From login tool toIdentity Matrix
OAuth 2.1 aggregated login · UMID federated identity · RBAC · multi-tenant SaaS. Each module works standalone; together they form a complete identity infrastructure.
OAuth 2.1 Aggregated Login
5-platform unified access, 5-minute integration
Unified access for WeChat / Alipay / QQ / Douyin / self-hosted. Complete OAuth 2.1 flow, MD5 signature anti-replay, 5-minute code cache prevents 40163 duplicate consumption.
Key Endpoints
<?php
require 'vendor/autoload.php';
$um = new UM($appid, $appkey, $callback, $apiurl);
// 1. 生成登录跳转 URL
$state = bin2hex(random_bytes(16));
$loginUrl = $um->login('wx', $state);
header("Location: $loginUrl");
// 2. 回调获取用户信息
$user = $um->callback($_GET['code']);
// => ["openid"=>"oX...", "nickname"=>"张三", "avatar"=>"..."]
// 3. 二次查询
$info = $um->query('wx', $social_uid);UMID Federated Identity
One UMID across all apps, cross-platform auto-merge
UMID (UserMatrix ID) is the federated identity. One UMID runs through all UM-integrated apps, cross-platform accounts auto-merge. User identity is owned by users, apps are consumers.
// 用户主表
CREATE TABLE um_user (
id BIGINT PRIMARY KEY AUTO_INCREMENT,
openid VARCHAR(64), -- UMID
login_type VARCHAR(20),
nickname VARCHAR(100),
avatar VARCHAR(500),
phone VARCHAR(20),
email VARCHAR(100),
score INT DEFAULT 0,
balance DECIMAL(10,2) DEFAULT 0
);
-- 第三方绑定表（一个 UMID 可绑定多个平台）
CREATE TABLE um_oauth (
user_id BIGINT,
appid VARCHAR(32),
type VARCHAR(20), -- wx/alipay/qq/douyin
openid VARCHAR(64), -- 第三方 openid
access_token VARCHAR(255)
);RBAC Permissions
6 login policies, granular permission registry, B-end role management
6 login policies (independent/group SSO/global SSO/single-device/multi-device/IP-bound), granular permission registry, B-end RBAC role management. Multi-instance tokens, each device/app has independent token.
Key Endpoints
// 配置分组 SSO 策略
{
"login_policy": "group_sso",
"policy_config": {
"group_key": "yunjii_products",
"max_devices": 3,
"ip_whitelist": []
}
}
// 多实例 Token 表
CREATE TABLE um_user_token (
user_id BIGINT,
token VARCHAR(255),
scope VARCHAR(50), -- 应用分组/全局
scope_type ENUM('app', 'group', 'global'),
device_id VARCHAR(64),
login_ip VARCHAR(45),
ip_bound BOOLEAN,
expire_at DATETIME
);Multi-tenant SaaS
App grouping, domain authorization, policy config, login logs
One backend serves countless apps, tenant isolation. App grouping, domain authorization, policy config, login logs, device management. B-end console visualizes all apps.
Key Endpoints
// B 端控制台 Dashboard 数据
GET /api/dashboard.php
响应：
{
"code": 1,
"data": {
"kpi": {
"total_users": 12834,
"active_today": 2341,
"logins_today": 5621,
"apps_count": 17
},
"platform_matrix": {
"wx": 8234, "alipay": 2341,
"qq": 892, "douyin": 1234, "self": 133
},
"trend_7d": [...]
}
}Pick a capability, integrate in 5 minutes
Each module works standalone; together they form a complete identity infrastructure. Read the docs to start.