Skip to content

WeCom OAuth — Doc Site Access Control

Protect docs.omnivoltaic.cn with WeCom SSO. Any user with an active WeCom seat in OVES gets access. Others get 403.

Prerequisites

Item Detail
WeCom enterprise 已认证 (verified), admin access
EdgeOne site omnivoltaic.cn, Personal plan (Edge Functions: 3M req/mo)
EdgeOne domain docs.omnivoltaic.cn active
ICP Required — WeCom trusted domain must be ICP-registered, entity must match

Step 1 — WeCom Self-Built App

  1. https://work.weixin.qq.com/wework_admin → 应用管理 → 自建
  2. Click 创建应用
  3. Fill:
Field Value
应用名称 OVES Docs Auth
应用logo (optional)
可见范围 根部门 (all employees)
  1. Save → copy CorpID (bottom of page or 我的企业 tab) and Secret (click 查看)

Step 2 — Trusted Domain

  1. Inside the new app → 网页授权及JS-SDK
  2. Set 可信域名: omnivoltaic.cn
  3. Click 申请校验域名 → download MP_verify_xxxxxx.txt
  4. Upload the verification file to your COS bucket root so it's accessible at https://omnivoltaic.cn/MP_verify_xxxxxx.txt
  5. Click 验证 in WeCom
  6. Under 作为应用OAuth2.0网页授权功能的回调域名: docs.omnivoltaic.cn
  7. Save

ICP reminder: WeCom checks ICP database. omnivoltaic.cn must be registered and the ICP entity must match the WeCom enterprise entity.

Step 3 — Deploy Edge Function

  1. EdgeOne console → omnivoltaic.cn site → 边缘函数 → 函数管理 → 新建函数
  2. Name: wecom-oauth
  3. Paste the Edge Function code (see wecom_oauth_edge_function.js)
  4. Set environment variables:
Variable Value
CORP_ID Your WeCom CorpID
CORP_SECRET Your WeCom app Secret
  1. 触发规则 → Add:
  2. 匹配条件: Host header = docs.omnivoltaic.cn
  3. 触发操作: Execute this function
  4. 保存并发布

How It Works

User → docs.omnivoltaic.cn → Edge Function checks cookie
  ├── Cookie present → passthrough to COS → serve content
  └── No cookie → redirect to WeCom OAuth
        ├── User authorizes (silent — snsapi_base)
        ├── WeCom redirects back with code
        ├── Edge Function exchanges code for UserId
        ├── UserId found → set cookie → serve content
        └── No UserId → 403 Access Denied

Verification

# Without auth — should redirect
curl -v https://docs.omnivoltaic.cn/tencent-cloud/

# Expected: 302 redirect to open.weixin.qq.com/connect/oauth2/authorize

# With valid cookie — serves content
curl -H "Cookie: wework_sid=test" https://docs.omnivoltaic.cn/tencent-cloud/

# Expected: 200 with site content

Per-Subdomain Access Policies

Extend this pattern for other subdomains:

Subdomain Auth Policy
docs WeCom SSO All employees
decks WeCom + Keycloak All WeCom + external guests
memo WeCom SSO All employees
training WeCom SSO All employees
media WeCom + Keycloak All WeCom + external guests

External access subdomains (decks, media) need a modified Edge Function that checks Keycloak as a fallback when WeCom auth fails.

Troubleshooting

Symptom Fix
redirect_uri 参数错误 Trusted domain not set → redo Step 2
企业未认证 WeCom enterprise not verified → verify first
ICP failed Domain ICP entity doesn't match WeCom entity
Edge Function not firing Check trigger rule matches docs.omnivoltaic.cn
403 for valid user Check CorpID/Secret env vars in Edge Function