修复全量审查问题;设置接口PATCH化;回传指纹加固

internal/oci/signon.go

@@ -17,6 +17,9 @@ const ociConsolePolicyID = "OciConsolePolicy"
 // scimPatchSchema 是 SCIM PatchOp 的 schema。
 const scimPatchSchema = "urn:ietf:params:scim:api:messages:2.0:PatchOp"
 
+// signOnConsentSchema 是修改 Oracle 预置 OCI Console sign-on 策略的知情同意扩展 schema。
+const signOnConsentSchema = "urn:ietf:params:scim:schemas:oracle:idcs:extension:ociconsolesignonpolicyconsent:Policy"
+
 // SignOnRuleInfo 是 sign-on 策略中一条规则的关键字段。
 type SignOnRuleInfo struct {
 	ID                   string `json:"id"`
@@ -220,15 +223,18 @@ func sortedRules(rules []identitydomains.PolicyRules) []identitydomains.PolicyRu
 
 func patchPolicyRules(ctx context.Context, dc identitydomains.IdentityDomainsClient, rules []interface{}) error {
 	var value interface{} = rules
+	var consent interface{} = true
+	var justification interface{} = "MFA Configured in External IDP"
 	_, err := dc.PatchPolicy(ctx, identitydomains.PatchPolicyRequest{
 		PolicyId: common.String(ociConsolePolicyID),
 		PatchOp: identitydomains.PatchOp{
 			Schemas: []string{scimPatchSchema},
-			Operations: []identitydomains.Operations{{
-				Op:    identitydomains.OperationsOpReplace,
-				Path:  common.String("rules"),
-				Value: &value,
-			}},
+			// 改动 Oracle 预置策略必须附带知情同意,否则 400 Missing required attribute(s): consent
+			Operations: []identitydomains.Operations{
+				{Op: identitydomains.OperationsOpReplace, Path: common.String("rules"), Value: &value},
+				{Op: identitydomains.OperationsOpAdd, Path: common.String(signOnConsentSchema + ":consent"), Value: &consent},
+				{Op: identitydomains.OperationsOpAdd, Path: common.String(signOnConsentSchema + ":justification"), Value: &justification},
+			},
 		},
 	})
 	if err != nil {