Question

我正在尝试设置Nginx + Keycloak以保护我的Spring Boot微服务。

我希望配置以下结构

   internet ---https---> nginx --http--> keycloak and other protected microservices

                   keycloak <----http----> zuul and other microservices

我不知道如何设置nginx以正确地将原始https请求传递给http后端服务器

这是我的配置： NGINX

server {

    listen        443 ssl default_server;
    server_name   localhost; 

    ssl_certificate           /etc/nginx/localhost.crt;
    ssl_certificate_key       /etc/nginx/localhost.key;

    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    access_log            /var/log/nginx/ledgerrun.access.log;

    proxy_set_header        Host $host:443;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;

    # keycloak redirect 
    location /auth {
        proxy_pass       https://keycloak:8443;
    }

    location / {
        proxy_pass        http://192.168.1.15:15700;
    }

    # all /lr-servies redirect to 15700
    #location ~* ^/lr-(.*) {
    #    proxy_pass        https://192.168.1.15:15700;
    #}
}

Keycloak实例为https打开8443，为http打开8080。

Spring Cloud Zuul的配置如下

server:
  port: "15700"

keycloak:
   auth-server-url: "https://my.external.ip:8443/auth"
   realm: "LedgerRunCTP"
   public-client: true
   resource: gateway-service
   security-constraints[0]:
     authRoles[0]: "user"
     securityCollections[0]:
       name: "internal services"
       patterns[0]: "/swagger-ui.html"

我必须将“ auth-server-url”配置为https，因为客户端需要首先使用keycloak登录，并且非本地连接需要https。有没有一种方法可以仅将http用于密钥斗篷？
，一旦密钥库验证了用户身份，就会出现以下错误：

普通的HTTP请求已发送到HTTPS端口

要实现它的正确配置是什么

只有https到nginx

nginx后面的所有http

Nginx在Keycloak和本地微服务之前

0 个答案: