我正在开发一个 Springboot 应用程序和一个在 Tomcat 上运行的 React 前端,以及 Hasura Graphql 和 Keycloak。所有 3 个项目都在一个 Docker 堆栈中运行,其中 stack.yml 如下:
version: '3.7'
services:
timescale-primary:
image: timescale-replication:latest
env_file:
- primary.env
networks:
- public-network
ports:
- 5432:5432
volumes:
- timescale-primary-storage:/var/lib/postgresql/data
deploy:
placement:
constraints:
- node.labels.type == primary
timescale-replica:
image: timescale-replication:latest
env_file:
- replica.env
networks:
- public-network
volumes:
- timescale-replica-storage:/var/lib/postgresql/data
deploy:
placement:
constraints:
- node.labels.type != primary
hasura:
image: hasura/graphql-engine
networks:
- public-network
ports:
- 6080:8080
env_file:
- hasura.env
volumes:
- hasura-storage:/var/lib/hasura
depends_on:
- timescale-primary
keycloak:
image: keycloak
networks:
- public-network
ports:
- 9080:8080
env_file:
- keycloak.env
volumes:
- keycloak-storage:/opt/jboss/keycloak/themes
depends_on:
- timescale-primary
tomcat:
image: tomcat:v1
networks:
- public-network
ports:
- 8086:8080
volumes:
- tomcat-storage:/usr/local/tomcat/webapps:Z
- tomcat-log-storage:/var/log/tomcat:Y
networks:
public-network:
volumes:
timescale-primary-storage:
timescale-replica-storage:
hasura-storage:
keycloak-storage:
tomcat-storage:
tomcat-log-storage:
SpringBoot webapp 是一个在 http://tomcat:8080/backend 下运行的 graphql 服务器。 ,React 应用程序部署在 http://tomcat:8080/ui 下.
在 Hasura 内部,我设置了一个远程架构来指向该服务器:http://tomcat:8080/backend/graphql ,转发所有客户端 header 。
基本上,React 应用程序通过 Hasura 间接访问“后端”。
在 Keycloak 中,我为“ui”应用程序设置了一个公共(public)客户端,为“后端”应用程序设置了一个 secret 客户端。
然后我得到的身份验证流程如下:
- 在 docker 主机上,调用 http://localhost:8086/ui
- 转发到 localhost:9080/auth/...(Keycloak 的登录屏幕)
- 登录成功后,重定向至“ui”应用
- React 应用调用 Hasura
- Hasura 调用“后端”并获取“无法验证 token ”、“授权 header 无效,有关详细信息,请参阅 WWW-Authenticate header ”
2019-12-09 02:47:59.163 DEBUG 1 --- [io-8080-exec-30] o.k.adapters.PreAuthActionsHandler : adminRequest http://tomcat:8080/backend/graphql
2019-12-09 02:47:59.164 DEBUG 1 --- [io-8080-exec-30] f.KeycloakAuthenticationProcessingFilter : Request is to process authentication
2019-12-09 02:47:59.164 DEBUG 1 --- [io-8080-exec-30] f.KeycloakAuthenticationProcessingFilter : Attempting Keycloak authentication
2019-12-09 02:47:59.165 TRACE 1 --- [io-8080-exec-30] o.k.adapters.RequestAuthenticator : --> authenticate()
2019-12-09 02:47:59.165 TRACE 1 --- [io-8080-exec-30] o.k.adapters.RequestAuthenticator : try bearer
2019-12-09 02:47:59.165 DEBUG 1 --- [io-8080-exec-30] o.k.a.BearerTokenRequestAuthenticator : Found [1] values in authorization header, selecting the first value for Bearer.
2019-12-09 02:47:59.165 DEBUG 1 --- [io-8080-exec-30] o.k.a.BearerTokenRequestAuthenticator : Verifying access_token
2019-12-09 02:47:59.165 TRACE 1 --- [io-8080-exec-30] o.k.a.BearerTokenRequestAuthenticator : access_token: eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJyb1NzQ2I1VWJPeDYyZHltWThzUm9qR2lGMHpINDJXQWdOU0JFd0Q2TEFFIn0.eyJqdGkiOiIyOWJlZmQ4MC04NGU3LTQ5NzMtOGQyMS0zOWE3ZTZiZjZiMjMiLCJleHAiOjE1NzU4NTk5NzksIm5iZiI6MCwiaWF0IjoxNTc1ODU5Njc5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjkwODAvYXV0aC9yZWFsbXMvdGQyMSIsInN1YiI6ImRlNWM2NjRhLWY0NTQtNDI0NC05OTY4LWJmYzAwZDg2YjA2ZSIsInR5cCI6IkJlYXJlciIsImF6cCI6InRkMjEtd2ViLXVpIiwibm9uY2UiOiJmZWE1NjE4My1kNDE2LTQ3NTktOWI0Yi1kNzI1NTVjZTA5OTAiLCJhdXRoX3RpbWUiOjE1NzU4NTg5NDksInNlc3Npb25fc3RhdGUiOiJiMmY2MjBhMC00MDRjLTRiYTctOGNlYy04OGQ2Y2Y3MDZmZmUiLCJhY3IiOiIwIiwiYWxsb3dlZC1vcmlnaW5zIjpbIioiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIkFETUlOIl19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhZG1pbiJ9.signature
2019-12-09 02:47:59.167 DEBUG 1 --- [io-8080-exec-30] o.k.a.BearerTokenRequestAuthenticator : Failed to verify token
2019-12-09 02:47:59.167 DEBUG 1 --- [io-8080-exec-30] o.k.adapters.RequestAuthenticator : Bearer FAILED
2019-12-09 02:47:59.167 DEBUG 1 --- [io-8080-exec-30] f.KeycloakAuthenticationProcessingFilter : Auth outcome: FAILED
2019-12-09 02:47:59.167 DEBUG 1 --- [io-8080-exec-30] f.KeycloakAuthenticationProcessingFilter : Authentication request failed: org.keycloak.adapters.springsecurity.KeycloakAuthenticationException: Invalid authorization header, see WWW-Authenticate header for details
org.keycloak.adapters.springsecurity.KeycloakAuthenticationException: Invalid authorization header, see WWW-Authenticate header for details
at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter.attemptAuthentication(KeycloakAuthenticationProcessingFilter.java:158) ~[keycloak-spring-security-adapter-7.0.0.jar:7.0.0]
如果我将 React 和 Springboot 应用程序放入直接安装在 Docker 主机上的 Tomcat 中,则后端的身份验证就可以了。仅当所有内容都部署到 Docker 中时才会出现此问题。
我是 Keycloak 和 Docker 的新手,非常感谢任何帮助。
最佳答案
为了进行身份验证,React 应用程序和 springboot 应用程序的 Keycloak URL 必须相同。 IE。您不能将 localhost 用于其中一个,而将 Docker 容器名称用于另一个。
就我而言,可以使用公共(public) IP 或实际域名。
关于docker - 将Springboot webapp部署到Docker时Keycloak适配器无法验证 token ,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/59242073/