1.對接目標

1.云端：提供云端的SDK API給到ISV用于管理態的應用權限和人員授權的管理。2.同步：平臺通過云->邊同步機制，把云端的應用的權限和人員的授權關系同步到邊緣集群。3.邊側：提供邊側的SDK API給到ISV用于運行態的邊側人員權限校驗。

2.接入構造說明

接入方是一個大租戶（tenantId）每個項目是一個隔離（scopeId）每個項目會有個邊緣集群（cluster）每個邊緣集群會有多個應用（application）權限，人員，權限，空間等應用的數據都是tenantId+scopeId隔離內，云邊同步的數據范圍也是tenantId+scopeId

3.API接口調用

3.1 云端API

現有云端API文檔：https://dev.iot.aliyun.com/api_center權限管理服務部分。

3.1.1 創建權限接口

接口描述

入參說明

具體復雜數組可參照接口文檔：創建權限接口

出參列表

請求示例

     /**
     * 系統環境變量中獲取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //設置api的版本
    request.setApiVer("0.0.3");


    //如果需要登錄，設置當前的會話的token
    request.setIotToken("xxxxxxxxxxxxxxx");

  // 接口參數
    request.putParam("permissions","value1");

    //請求參數域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回結果示例 JSON

{
    "id": "c996a414-45ce-4010-b9a5-88038342d50a",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失敗返回結果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.2 創建角色接口

接口描述

入參說明

具體復雜數組可參照接口文檔：創建角色接口

出參列表

請求示例

     /**
     * 系統環境變量中獲取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //設置api的版本
    request.setApiVer("0.0.3");


    //如果需要登錄，設置當前的會話的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口參數
    request.putParam("roles","value1");

    //請求參數域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回結果示例 JSON

{
    "id": "d13e1f27-b24a-4be7-9c5e-b452da6f4430",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失敗返回結果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.3 刪除角色接口

接口描述

入參說明

具體復雜數組可參照接口文檔：刪除角色接口

出參列表

請求示例

     /**
     * 系統環境變量中獲取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //設置api的版本
    request.setApiVer("0.0.3");


    //如果需要登錄，設置當前的會話的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口參數
    request.putParam("roles","value1");

    //請求參數域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回結果示例 JSON

{
    "id": "6c8977f8-c31e-46ef-81da-9244759e13c6",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失敗返回結果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.4 批量給角色關聯權限接口

接口描述

入參說明

具體復雜數組可參照接口文檔：批量給角色關聯權限接口

出參列表

請求示例

     /**
     * 系統環境變量中獲取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //設置api的版本
    request.setApiVer("0.0.3");


    //如果需要登錄，設置當前的會話的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口參數
    request.putParam("roles","value1");
    request.putParam("permissions","value2");

    //請求參數域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回結果示例 JSON

{
    "id": "7a31b6a5-91f8-422c-907e-7434918f5869",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失敗返回結果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.5 批量移除角色權限接口

接口描述

入參說明

具體復雜數組可參照接口文檔：批量從identity移除權限接口

出參列表

請求示例

     /**
     * 系統環境變量中獲取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //設置api的版本
    request.setApiVer("0.0.3");


    //如果需要登錄，設置當前的會話的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口參數
   request.putParam("identityId","value1");
    request.putParam("permissions","value2");
    //請求參數域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回結果示例 JSON

{
    "id": "7a31b6a5-91f8-422c-907e-7434918f5869",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失敗返回結果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.6 批量給identity授予角色接口

接口描述

入參說明

具體復雜數組可參照接口文檔：批量給identity授予角色接口

出參列表

請求示例

     /**
     * 系統環境變量中獲取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //設置api的版本
    request.setApiVer("0.0.3");


    //如果需要登錄，設置當前的會話的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口參數
   request.putParam("identityId","value1");
    request.putParam("roles","value2");

    //請求參數域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回結果示例 JSON

{
    "id": "7a31b6a5-91f8-422c-907e-7434918f5869",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失敗返回結果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

3.1.7 批量給identity移除角色接口

接口描述

入參說明

具體復雜數組可參照接口文檔：批量從identity移除角色接口

出參列表

請求示例

     /**
     * 系統環境變量中獲取的
     */
    public static final String appkey = System.getenv("iot.hosting.appKey");
    public static final String appSecret = System.getenv("iot.hosting.appSecret");
public static void main(String[] args) throws UnsupportedEncodingException {
    IoTApiClientBuilderParams ioTApiClientBuilderParams =
      new IoTApiClientBuilderParams();
    ioTApiClientBuilderParams.setAppKey("你的<AppKey>");
    ioTApiClientBuilderParams.setAppSecret("你的<AppSecret>");
    SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);

    IoTApiRequest request = new IoTApiRequest();
    //設置api的版本
    request.setApiVer("0.0.3");


    //如果需要登錄，設置當前的會話的token
    request.setIotToken("xxxxxxxxxxxxxxx");

    // 接口參數
   request.putParam("identityId","value1");
    request.putParam("roles","value2");

    //請求參數域名、path、request
  ApiResponse response = syncClient.postBody("api.link.aliyun.com",
      "/user/rbac/permission/batchcreate", request, true);
    System.out.println( "response code = " + response.getCode()
      + " response = " + new String(response.getBody(), "UTF-8"));
}

返回結果示例 JSON

{
    "id": "7a31b6a5-91f8-422c-907e-7434918f5869",
    "code": 200,
    "message": null,
    "localizedMsg": null,
    "data": ""
}

失敗返回結果示例 JSON

{
    "id": "5a0e2944-36ad-4a42-97c1-958dd37bfa10",
    "code": 500,
    "message": "server error.",
    "localizedMsg": "server error.",
    "data": null
}

地產平臺通過封裝LP云邊同步能力，對外開放如下API：1、獲取邊緣集群列表2、數據同步預檢查3、觸發數據同步4、數據同步結果查詢

3.2.1接口定義

分頁參數會出現在請求參數和返回結果中，用于下文中API調用參照。

• 在請求參數中代表請求分頁的頁數（pageNo）和每頁的記錄數（pageSize）；

• 在響應結果中的頁數（pageNo）和每頁的記錄數（pageSize）與請求參數一致，同時還有total字段代表數據總數。

所有的分頁接口除特殊說明外，都遵循下面的約束

獲取集群列表

接口定義

入參

出參

分頁數據對象ClusterDTOList

示例

請求示例

{
  "pageNo":1,
  "pageSize":20
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data":{
    "pageNo": 1,
    "pageSize": 20,
    "total": 10,
      "data":[{
        "id": "xxx",
      "name": "cluster01",
        "gmtCreate": "2020-03-04 18:00:00",
        "gmtModified": "2020-03-04 18:00:00"
        }]
    }
}

數據同步預檢查

接口定義

入參

出參

示例

請求示例

{
  "clusterId": "xxx",
  "opsType": "SYNC_DATA",
  "dataTypeList": [
      "ACCOUNT",
    "SPACE"
    "RTPC"
    "ALARM"
  ]
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data": "XXX"
}

觸發數據同步

接口定義

入參

出參

示例

請求示例

{
  "clusterId": "xxx",
  "opsType": "SYNC_DATA",
  "dataTypeList": [
      "ACCOUNT",
    "SPACE"
  ]
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data": "XXX"
}

根據數據同步請求查詢結果

接口定義

入參

出參

示例

請求示例

{
  "clusterId": "xxx",
  "opsType": "SYNC_DATA",
  "dataTypeList": [
      "ACCOUNT",
    "SPACE"
  ]
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data": {
    "dataSyncStatus": "SUCCESS",
    "preCheckResult": "NO",
    "taskGroupId": "XXX"
  }
}

根據任務組查詢數據同步結果

接口定義

入參

出參

示例

請求示例

{
  "clusterId": "xxx",
  "opsType": "SYNC_DATA",
  "dataTypeList": [
      "ACCOUNT",
    "SPACE"
  ]
}

返回示例

{
  "code": 200,
  "message": null,
  "localizedMsg": null,
  "data": "SUCCESS"
}

3.3 邊緣端API

變成服務對接，遵循服務模型API對接規范。

3.3.1 API對接規范

請求頭

Host: ****.com
Date: Mon, 22 Aug 2016 11:21:04 GMT
User-Agent: Apache-HttpClient/4.1.2 (java 1.6)
Content-Type: application/json; charset=utf-8
//請求體類型，請根據實際請求體內容設置。
Accept: application/json 
//請求響應體類型，部分 API 可以根據指定的響應類型來返回對應數據格式，建議手動指定此請求頭，如果不設置，部分 HTTP 客戶端會設置默認值 */*，導致簽名錯誤。
X-Ca-Request-Mode: debug 
//是否開啟 Debug 模式，大小寫不敏感，不設置默認關閉，一般 API 調試階段可以打開此設置。
X-Ca-Signature-Headers: X-Ca-Request-Mode,X-Ca-Version,X-Ca-Stage,X-Ca-Key,X-Ca-Timestamp 
//參與簽名的自定義請求頭，服務端將根據此配置讀取請求頭進行簽名，此處設置不包含 Content-Type、Accept、Content-MD5、Date 請求頭，這些請求頭已經包含在了基礎的簽名結構中，詳情參照請求簽名說明文檔。
X-Ca-Key: 6002****  
//請求的 AppKey
X-Ca-Timestamp: 147186486**** 
//請求的時間戳，值為當前時間的毫秒數，也就是從1970年1月1日起至今的時間轉換為毫秒，時間戳有效時間為15分鐘。
X-Ca-Nonce:b931bc77-645a-4299-b24b-f3669be5****  
//請求唯一標識，15分鐘內 AppKey+API+Nonce 不能重復，與時間戳結合使用才能起到防重放作用。
X-Ca-Signature: FJleSrCYPGCU7dMlLTG+UD3Bc5Elh3TV3CWHtSKh1Ys= 
//請求簽名。

響應狀態碼

400  
//響應狀態碼，大于等于200小于300表示成功；大于等于400小于500為客戶端錯誤；大于500為服務端錯誤。

響應頭

Content-Type: application/json; charset=utf-8
//響應體類型，請根據實際請求體內容設置
X-Ca-Error-Message: Invalid Url  
//主要處理應用容器非業務異常的錯誤信息處理
X-Ca-Debug-Info: {"ServiceLatency":0}  
//當打開 Debug 模式后會返回 Debug 信息，此信息后期可能會有變更，僅用做聯調階段參考

請求Body部分

協議

request 屬性

API示例

## API 名稱刪除人臉模型
## 名稱：DeleteModel
## 路徑：/facade/model/delete
## 版本：1.0.0
## 請求參數
{
    "request": {
        "apiVer": "1.0.0"
    },
    "id": "BRC-155193021****",
    "params": {
        "modelId": "d80c6c551cee4d78beb3f8259a3feba4"
    },
    "version": "1.0"
}

## 返回示例
{
    "id": "BRC-155193021****",
    "code": 200,
    "data": 2,
    "message": ""
}

代碼請求示例：

public static void main(String[] args) throws UnsupportedEncodingException {
IoTApiClientBuilderParams ioTApiClientBuilderParams =
new IoTApiClientBuilderParams();
ioTApiClientBuilderParams.setAppKey("28282004");
ioTApiClientBuilderParams.setAppSecret("dcbab9388216c6479b69906565d28f93");
SyncApiClient syncClient = new SyncApiClient(ioTApiClientBuilderParams);
String path = "/app/user/info/get";
IoTApiRequest request = new IoTApiRequest();
request.setApiVer("1.0.0");
Map<String, Object> params = new HashMap<>(4);
// 接口參數
params.put("appId", "4febf37ae01048509cc8136f3ad19926");
params.put("tenantSubUserId", "");
params.put("userId", "2088954581022991");
request.setParams(params);
request.setVersion("1.0");
//請求參數域名、path、request
ApiResponse response = syncClient.postBody("api.link.aliyun.com",
path, request, true);
System.out.println("response code = " + response.getCode()
+ " response = " + new String(response.getBody(), "UTF-8"));

3.3.2 權限校驗

API 權限驗證名稱：authenIdentityPerm路徑：/user/rbac/identity/authenperm版本：1.0.0

請求參數

    {
        "request": {
            "apiVer": "1.0.0"
        },
        "id": "BRC-155193021****",
        "params": {
            "identityId":"身份ID",
            "actionCode":"資源操作-比如應用權限",
            "resCode":"資源ID-比如應用ID"
       },
     "version": "1.0"
    }

返回示例

    {
    "id": "BRC-155193021****",
    "code": 200,         #響應碼, 200: 成功
    "message": "",     #錯誤消息
    "data": **true**     #是否有權限
}

3.3.3 查詢賬號所有權限

API 權限驗證名稱：queryIdentityAllPermission路徑：/user/rbac/identity/queryallpermission版本：1.0.0

請求參數

    {
      "request": {
           "apiVer": "1.0.0"
       },
        "id": "BRC-155193021****",
        "params": {
           "identityId":"身份ID"
     },
    "version": "1.0"
}

返回示例

 {
    "id": "1718af5d-5528-4cc6-b0c5-eba636444091",
    "code": 200,
    "message": **null**,
    "localizedMsg": **null**,
    "data": [
       {
    "actionCode": "open",
    "actionDesc": "開",
    "cronExpression": "* * * ? * 1-5 *",
    "effectiveTime": 155801997****,
    "expireTime": 155802357****,
     "bizTag1": "標簽A",
     "bizTag2": "標簽B",
     "bizTag3": **null**,
    "permissionDesc": "備注",
    "permissionName": "園區正門開門權限",
    "resCode": "park_door",
    "resDesc": "園區正門"
       }
     ]
 }

4.登錄查看賬號進行登錄

4.1 查看賬號

單擊賬號管理>新建賬號，添加“集群用戶”（用戶名、密碼、手機號），其中，手機號必填且唯一，并提示用戶，手機號是系統之間免登的憑據，如下圖所示：

4.2 進行登錄

登錄成功后，可以查看到該賬號對應的權限。（主要是運維管理中應用管理和主機監控的權限）單擊運維管理>主機監控 可查看該集群下，已激活的主機資源配置詳情，如下圖所示：