ELY23005:无法加载OpenID提供程序元数据

我们的是一个基于wildfly的应用程序。我们用Elytron配置Keycloak OIDC。这种集成在除了这个环境之外的所有环境中都能很好地工作。当点击任何URL时，它返回403 Forbidden error。

在启用TRACE级别时，我可以在到达应用程序端点时看到这些日志:

{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "Created ServletSecurityContextImpl enableJapi=true, integratedJaspi=true, applicationContext=default-host /my-app"}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "No AuthConfigProvider for layer=HttpServlet, appContext=default-host /my-app"}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "JASPIC Unavailable, using HTTP authentication."}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security", "log_message": "No CachedIdentity to restore."}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security", "log_message": "Created HttpServerAuthenticationMechanism [org.wildfly.security.auth.server.SecurityIdentityServerMechanismFactory$1@611230fa] for mechanism [OIDC]"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "adminRequest http://localhost:8180/my-app/"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "--> authenticate()"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try bearer"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try query parameter auth"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try basic auth"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try oidc"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "Account was not in session, returning null"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "there was no code"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "redirecting to auth server"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "callback uri: http://localhost:8180/my-app/"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "Loading OpenID provider metadata from https://myidp.com/realm/myrealm/.well-known/openid-configuration"}
{"log_timestamp": "2023-03-31T12:34:38.632+0000", "log_level": "WARN", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "ELY23005: Unable to load OpenID provider metadata from https://myidp.com/realm/myrealm/.well-known/openid-configuration"}

在查看此日志的源代码时，没有证据表明是哪一行导致了异常。

一些线索:

我们所有的环境都是用相同的Helm创建的，所以不存在完整性或理智的问题。HTTPS IDP证书由受信任的CA颁发。在容器中，我们可以在最后一行找到元数据配置URL还附带了standalone.xmlIDP提供商是Keycloak。比较Realm设置，客户端设置，没有发现差异。尝试将此应用程序指向不同的Keycloak实例，但得到相同的问题。

我认为问题是内部服务无法通过HTTPS到达内部https://myidp.com。当您的HTTPS在代理/负载平衡器中终止并且内部服务主要使用HTTP时，这是一个非常常见的网络问题。如何修复它取决于你的基础设施，一个选项可以是将HTTPS证书添加到密钥斗篷端点，然后将myidp.com映射到LAN上的内部ip地址。

我无意中发现了这个问题，我通过添加"truststore"one_answers";truststore-password"属性到OICD客户机配置:

<subsystem xmlns="urn:wildfly:elytron-oidc-client:1.0">
<secure-deployment name="myapp.war" truststore="/path/to/cacerts.p12" truststore-password="changeit">
<provider-url>https://localhost/auth/realms/my-app-realm</provider-url>
<ssl-required>ALL</ssl-required>
<principal-attribute>preferred_username</principal-attribute>
<client-id>my-app-oidc-client</client-id>
<credential name="secret" secret="..."/>
</secure-deployment>
</subsystem>

参考https://docs.wildfly.org/28/wildscribe/subsystem/elytron-oidc-client/secure-deployment/index.html

使用

创建信任存储文件cacerts.p12

keytool -importcert -alias keycloak -keystore cacerts.p12 -file localhost.crt

其中localhost.crt为服务器证书。

相关内容

最新更新

热门标签：