server端登录页
- 域名校验 — 客户端域名白名单
- NoSdk/ReSdk — 非Java项目SSO接入
⚠️ Requirements
- 模式一和模式二需要所有服务共享同一个Redis
- SSO-Server和SSO-Client需要网络互通
- 生产环境建议配置
secret-key加密通信
❌ Out of Scope
- 基础登录/权限/注解鉴权 → sa-token
- OAuth2.0 服务端 → sa-token-oauth2
- 微服务鉴权 → sa-token-micro
三种模式对比
| 模式 | 场景 | 共享Redis | 认证机制 | 适用 |
|---|---|---|---|---|
| 类型1 | 同域名 | ✅ | Cookie共享 | 同父域下的子系统 |
| 类型2 | 不同域名 | ✅ | URL重定向 | 不同域名但共享Redis |
| 类型3 | 完全隔离 | ❌ | HTTP ticket | 不同Redis、不同网络 |
什么时候用哪种模式
- 同父域名下的多个子系统(如
admin.example.com、shop.example.com)→ 模式一,最简单 - 不同域名但共享Redis基础设施 → 模式二
- 完全独立的服务,不同Redis、不同网络环境 → 模式三
- 不确定选哪个 → 默认选模式三,灵活性最高
工作流
Step 1. 确认环境 — 引入 sa-token-sso 依赖,确认Redis连接
Step 2. 选择模式 — 根据系统架构选择模式一/二/三
Step 3. 搭建SSO-Server — 配置认证中心 /sso/auth 等端点
Step 4. 接入SSO-Client — 各应用系统配置认证地址
Step 5. 配置域名校验 — 设置允许的域名白名单
Step 6. 开启单点注销 — 配置 is-slo: true
Step 7. 测试验证 — 验证跨系统登录/注销流程
参考文档
| 主题 | 文件 | 来源 |
|---|---|---|
| SSO-Server搭建+三种模式 | references/sso-server.md | sso-server、sso-type1、sso-type2、sso-type3 |
| SSO-Client接入+注销+FAQ | references/sso-client.md | readme、signout、sso-questions |
| 前后端分离SSO(H5) | references/sso-h5.md | sso-h5 |
FAQ
Q: SSO和OAuth2.0的区别是什么? A: SSO解决多系统统一登录问题(一个账号登录所有系统)。OAuth2.0解决第三方授权问题(允许第三方应用访问用户数据)。简单场景选SSO,开放平台场景选OAuth2.0。
Q: 三种SSO模式如何选择? A: 同域名用模式一(最简单),跨域但共享Redis用模式二,完全隔离的环境用模式三。不确定时选模式三。
Q: SSO-Server和SSO-Client必须用同一语言吗? A: 模式一和模式二需要(依赖共享Redis的Java SDK),模式三不限语言(通过HTTP交互)。
Q: 如何保证ticket的安全性?
A: 1) 配置 secret-key 加密通信;2) ticket有效期默认5分钟,较短;3) 配置 is-check-sign: true 校验签名。
Q: SSO支持前后端分离项目吗? A: 支持。有专门的H5方案,前端SPA应用通过URL参数传递ticket,后端提供接口换取登录态。
Q: 单点注销是怎么工作的? A: 用户在SSO-Server注销时,Server会向所有已注册的Client发送注销通知,各Client清除本地会话。
Gotchas
- 模式三需要配置 ticket-url — 不能遗漏
ticket-url配置,否则Client无法向Server校验ticket - secret-key 生产环境必须配置 — 调试时可设
is-check-sign: false,生产务必开启 - 域名校验白名单 — 未配置
allow-domains时所有域名均可接入,生产环境需限制 - 单点注销需双向配置 — Server端
is-slo: true+ Client端reg-logout-call: true - 前后端分离下URL中ticket参数需要前端主动处理 — 后端不会自动重定向
- 模式一依赖Cookie同域 — 子域名必须在同一父域名下(如
.example.com) - Same-Token与SSO不要混淆 — Same-Token用于微服务内部鉴权,SSO用于用户登录态共享
Data Privacy
本技能不收集、存储或传输任何用户数据。所有代码示例仅供本地开发参考。
FAQ
What does the sa-token-sso skill do?
Sa-Token SSO 单点登录专项技能。覆盖三种SSO模式完整方案:模式一(同域+同Redis/Cookie共享)、模式二(跨域+同Redis/URL重定向)、模式三(跨域+跨Redis/Http ticket)。 SSO-Server认证中心搭建、SSO-Client接入、单点注销、自定义登录页面、前后端分离SSO(H5方案)、消息推送、匿名Client、域名校验、NoSdk非Java接入、自定义API路由、平台中心跳转。 当用户需要多系统统一登录/注销、搭建单点登录认证中心、跨域SSO集成时使用。 基础登录认证请先使用 sa-token 技能。
How do I install sa-token-sso?
Run npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-sso in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/sa-token-sso/ (personal) or .claude/skills/sa-token-sso/ (project).
Which AI agents can use sa-token-sso?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is sa-token-sso safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains sa-token-sso?
It is published by full-stack-skills in full-stack-skills/java-skills. It has 76 recorded installs.
More from full-stack-skills/java-skills
mybatis-plus-patterns
full-stack-skills/java-skills
MyBatis-Plus 增强 ORM 技能。覆盖 LambdaQueryWrapper vs QueryWrapper选择(始终Lambda)、分页插件(PaginationInnerInterceptor)配置、乐观锁(@Version + OptimisticLockerInnerInterceptor)、逻辑删除(@TableLogic 全局/局部配置)、自动填充(@TableField fill + MetaObjectHandler)、ActiveRecord vs Mapper模式选择、防全表更新(BlockAttackInnerInterceptor)、通用PageQuery抽取。 当用户使用 MyBatis-Plus 进行数据库操作、配置分页乐观锁、选择查询方式时使用。 与 mybatis 技能互补:mybatis 侧重XML/ResultMap/SQL写法,mybatis-plus 侧重增强功能。
java-development-manual
full-stack-skills/java-skills
Java开发手册规约集合,基于阿里巴巴Java开发手册(嵩山版)。 涵盖7大维度:编程规约、异常日志、单元测试、安全规约、MySQL数据库、工程结构、设计规约。 当用户需要:(1) 编写或审查Java代码 (2) 检查命名/代码规范 (3) 处理异常和日志 (4) 编写单元测试 (5) 安全编码 (6) 数据库设计 (7) 工程架构设计时使用此skill。 触发词:Java规范、阿里规约、代码规范、开发手册、编程规约、异常处理、单元测试、安全、MySQL、工程结构、设计模式。
java-code-comments
full-stack-skills/java-skills
Provides comprehensive guidance for adding Java code comments following industry standards and best practices. This skill helps add class-level comments, method-level comments, and field-level comments to Java code. Use when the user wants to add comments to Java code, needs to document Java classes/methods/fields, wants to improve code documentation, or needs to generate JavaDoc comments. This skill covers Controller, Service, ServiceImpl, Mapper, Model, Entity, BO (Business Object), DTO, VO, and other common Java component types. The skill follows a systematic workflow: scan codebase, identify components, create todo list, and add comments in order (class comments → method comments → field comments).
mybatis-patterns
full-stack-skills/java-skills
MyBatis 核心 ORM 技能。覆盖 XML vs 注解 SQL选择、ResultMap复用(extends)、关联查询(association/collection join vs 嵌套select/N+1决策)、分页插件配置、和$的SQL注入防护、动态SQL(if/where/set/foreach/choose)最佳实践、columnPrefix解决同表多次JOIN。 当用户编写 MyBatis Mapper XML、处理关联查询、配置分页、防范SQL注入时使用。
java-conventions
full-stack-skills/java-skills
统一 Java 项目编码规范与注释规范(SLF4J+Lombok 日志、Bean Lombok 注解选择、判空 Objects/Optional、工具类优先级 Spring→Apache Commons→Hutool→Guava、复杂逻辑用设计模式/简单逻辑不拆分、Controller/Service/ServiceImpl/Mapper 注释一致性)。当需要“按 Java 规范重构/Review/补全注释/统一日志/统一工具类使用/补全 JavaDoc”时使用。
junit-mockito-patterns
full-stack-skills/java-skills
JUnit5 + Mockito 测试框架技能。覆盖 JUnit5 @ExtendWith替代@RunWith、Mockito @Mock/@InjectMocks规则、测试隔离原则(FIRST)、@SpringBootTest何时用何时不用(@WebMvcTest/@DataJpaTest切片测试)、BDDMockito given/willReturn风格、ArgumentCaptor参数捕获、verify行为验证、@ParameterizedTest参数化测试。 当用户编写 Java 单元测试/集成测试、Mock外部依赖时需要此技能。
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.