如何配置Keycloak以与Guacamole的OpenID插件一起使用？

Question

我正在尝试使用 KeyCloak 设置 Apache Guacamole 作为 OpenID Connect 授权服务器。

Guacamole 正在将我重定向到 KeyCloak，我可以使用我在 KeyCloak 上创建的用户登录，然后我会被重定向回 Guacamole，但那里显示我的令牌无效

08:08:11.477 [http-nio-4432-exec-7] INFO  o.a.g.a.o.t.TokenValidationService - Rejected invalid OpenID token: Unable to process JOSE object (cause: org.jose4j.lang.UnresolvableKeyException: Unable to find a suitable verification key for JWS w/ header {"alg":"RS256","typ" : "JWT","kid" : "8ZNpgh_vnmG0HMMNYdOz1lw4ECoWxmsiUGte1mJfvyI"} due to an unexpected exception (javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty) while obtaining or using keys from JWKS endpoint at https://172.16.47.229:12345/auth/realms/Guacamole-test/protocol/openid-connect/certs): JsonWebSignature{"alg":"RS256","typ" : "JWT","kid" : "8ZNpgh_vnmG0HMMNYdOz1lw4ECoWxmsiUGte1mJfvyI"}->eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI4Wk5wZ2hfdm5tRzBITU1OWWRPejFsdzRFQ29XeG1zaVVHdGUxbUpmdnlJIn0.eyJleHAiOjE2MDIzOTczODgsImlhdCI6MTYwMjM5NjQ4OCwiYXV0aF90aW1lIjoxNjAyMzk2NDcwLCJqdGkiOiI5Y2RiZDVjZC01MDJhLTRjNmItYTM3Mi1jZDIxMTNjNTE1NTMiLCJpc3MiOiJodHRwczovLzE3Mi4xNi40Ny4yMjk6MTIzNDUvYXV0aC9yZWFsbXMvR3VhY2Ftb2xlLXRlc3QiLCJhdWQiOiJHdWFjYW1vbGUiLCJzdWIiOiI1YzQ3N2NiZC04ZjIzLTRlMjEtYmNhMi1kMzNlMTRhZGY0ZDYiLCJ0eXAiOiJJRCIsImF6cCI6Ikd1YWNhbW9sZSIsIm5vbmNlIjoiaTQyZDBpZTc4c2s0MjRjMHJzMmJvdTM4YnUiLCJzZXNzaW9uX3N0YXRlIjoiMjNlZjdhMTYtMDhhNS00YTNkLTgxYTItYTQ2ZmE1NmM1NjE3IiwiYWNyIjoiMCIsImlzX3N1cGVydXNlciI6IlRydWUiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsIm5hbWUiOiJ0ZXN0IHRlc3QiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0dXNlciIsImdpdmVuX25hbWUiOiJ0ZXN0IiwiZmFtaWx5X25hbWUiOiJ0ZXN0IiwiZW1haWwiOiJ0ZXN0QHRlc3QuY29tIn0.eOhkDqcgfdJnO12PRDqLIHACRNVdVHoSDFjThHWc6Ug1gdoz9t_T2K7F_B6dJSbNygAJrGvc5BVRx9XCJH1fVFSYhpXVqCO0jrHm0XJKhw_kBce4x3ZluGAtktx614j9qFzUwZHXOkFAUGPtyPQKuRTfdzHqQUILLJhVdSRPmou40rX31-l7VwqWZk_Yp1JCdQsA61XvJcQrU_aiKivZFaDGiY5GrnpL8zcEwJcFemptVoGKrG63O_LjxDCxhLpO1C1fi8GjngMSfco9aAp4AaGpHWy8ofJAu-TWbLGf-UPLUhC3lf903-Q_BU3eehYxtMyN1eet0HeGm0x_gV_wvA

在KeyCloak中我创建了一个客户端，如下所示：

（一旦我让它工作，将更改有效重定向 URI）

我的鳄梨酱.properites 看起来像这样：

guacd-port: 4822
guacd-hostname: localhost

# OpenID Connect Properties
openid-authorization-endpoint: https://172.16.47.229:12345/auth/realms/Guacamole-test/protocol/openid-connect/auth
openid-jwks-endpoint: https://172.16.47.229:12345/auth/realms/Guacamole-test/protocol/openid-connect/certs
openid-issuer: https://172.16.47.229:12345/auth/realms/Guacamole-test
openid-client-id: Guacamole
openid-redirect-uri: http://172.16.47.229:4432/guacamole/

# Postgresql Properties
postgresql-hostname: 172.16.47.229
postgresql-port: 4444
postgresql-database: guacamoledb
postgresql-username: guacamoleuser
postgresql-password: test

我需要更改什么才能让鳄梨酱接受令牌？

更新：如果我使用带有 HTTP 而不是 HTTPS 的 KeyCloak，我发现配置可以正常工作，但这是不可取的。我现在还配置了鳄梨酱，或者更准确地说是托管鳄梨酱的 tomcat，以使用 https，但我仍然无法让它工作（无需为 KeyCloak 使用 HTTP）。

Answer 1

我也发现了同样的问题。最有可能的是，您只需为您的 IdP (Keycloak) 提供有效的 SSL 证书即可。

在这里找到了可能的解决方法：如何配置 Keycloak 以与 Guacamole 的 OpenID 插件一起使用？.

我已经重新编译了

guacamole-auth-openid

扩展并进行了此更改：

diff --git a/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java b/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
index 5efb09dab..27d818ee5 100644
--- a/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
+++ b/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
@@ -79,6 +79,7 @@ public class TokenValidationService {
 
         // Create JWT consumer for validating received token
         JwtConsumer jwtConsumer = new JwtConsumerBuilder()
+               .setSkipSignatureVerification()
                 .setRequireExpirationTime()
                 .setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
                 .setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())

这解决了问题。不要认为它适用于生产需求，但在生产中不应使用自签名证书。

Answer 2

使用 Guacamole 1.4.0 和 Keycloak 15.0.2，我通过在 Guacamole 容器中安装自定义

cacerts

密钥库修复了 HTTPS 问题。此自定义密钥库只是 OpenJDK 8

cacerts

，其中导入了 Let's Encrypt CA 捆绑包 https://letsencrypt.org/certs/isrgrootx1.pem。因为我的 Keycloak 和 Guacamole 实例使用 Let's Encrypt 证书。

在主机上我安装了 OpenJDK 8。所以 Docker 挂载是

/etc/ssl/certs/java/cacerts:/usr/local/openjdk-8/jre/lib/security/cacerts

Answer 3

大家好有人找到解决方案吗 [2024-04-01 09:00:23] [info] 09:00:23.078 [https-openssl-nio-8443-exec-2] INFO o.a.g.a.o.t.TokenValidationService - 拒绝无效的 OpenID 令牌：JWT 处理失败。其他详细信息：[[17] 无法处理 JOSE 对象（原因：org.jose4j.lang.UnresolvableKeyException：无法为带有标头的 JWS 找到合适的验证密钥 {"alg":"RS256","typ" : "JWT ","kid" : "9mvGVLLmC3DvztD5vONttZXcQXw-3jhVf23Hy9hL5KE"} 由于意外异常 (javax.net.ssl.SSLHandshakeException: PKIX 路径构建失败: sun.security.provider.certpath.SunCertPathBuilderException: unabl e 找到请求目标的有效证书路径），同时从 JWKS 端点获取或使用密钥（https://keycloak:8443/realms/access_managment/protocol/openid-connect/certs）： JsonWebSignature{"alg":"RS256", “典型”：“JWT”，“孩子”：“9mvGVLLmC3DvztD5vONttZXcQXw-3jhVf23Hy9hL5KE”}->eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI5bXZHVkxMbUMzRHZ6dEQ1dk9OdHR AWGNRWHctM2poVmYyM0h5OWhMNUtFIN0..CBmBUIt3FKuTQc6isaZLQ8j9Ovq9cznK4Fwew8JNXFaq_GxPYNNsbUanZS1R7u3-Oq6p9THEIcmSA_rfujnaE-mTjBEtQfpoGPSnInJBS023RJsvB4W2rbEE6 LUWu6wkvBpNt-ne2Ts5wU2J8FH1e4F-5H6CgbUEZdPu4lcoMyy2xH5tPfUQBXsMgFF_vH9uhTgYx-39_caqTc5BQAe6OLoqeLxn8KDmFUYa0Ew-w2sB4NNx2AuZ0tW10xLSKefkNvuD ZvEC3M0SqwtB61rXm3vm6ToYKQidnhRlwSDpcxiPmIVE9a_y1Sglq5603XnE2hriBP_-pKtrQkP6MiVixA]