Java 使用反向代理背后的KeyClope进行身份验证失败

完成以下设置：

我已经为postgres数据库、java应用程序、Key斗篷和nginx服务器（运行angularjs应用程序）分别创建了一个docker容器

使用docker compose，生成的设置为：

version: '3.3'
services:
  nginx:
    build:
      context: frontend
    image: 127.0.0.1:5000/abe_frontend
    ports:
      - "80:80"
    logging:
      driver: "json-file"
      options:
        max-size: "100k"
        max-file: "10"
    restart: unless-stopped

  backend:
    build:
      context: backend
    image: 127.0.0.1:5000/abe_backend
    volumes:
      - ./data/abe_backend/data:/abedata
    expose:
      - "8080"
    depends_on:
      - postgres
    environment:
      SPRING_PROFILES_ACTIVE: docker
      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/abe_db
      DB_USER: abe_user
      DB_PASSWORD: test
      KEYCLOAK_ENABLED: "true"
      KEYCLOAK_URL: "http://keycloak:8080/auth"
     KEYCLOAK_REALM: abe
      KEYCLOAK_RESOURCE: "abe_backend"
    logging:
      driver: "json-file"
      options:
        max-size: "100k"
        max-file: "10"
    restart: unless-stopped


  postgres:
    build:
      context: postgres
    image: 127.0.0.1:5000/abe_postgres
    volumes:
      - ./data/postgres/data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    environment:
      POSTGRES_DB: postgres
      POSTGRES_USER: admin
      POSTGRES_PASSWORD: "test"
      PG_DATA: "/var/lib/postgresql/data/pgdata"
      KEYCLOAK_DB: "keycloak_db"
      KEYCLOAK_DB_USER: "keycloak_admin"
      KEYCLOAK_DB_PASSWORD: "test"
      ABE_DB: "abe_db"
      ABE_DB_USER: "abe_user"
      ABE_DB_PASSWORD: "test"
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"

  keycloak:
    build:
      context: keycloak
    image: 127.0.0.1:5000/abe_keycloak
#    expose:
#      - "8080"
    ports:
      - "8282:8080"
    depends_on:
      - postgres
    environment:
      DB_VENDOR: "POSTGRES"
      DP_PORT: "5432"
      DB_ADDR: "postgres"
      DB_DATABASE: "keycloak_db"
      DB_USER: "keycloak_admin"
      DB_PASSWORD: "test"
      KEYCLOAK_USER: "admin"
      KEYCLOAK_PASSWORD: "test"
      PROXY_ADDRESS_FORWARDING: "true"
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"

angularjs.app中的keydaveat.json是从keydaveat服务器下载的：

{
  "realm": "abe",
  "auth-server-url": "http://localhost:8282/auth/",
  "ssl-required": "external",
  "resource": "abe_frontend",
  "public-client": true,
  "confidential-port": 0
}

反向nginx代理传递前端和keydepeat请求：

location /service {
    include /etc/nginx/cors.conf;
    proxy_set_header Host $host;
    proxy_pass http://backend:8080/;
}

location /auth/ {
    proxy_pass http://keycloak:8080/auth/;
    proxy_set_header    Host               $host;
    proxy_set_header    X-Real-IP          $remote_addr;
    proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Host   $host;
    proxy_set_header    X-Forwarded-Server $host;
    proxy_set_header    X-Forwarded-Port   $server_port;
    proxy_set_header    X-Forwarded-Proto  $scheme;
}

现在，当我在localhost:80中启动angularjs应用程序时，后端容器的控制台输出中出现以下错误：

 Failed to verify token: org.keycloak.common.VerificationException: Invalid token issuer. Expected 'http://keycloak:8080/auth/realms/abe', but was 'http://localhost:8282/auth/realms/abe'

---

由于您在Key斗篷和前端前面有一个代理，因此必须使用它并确保令牌颁发者、身份验证服务器和url相同

假设您通过代理（localhost:80）访问应用程序，那么在您的情况下，有效的配置可能是：

"auth-server-url": "http://localhost/auth/"

及

---

为了让事情变得更干净、更好，您以后需要设置代理主机或公共DNS名称，而不是

localhost

当您的angular应用程序下载keydape.json时，它请求的URL是什么？如果您使用

keydepot:8080

验证颁发者，那么我认为您始终需要将keydepot服务器称为

keydeport:8080

，而不要称为

localhost:8282

。即使它可能在两个地址都响应，它也可能需要保持一致，以便令牌颁发者匹配预期的内容。这是我最好的猜测。我从localhost:8282下载了keydrope.json，是的，这是真的，当在keydrope.json中url设置为keydrope:8080时，那么在Chrome中请求时可以访问keydrope服务器itsnt。可能是因为nginx，它期望所有请求都是？可以设置KeyClope realms frontendURL来覆盖令牌中设置的颁发者。任何后续@user3133542？请继续关注我们正在解决的问题…您的解决方案无法解决问题…我仍然从上面得到验证异常

location /auth/ {
    ...
    proxy_set_header    Host               localhost
    proxy_set_header    X-Forwarded-Host   localhost
    ...
}