Kong API网关Oauth2 grant_type = password invalid_client错误,无论我如何更改

问题描述 投票:0回答:1

我一直在本地设置Kong并测试各种设置。目前,我在docker-compose内部运行kong,可以访问发出请求的网关。传递这些环境变量

environment:
  - KONG_ADMIN_ACCESS_LOG=/dev/stdout
  - KONG_ADMIN_ERROR_LOG=/dev/stderr
  - KONG_PROXY_ACCESS_LOG=/dev/stdout
  - KONG_PROXY_ERROR_LOG=/dev/stderr
  - KONG_DATABASE=postgres
  - KONG_ADMIN_LISTEN=0.0.0.0:8001
  - KONG_PG_DATABASE=kong
  - KONG_PG_HOST=postgres.me.io
  - KONG_PG_USER=username
  - KONG_PG_PASSWORD=password
  - KONG_TRUSTED_IPS=0.0.0.0/0
  - VIRTUAL_HOST=kong.me.io
  - VIRTUAL_PORT=8080

我正在尝试使用grant_type=password设置oauth2插件。我经常遇到invalid_client错误,日志中什么也没有,只能真正告诉我发生了什么。我尝试了以下https://github.com/Kong/kong/issues/2446,没有任何运气,即使删除client_id也不起作用。似乎没有其他信息可以指示发生了什么。我已将trusted_ips添加到环境中,因此我不会在ssl上运行它,如果您没有给出Must use https的错误。我在做这项工作时做错了什么?这似乎是最简单的实现,但它什么都不喜欢。

为后端api路由添加服务

http POST http://kong.me.io:8001/services name=me.io.apis host=api.me.io port:=5000

HTTP/1.1 201 Created
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 300
Content-Type: application/json; charset=utf-8
Date: Fri, 22 Nov 2019 22:33:54 GMT
Server: kong/1.4.0
X-Kong-Admin-Latency: 232

{
    "client_certificate": null,
    "connect_timeout": 60000,
    "created_at": 1574462034,
    "host": "api.me.io",
    "id": "6f12367c-d92b-4334-a654-8f2d706b70e6",
    "name": "me.io.apis",
    "path": null,
    "port": 5000,
    "protocol": "http",
    "read_timeout": 60000,
    "retries": 5,
    "tags": null,
    "updated_at": 1574462034,
    "write_timeout": 60000
}

为后端api路径创建路由

http POST http://kong.me.io:8001/services/6f12367c-d92b-4334-a654-8f2d706b70e6/routes hosts:='["api.me.io"]' paths:='["/apis"]'

HTTP/1.1 201 Created
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 417
Content-Type: application/json; charset=utf-8
Date: Fri, 22 Nov 2019 22:34:29 GMT
Server: kong/1.4.0
X-Kong-Admin-Latency: 22

{
    "created_at": 1574462069,
    "destinations": null,
    "headers": null,
    "hosts": [
        "api.me.io"
    ],
    "https_redirect_status_code": 426,
    "id": "92ff918e-2a05-4768-866e-3a3061d563e4",
    "methods": null,
    "name": null,
    "paths": [
        "/apis"
    ],
    "preserve_host": false,
    "protocols": [
        "http",
        "https"
    ],
    "regex_priority": 0,
    "service": {
        "id": "6f12367c-d92b-4334-a654-8f2d706b70e6"
    },
    "snis": null,
    "sources": null,
    "strip_path": true,
    "tags": null,
    "updated_at": 1574462069
}

在后端路由上创建Oauth插件

http POST http://kong.me.io:8001/services/6f12367c-d92b-4334-a654-8f2d706b70e6/plugins name=oauth2 config:='{"enable_password_grant": true, "accept_http_if_already_terminated": true}'

HTTP/1.1 201 Created
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 682
Content-Type: application/json; charset=utf-8
Date: Fri, 22 Nov 2019 22:35:19 GMT
Server: kong/1.4.0
X-Kong-Admin-Latency: 139

{
    "config": {
        "accept_http_if_already_terminated": true,
        "anonymous": null,
        "auth_header_name": "authorization",
        "enable_authorization_code": false,
        "enable_client_credentials": false,
        "enable_implicit_grant": false,
        "enable_password_grant": true,
        "global_credentials": false,
        "hide_credentials": false,
        "mandatory_scope": false,
        "provision_key": "uijq0y4dBFZITqirZ9QJr18DeHjaMpXS",
        "refresh_token_ttl": 1209600,
        "scopes": null,
        "token_expiration": 7200
    },
    "consumer": null,
    "created_at": 1574462119,
    "enabled": true,
    "id": "c3d21c32-9062-49bd-a2b0-66b4fa6ac320",
    "name": "oauth2",
    "protocols": [
        "grpc",
        "grpcs",
        "http",
        "https"
    ],
    "route": null,
    "run_on": "first",
    "service": {
        "id": "6f12367c-d92b-4334-a654-8f2d706b70e6"
    },
    "tags": null
}

创建要测试的使用者

http POST http://kong.me.io:8001/consumers [email protected] custom_id=5b6215eed6814902e4d53d24

HTTP/1.1 201 Created
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 162
Content-Type: application/json; charset=utf-8
Date: Fri, 22 Nov 2019 22:37:29 GMT
Server: kong/1.4.0
X-Kong-Admin-Latency: 20

{
    "created_at": 1574462249,
    "custom_id": "5b6215eed6814902e4d53d24",
    "id": "f1b5fb00-df6e-4089-b4b8-639ceb4e6a80",
    "tags": null,
    "username": "[email protected]"
}

向测试使用者添加客户ID

http POST http://kong.me.io:8001/consumers/f1b5fb00-df6e-4089-b4b8-639ceb4e6a80/oauth2 name='[email protected]'

HTTP/1.1 201 Created
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 295
Content-Type: application/json; charset=utf-8
Date: Fri, 22 Nov 2019 22:41:21 GMT
Server: kong/1.4.0
X-Kong-Admin-Latency: 29

{
    "client_id": "03N4ehIbe44hYhnjGwO8hfW8jTHnxLSL",
    "client_secret": "nfW39yTNiDEVShtVIHovjC1aXm1VlxPd",
    "consumer": {
        "id": "f1b5fb00-df6e-4089-b4b8-639ceb4e6a80"
    },
    "created_at": 1574462481,
    "id": "d533d1ad-3d2b-47ef-af87-33f7b14dbb88",
    "name": "[email protected]",
    "redirect_uris": null,
    "tags": null
}

测试您是否可以从香港取回钥匙

http POST http://api.me.io:8080/apis/oauth2/token "x-forwarded-proto: https" authenticated_userid="5b6215eed6814902e4d53d24" client_id="03N4ehIbe44hYhnjGwO8hfW8jTHnxLSL" client_secret="nfW39yTNiDEVShtVIHovjC1aXm1VlxPd" grant_type=password provision_key="uijq0y4dBFZITqirZ9QJr18DeHjaMpXS" username="[email protected]" password="password" -vv

POST /apis/oauth2/token HTTP/1.1
Accept: application/json, */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 301
Content-Type: application/json
Host: api.me.io:8080
User-Agent: HTTPie/1.0.2
x-forwarded-proto: https

{
    "authenticated_userid": "5b6215eed6814902e4d53d24",
    "client_id": "03N4ehIbe44hYhnjGwO8hfW8jTHnxLSL",
    "client_secret": "nfW39yTNiDEVShtVIHovjC1aXm1VlxPd",
    "grant_type": "password",
    "password": "password",
    "provision_key": "uijq0y4dBFZITqirZ9QJr18DeHjaMpXS",
    "username": "[email protected]"
}

HTTP/1.1 400 Bad Request
Connection: keep-alive
Content-Length: 78
Content-Type: application/json; charset=utf-8
Date: Fri, 22 Nov 2019 22:45:14 GMT
Server: kong/1.4.0
X-Kong-Response-Latency: 25
cache-control: no-store
pragma: no-cache

{
    "error": "invalid_client",
    "error_description": "Invalid client authentication"
}
nginx oauth-2.0 api-gateway kong kong-plugin
1个回答
0
投票

您需要在Consumer凭证oauth中添加重定向URL,或在本教程https://medium.com/@far3ns/kong-oauth-2-0-plugin-38faf938a468#f9d5中调用的应用程序,如果这样做,它将不属于该重定向URL

local allowed_redirect_uris, client = get_redirect_uris(client_id)
    if not (grant_type == GRANT_CLIENT_CREDENTIALS) then
      if allowed_redirect_uris then
        local redirect_uri = parameters[REDIRECT_URI] and
          parameters[REDIRECT_URI] or
          allowed_redirect_uris[1]

        if not table_contains(allowed_redirect_uris, redirect_uri) then
          response_params = {
            [ERROR] = "invalid_request",
            error_description = "Invalid " .. REDIRECT_URI .. " that does " ..
              "not match with any redirect_uri created "  ..
              "with the application"
          }
        end
© www.soinside.com 2019 - 2024. All rights reserved.