Question

我在Java中有一个无法使用Spring Cloud的旧版应用程序。它使用伪装客户端通过网关访问微服务。

网关和服务由带有OAuth2 / OIDC选项的jhipster 5.7.2生成。

在我的客户端中，一个RequestInterceptor调用keycloak以获得令牌（直接访问授权）并将其注入标头中。

我发出GET请求可以，但是在POST或PUT请求之后收到403。

CORS已在网关上启用（但未使用，因为该请求不是cors请求）。我在开发模式下运行它。 Zuul路线似乎还可以。我既没有在网关上也没有在服务上更改配置。

有人有主意吗？

在我的ign客以下：

public interface SmartDocumentClient {

@RequestLine("GET /api/ebox/test")
//@Headers("Content-Type: application/json")
public ResponseEntity<HasEboxResponse> test();

@RequestLine("POST /api/ebox/test")
@Headers("Content-Type: application/json")
public ResponseEntity<HasEboxResponse> testPost(HasEboxRequest request);

@RequestLine("PUT /api/ebox/test")
@Headers("Content-Type: application/json")
public ResponseEntity<HasEboxResponse> testPut(HasEboxRequest request); }

我的客户端配置：

T client = Feign.builder()
            .contract(new feign.Contract.Default()) //annotation openfeign pour éviter bug d'upload avec SpringMvc
            .client(new OkHttpClient())
            .encoder(new FormEncoder(new GsonEncoder())) //pour gérer le formData
            .decoder(new ResponseEntityDecoder(new ResponseEntityDecoder(new CustomFileDecoder(new CustomGsonDecoder()))))
            .requestInterceptor(interceptor)
            .options(new Request.Options(timeout, timeout))
            .target(SmartDocumentClient, url);

拦截器：

public class GedRequestInterceptor implements RequestInterceptor {

public static final String AUTHORIZATION = "Authorization";
public static final String BEARER = "Bearer";

private String authUrl;
private String user;
private String password;
private String clientId;
private String clientSecret;

private RestTemplate restTemplate;
private CustomOAuth2ClientContext oAuth2ClientContext;

public GedRequestInterceptor(String authUrl, String user, String password, String clientId, String clientSecret) {
    super();
    this.authUrl = authUrl;
    this.user = user;
    this.password = password;
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    restTemplate = new RestTemplate();
    //oAuth2ClientContext = new DefaultOAuth2ClientContext();
}

@Override
public void apply(RequestTemplate template) {
    // demander un token à keycloak et le joindre à la request
    Optional<String> token = getToken();
    if (token.isPresent()) {
        template.header(HttpHeaders.ORIGIN, "localhost");
        template.header(AUTHORIZATION, String.format("%s %s", BEARER, token.get()));
    }
}

private Optional<String> getToken() {
    if (oAuth2ClientContext.getAccessToken() == null || oAuth2ClientContext.getAccessToken().isExpired()) {
        MultiValueMap<String, String> map = new LinkedMultiValueMap<>();
        map.add("client_id", this.clientId);
        map.add("client_secret", this.clientSecret);
        map.add("grant_type", "password"); // client_credentials //password
        map.add("username", this.user);
        map.add("password", this.password);
        oAuth2ClientContext.setAccessToken(askToken(map));
    } 

    if (oAuth2ClientContext.getAccessToken() != null){
        return Optional.ofNullable(oAuth2ClientContext.getAccessToken().getValue());
    } else {
        return Optional.empty();
    }
}

private CustomOAuth2AccessToken askToken( MultiValueMap<String, String> map) {
        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);

        HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(map, headers);

        ResponseEntity<CustomOAuth2AccessToken> response = restTemplate.postForEntity(
                this.authUrl, request, CustomOAuth2AccessToken.class);

        if (response != null && response.hasBody()) {
            return response.getBody();
        } else {
            return null;
        }
}

}

最后是资源：

@RestController

@RequestMapping（“ / api”）公共类DocumentResource {

    private static String TMP_FILE_PREFIX = "smartdoc_tmp";

    public DocumentResource() {
    }

    @GetMapping("/ebox/test")
    public ResponseEntity<HasEboxResponse> test() {
            return ResponseEntity.ok(new HasEboxResponse());
    }

    @PostMapping("/ebox/test")
    public ResponseEntity<HasEboxResponse> testPost(@RequestBody HasEboxRequest request) {
            return ResponseEntity.ok(new HasEboxResponse());
    }

    @PutMapping("/ebox/test")
    public ResponseEntity<HasEboxResponse> testPut(@RequestBody HasEboxRequest request) {
            return ResponseEntity.ok(new HasEboxResponse());
    }

}

谢谢！

Answer 1

问题出在spring安全配置中。 WebSecurity不允许未经身份验证调用“ [SERVICE_NAME] / api”之类的网址。我添加了一条规则，允许对某些网址进行访问。如果标头中包含访问令牌，则zuul会将其转发给服务。

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring()
        .antMatchers("/ext/*/api/**") // allow calls to services, redirect by zuul
        .antMatchers(HttpMethod.OPTIONS, "/**")
        .antMatchers("/app/**/*.{js,html}")
        .antMatchers("/i18n/**")
        .antMatchers("/content/**")
        .antMatchers("/swagger-ui/index.html")
        .antMatchers("/test/**");
}

为了通过UI调用其他服务并让网关注入访问令牌，我在zuul配置中定义了两组路由，

routes:
    myservice: 
        path: /myservice/**
        serviceId: myservice
    myservice_ext: 
        path: /ext/myservice/**
        serviceId: myservice

/ ext / myService ...：通过Spring secu引用服务而不要忽略
/ myService ...：引用服务，但由spring secu处理

假冒客户端向微服务发出POST / PUT请求时出现错误403

1 个答案: