diff --git a/.idea/encodings.xml b/.idea/encodings.xml
index da0415a0f5..f966f7a154 100644
--- a/.idea/encodings.xml
+++ b/.idea/encodings.xml
@@ -1,4 +1,97 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
-  <component name="Encoding" defaultCharsetForPropertiesFiles="UTF-8" />
+  <component name="Encoding" defaultCharsetForPropertiesFiles="UTF-8">
+    <file url="file://$PROJECT_DIR$/dinky-admin/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-admin/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-base/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-base/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-dingtalk/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-dingtalk/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-email/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-email/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-feishu/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-feishu/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-http/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-http/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-sms/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-sms/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-wechat/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/dinky-alert-wechat/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-alert/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-app/dinky-app-base/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-app/dinky-app-base/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-app/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-app/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-assembly/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-assembly/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-catalog/dinky-catalog-mysql/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-catalog/dinky-catalog-mysql/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-catalog/dinky-catalog-postgres/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-catalog/dinky-catalog-postgres/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-catalog/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-catalog/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-cdc/dinky-cdc-core/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-cdc/dinky-cdc-core/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-cdc/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-cdc/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-client/dinky-client-base/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-client/dinky-client-base/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-client/dinky-client-hadoop/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-client/dinky-client-hadoop/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-client/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-client/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-common/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-common/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-connectors/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-connectors/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-core/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-core/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-daemon/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-daemon/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-extends/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-extends/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-flink/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-flink/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-function/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-function/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-gateway/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-gateway/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-base/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-base/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-clickhouse/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-clickhouse/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-doris/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-doris/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-hive/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-hive/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-mysql/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-mysql/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-oracle/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-oracle/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-paimon/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-paimon/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-phoenix/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-phoenix/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-postgresql/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-postgresql/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-presto/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-presto/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-sqlserver/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-sqlserver/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-starrocks/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/dinky-metadata-starrocks/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-metadata/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-sandbox/dinky-sandbox-base/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-sandbox/dinky-sandbox-base/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-sandbox/dinky-sandbox-memory/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-sandbox/dinky-sandbox-memory/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-sandbox/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-sandbox/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-scheduler/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/dinky-scheduler/src/main/resources" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/src/main/resources" charset="UTF-8" />
+  </component>
 </project>
\ No newline at end of file
diff --git a/dinky-admin/pom.xml b/dinky-admin/pom.xml
index 8181ec7da1..4984130a93 100644
--- a/dinky-admin/pom.xml
+++ b/dinky-admin/pom.xml
@@ -1,4 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
+
 <!--
   ~ Licensed to the Apache Software Foundation (ASF) under one or more
   ~ contributor license agreements.  See the NOTICE file distributed with
diff --git a/dinky-admin/src/main/java/org/dinky/controller/AdminController.java b/dinky-admin/src/main/java/org/dinky/controller/AdminController.java
index b9bf093c05..3b8583c7ec 100644
--- a/dinky-admin/src/main/java/org/dinky/controller/AdminController.java
+++ b/dinky-admin/src/main/java/org/dinky/controller/AdminController.java
@@ -21,6 +21,7 @@
 
 import org.dinky.DinkyVersion;
 import org.dinky.data.dto.LoginDTO;
+import org.dinky.data.dto.LoginSSODTO;
 import org.dinky.data.dto.UserDTO;
 import org.dinky.data.enums.Status;
 import org.dinky.data.model.rbac.Tenant;
@@ -47,6 +48,12 @@
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.net.URISyntaxException;
+import java.util.Objects;
+
 /**
  * AdminController
  *
@@ -88,6 +95,42 @@ public Result<Void> outLogin() {
         return Result.succeed(Status.SIGN_OUT_SUCCESS.getMessage());
     }
 
+    /**
+     * user sso login
+     * @param ticket
+     */
+    @GetMapping("/redirect/login/sso")
+    @SaIgnore
+    public void loginsso(@RequestParam("ticket") String ticket, HttpServletResponse response)
+            throws URISyntaxException, IOException {
+
+        log.info("ticket is {}", ticket);
+        LoginSSODTO loginSSODTO = new LoginSSODTO();
+        loginSSODTO.setTicket(ticket);
+        UserDTO user = userService.loginSSOUser(loginSSODTO);
+        if (Objects.nonNull(user)) {
+            log.info("sso user succ {}", user);
+
+            Cookie cookie = new Cookie("dinky-token", user.getTokenInfo().getTokenValue());
+            cookie.setPath("/");
+            response.addCookie(cookie);
+
+            Cookie cookieTen = new Cookie(
+                    "tenantId", String.valueOf(user.getTenantList().get(0).getId()));
+            cookieTen.setPath("/");
+            response.addCookie(cookieTen);
+
+            Cookie cookieLan = new Cookie("language", "zh-CN");
+            cookieLan.setPath("/");
+            response.addCookie(cookieLan);
+
+            response.sendRedirect(user.getRedirectUri());
+        } else {
+            log.error("loginsso failed user {}", user);
+            response.sendRedirect(user.getRedirectUri());
+        }
+    }
+
     /**
      * get current user info
      *
diff --git a/dinky-admin/src/main/java/org/dinky/data/dto/LoginSSODTO.java b/dinky-admin/src/main/java/org/dinky/data/dto/LoginSSODTO.java
new file mode 100644
index 0000000000..21ea150789
--- /dev/null
+++ b/dinky-admin/src/main/java/org/dinky/data/dto/LoginSSODTO.java
@@ -0,0 +1,28 @@
+/*
+ *
+ *  Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  See the NOTICE file distributed with
+ *  this work for additional information regarding copyright ownership.
+ *  The ASF licenses this file to You under the Apache License, Version 2.0
+ *  (the "License"); you may not use this file except in compliance with
+ *  the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.dinky.data.dto;
+
+
+import lombok.Data;
+
+@Data
+public class LoginSSODTO {
+    private String ticket;
+}
\ No newline at end of file
diff --git a/dinky-admin/src/main/java/org/dinky/data/dto/UserDTO.java b/dinky-admin/src/main/java/org/dinky/data/dto/UserDTO.java
index d152da2ee0..5a2d6b0dd0 100644
--- a/dinky-admin/src/main/java/org/dinky/data/dto/UserDTO.java
+++ b/dinky-admin/src/main/java/org/dinky/data/dto/UserDTO.java
@@ -32,6 +32,7 @@
 import lombok.AllArgsConstructor;
 import lombok.Data;
 import lombok.NoArgsConstructor;
+import org.dinky.data.model.rbac.UserRole;
 
 @Data
 @NoArgsConstructor
@@ -45,6 +46,11 @@ public class UserDTO {
     @ApiModelProperty(value = "roleList", required = true, dataType = "List<Role>", allowEmptyValue = false)
     private List<Role> roleList;
 
+    @ApiModelProperty(value = "userRoleList", required = false, dataType = "List<UserRole>", allowEmptyValue = false)
+    private List<UserRole> userRoleList;
+
+    private String redirectUri;
+
     @ApiModelProperty(value = "tenantList", required = true, dataType = "List<Tenant>", allowEmptyValue = false)
     private List<Tenant> tenantList;
 
diff --git a/dinky-admin/src/main/java/org/dinky/service/UserService.java b/dinky-admin/src/main/java/org/dinky/service/UserService.java
index b428dc5246..80bb728c59 100644
--- a/dinky-admin/src/main/java/org/dinky/service/UserService.java
+++ b/dinky-admin/src/main/java/org/dinky/service/UserService.java
@@ -21,6 +21,7 @@
 
 import org.dinky.data.dto.AssignRoleDTO;
 import org.dinky.data.dto.LoginDTO;
+import org.dinky.data.dto.LoginSSODTO;
 import org.dinky.data.dto.ModifyPasswordDTO;
 import org.dinky.data.dto.UserDTO;
 import org.dinky.data.model.rbac.Role;
@@ -31,6 +32,8 @@
 import org.dinky.data.vo.UserVo;
 import org.dinky.mybatis.service.ISuperService;
 
+import java.io.IOException;
+import java.net.URISyntaxException;
 import java.util.List;
 
 /**
@@ -80,6 +83,15 @@ public interface UserService extends ISuperService<User> {
      */
     Result<UserDTO> loginUser(LoginDTO loginDTO);
 
+
+
+    /**
+     *
+     * @param loginSSODTO
+     */
+    UserDTO loginSSOUser(LoginSSODTO loginSSODTO) throws URISyntaxException, IOException;
+
+
     /**
      * get user by username
      *
diff --git a/dinky-admin/src/main/java/org/dinky/service/impl/UserServiceImpl.java b/dinky-admin/src/main/java/org/dinky/service/impl/UserServiceImpl.java
index e6dc26842f..0bf28fb28f 100644
--- a/dinky-admin/src/main/java/org/dinky/service/impl/UserServiceImpl.java
+++ b/dinky-admin/src/main/java/org/dinky/service/impl/UserServiceImpl.java
@@ -19,13 +19,26 @@
 
 package org.dinky.service.impl;
 
+import com.alibaba.fastjson2.JSON;
+import com.alibaba.fastjson2.JSONObject;
+import org.apache.http.HttpResponse;
+import org.apache.http.HttpStatus;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.message.BasicNameValuePair;
+import org.apache.http.util.EntityUtils;
 import org.dinky.assertion.Asserts;
 import org.dinky.context.RowLevelPermissionsContext;
 import org.dinky.context.TenantContextHolder;
 import org.dinky.context.UserInfoContextHolder;
+import org.dinky.data.constant.BaseConstant;
 import org.dinky.data.dto.AssignRoleDTO;
 import org.dinky.data.dto.AssignUserToTenantDTO;
 import org.dinky.data.dto.LoginDTO;
+import org.dinky.data.dto.LoginSSODTO;
 import org.dinky.data.dto.ModifyPasswordDTO;
 import org.dinky.data.dto.UserDTO;
 import org.dinky.data.enums.Status;
@@ -56,15 +69,20 @@
 import org.dinky.service.UserService;
 import org.dinky.service.UserTenantService;
 
+import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.ArrayList;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Objects;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.locks.ReentrantLock;
 import java.util.stream.Collectors;
 
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.util.CollectionUtils;
 
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
@@ -109,6 +127,15 @@ public class UserServiceImpl extends SuperServiceImpl<UserMapper, User> implemen
     private final TokenService tokenService;
     private final TokenMapper tokenMapper;
 
+    @Value("${sso.clientSecret}")
+    private String ssoClientSecret;
+
+    @Value("${sso.tokenVerifyUri}")
+    private String ssoTokenUri;
+
+    @Value("${sso.callbackUrl}")
+    private String callbackUrl;
+
     private final ReentrantLock lock = new ReentrantLock();
 
     @Override
@@ -210,6 +237,132 @@ public Result<UserDTO> loginUser(LoginDTO loginDTO) {
         return Result.succeed(userInfo, Status.LOGIN_SUCCESS);
     }
 
+    @Override
+    public UserDTO loginSSOUser(LoginSSODTO loginSSODTO) throws URISyntaxException, IOException {
+        CloseableHttpClient client = HttpClients.createDefault();
+        URI uri = new URI(ssoTokenUri);
+        HttpPost post = new HttpPost(uri);
+
+        List<NameValuePair> params = new ArrayList<>();
+        params.add(new BasicNameValuePair("ticket", loginSSODTO.getTicket()));
+        params.add(new BasicNameValuePair("secret_key", ssoClientSecret));
+
+        UrlEncodedFormEntity entity = new UrlEncodedFormEntity(params, "UTF-8");
+        post.setEntity(entity);
+        HttpResponse res = client.execute(post);
+
+        if (res.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
+            String resp = EntityUtils.toString(res.getEntity());
+            JSONObject jsonObject = JSON.parseObject(resp);
+            String userName = jsonObject.getString("username");
+            String nickName = jsonObject.getString("full_name");
+
+            User user = getUserByUsername(userName);
+            if (Objects.isNull(user)) {
+
+                User userAdd = new User();
+                String passWord = String.valueOf(System.currentTimeMillis());
+                userAdd.setPassword(SaSecureUtil.md5(passWord));
+                userAdd.setEnabled(true);
+                userAdd.setIsDelete(false);
+                userAdd.setNickname(nickName);
+                userAdd.setUsername(userName);
+                userAdd.setUserType(UserType.LOCAL.getCode());
+                boolean saveRes = save(userAdd);
+
+                if (saveRes) {
+                    StpUtil.login(userAdd.getId(), true);
+                    List<Tenant> tenantList = tenantService.getTenantListByUserId(userAdd.getId());
+                    List<UserTenant> tenantUserList = new ArrayList<>();
+                    if (CollectionUtils.isEmpty(tenantList)) {
+                        UserTenant userTenant = new UserTenant();
+                        userTenant.setTenantId(1);
+                        userTenant.setUserId(userAdd.getId());
+                        tenantUserList.add(userTenant);
+                        // save or update user role
+                        boolean result = userTenantService.saveOrUpdateBatch(
+                                tenantUserList, BaseConstant.DEFAULT_BATCH_INSERT_SIZE);
+                        log.info("sso save userTenant res {}", result);
+                    }
+
+                    List<UserRole> userRoleList = new ArrayList<>();
+                    List<Role> roleList = roleService.getRoleByUserId(userAdd.getId());
+                    if (CollectionUtils.isEmpty(roleList)) {
+                        UserRole userRole = new UserRole();
+                        userRole.setUserId(userAdd.getId());
+                        userRole.setRoleId(6);
+                        userRoleList.add(userRole);
+                        // save or update user role
+                        boolean result = userRoleService.saveOrUpdateBatch(userRoleList, 1000);
+                        log.info("sso save userRole res {}", result);
+                    }
+
+                    // save login log record
+                    UserDTO userDTO = refreshUserInfo(userAdd);
+                    userDTO.setUserRoleList(userRoleList);
+                    // save login log record
+                    loginLogService.saveLoginLog(userDTO.getUser(), Status.LOGIN_SUCCESS);
+                    upsertTokenSso(userDTO);
+                    userDTO.setRedirectUri(callbackUrl);
+                    return userDTO;
+                } else {
+                    log.error("sso save user failed {}", saveRes);
+                    return null;
+                }
+
+            } else {
+
+                StpUtil.login(user.getId(), true);
+                UserDTO userDTO = refreshUserInfo(user);
+                List<UserRole> userRoleList = userRoleService.getUserRoleByUserId(user.getId());
+                userDTO.setUserRoleList(userRoleList);
+
+                // save login log record
+                loginLogService.saveLoginLog(user, Status.LOGIN_SUCCESS);
+                upsertTokenSso(userDTO);
+                userDTO.setRedirectUri(callbackUrl);
+
+                return userDTO;
+            }
+        } else {
+            log.error("sso failed result is {}", res);
+            return null;
+        }
+    }
+
+    private void upsertTokenSso(UserDTO userInfo) {
+        Integer userId = userInfo.getUser().getId();
+        SysToken sysToken = new SysToken();
+        String tokenValue = userInfo.getTokenInfo().getTokenValue();
+        sysToken.setTokenValue(tokenValue);
+        sysToken.setUserId(userId);
+        // todo 权限和租户暂未接入
+        sysToken.setRoleId(userInfo.getUserRoleList().get(0).getId());
+        sysToken.setTenantId(userInfo.getTenantList().get(0).getId());
+        sysToken.setExpireType(3);
+        DateTime date = DateUtil.date();
+        sysToken.setExpireStartTime(date);
+        sysToken.setExpireEndTime(DateUtil.offsetDay(date, 1));
+        sysToken.setCreator(userId);
+        sysToken.setUpdater(userId);
+        sysToken.setSource(SysToken.Source.LOGIN);
+        try {
+            lock.lock();
+            SysToken lastSysToken =
+                    tokenMapper.selectOne(new LambdaQueryWrapper<SysToken>().eq(SysToken::getTokenValue, tokenValue));
+            if (Asserts.isNull(lastSysToken)) {
+                tokenMapper.insert(sysToken);
+            } else {
+                sysToken.setId(lastSysToken.getId());
+                tokenMapper.updateById(sysToken);
+            }
+        } catch (Exception e) {
+            log.error("update token info failed", e);
+        } finally {
+            lock.unlock();
+        }
+    }
+
     private void upsertToken(UserDTO userInfo) {
         Integer userId = userInfo.getUser().getId();
         SysToken sysToken = new SysToken();
diff --git a/dinky-admin/src/main/resources/application.yml b/dinky-admin/src/main/resources/application.yml
index a71804ab9e..08a9051cf6 100644
--- a/dinky-admin/src/main/resources/application.yml
+++ b/dinky-admin/src/main/resources/application.yml
@@ -165,3 +165,7 @@ knife4j:
 crypto:
   enabled: false
   encryption-password:
+sso:
+  clientSecret: ""
+  tokenVerifyUri: ""
+  callbackUrl: ""
\ No newline at end of file