使用tWAS

时间：2019-04-18 08:19:53

标签： websphere openid-connect ibm-appid websphere-9

我正在尝试配置App ID和tWAS之间的集成。我已经遵循了App ID服务的“概述”，并使用提供的示例成功地使用Liberty进行了配置，但是tWAS的相同配置失败。我已经做了：

  • 使用以下道具配置了TAI：

    provider_1.identifier=app-idp
provider_1.clientId=xxx
provider_1.clientSecret=zzz
provider_1.authorizeEndpointUrl=https://eu-gb.appid.cloud.ibm.com/...
provider_1.tokenEndpointUrl=https://eu-gb.appid.cloud.ibm.com/oauth/...
provider_1.signatureAlgorithm=RS256
provider_1.jwkEndpointUrl= https://eu-gb.appid.cloud.ibm.com/oauth/...
provider_1.interceptedPathFilter=/appContext
provider_1.redirectToRPHostAndPort=https://host:443
provider_1.tokenEndpointAuthMethod=basic
provider_1.issuerIdentifier=https://eu-gb.appid.cloud.ibm.com/oauth...

  • 已安装的OIDCRP

当我尝试登录时，我已正确重定向到App ID登录页面，但是在提供凭据后，它将重定向并显示403 Forbidden。

这是堆栈跟踪，任何提示可能是错误的或我缺少了什么？

 [4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU <  getSecuredConnection returns [not null] Exit
 [4/17/19 16:51:28:016 UTC] 000000bf SessionCache  3   getOpServerConnTimeout returns [20000])
 [4/17/19 16:51:28:016 UTC] 000000bf RelyingParty  3   getRevokeEndpoint returns [null]
 [4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU 3   isRevokeEndpoint[false]
 [4/17/19 16:51:28:016 UTC] 000000bf RelyingParty  3   getTokenEndpointAuthMethod returns [basic]
 [4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU 3   Setting [Authorization] property on request with basicauth info
 [4/17/19 16:51:28:016 UTC] 000000bf RelyingParty  3   getClientBasicAuth returns [Basic OGExZmM2NjQtYTY3Zi00YTk4LWJmM2YtN2E0N2FmYjE4NTdlOk5XTmhaVGN5TVRFdFlUbGhaaTAwTlRkbUxXRTNOemd0TVdSa1lXVTVNelkxTXpWaw==]
 [4/17/19 16:51:28:105 UTC] 000000bf RelyingPartyU 3   Response code: 403
 [4/17/19 16:51:28:105 UTC] 000000bf RelyingPartyU >  getData(inStream[not null]) Entry
 [4/17/19 16:51:28:108 UTC] 000000bf RelyingPartyU <  getData returns [<!DOCTYPE html>
 ....
 [4/17/19 16:51:28:110 UTC] 000000bf RelyingParty  E   CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
 [4/17/19 16:51:28:111 UTC] 000000bf WebAuthentica E   SECJ0126E: Trust Association failed during validation. The exception is com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
         at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:526)
         at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:301)
         at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
         at com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(WebAuthenticator.java:438)
         at com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthenticator.java:3103)
         at com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectIfNeeded(WebCollaborator.java:3522)
         at com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborator.java:851)
         at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebCollaborator.java:447)
         at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
         at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preInvokeCollaborators(CollaboratorHelper.java:436)
         at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1091)
         at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4217)
         at com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppImpl.java:2208)
         at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:304)
         at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1030)
         at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
         at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
         at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
         at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
         at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
         at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
         at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1187)
         at com.ibm.ws.ssl.channel.impl.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:694)
         at com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1833)
         at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
         at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
         at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
         at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
         at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
         at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
         at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
         at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
 . Make sure that the setup is correct and that the user credentials are valid.
 [4/17/19 16:51:28:116 UTC] 000000bf WebCollaborat A   SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.

也尝试过将auth方法更改为

provider_1.tokenEndpointAuthMethod=post

但结果相同，并附加来自通话trace1.txt的完整跟踪

更新

在进行更改和一些更改之后，我对设置进行了进一步的调整。我已将此设置重置为“基本” 

provider_1.tokenEndpointAuthMethod=Basic

现在错误是：

[4/18/19 12:07:58:638 UTC] 000000a6 WebCollaborat A   SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]]. Check the logs for details that lead to this exception.

跟踪显示：

[4/18/19 12:07:58:614 UTC] 000000a6 JWT           E   CWWKS1756E: Validation failed for the ID token requested by [....] using the [RS256] algorithm due to a signature verification failure: [JsonObject].
[4/18/19 12:07:58:617 UTC] 000000a6 SessionData   3   Failed to validate id token, exception thrown during verify [JsonObject]

[4/18/19 12:07:58:629 UTC] 000000a6 WebAuthentica E   SECJ0126E: Trust Association failed during validation. The exception is com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]]. Check the logs for details that lead to this exception.
        at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:532)
        at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:301)
        at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
        at com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(WebAuthenticator.java:438)
        at com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthenticator.java:3171)
        at com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectIfNeeded(WebCollaborator.java:3522)
        at com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborator.java:851)
        at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebCollaborator.java:447)
        at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
        at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preInvokeCollaborators(CollaboratorHelper.java:436)
        at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1091)
        at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4217)
        at com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppImpl.java:2208)
        at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:304)
        at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1030)
        at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
        at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
        at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
        at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
        at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
        at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
        at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1187)
        at com.ibm.ws.ssl.channel.impl.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:694)
        at com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1833)
        at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
        at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
        at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
        at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
        at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
        at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
        at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
        at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
Caused by: com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]
        at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:483)
        at com.ibm.ws.security.oidc.client.SessionData.processJSON(SessionData.java:236)
        at com.ibm.ws.security.oidc.client.SessionData.createData(SessionData.java:166)
        at com.ibm.ws.security.oidc.client.SessionData.<init>(SessionData.java:137)
        at com.ibm.ws.security.oidc.client.SessionCache.createEntry(SessionCache.java:184)
        at com.ibm.ws.security.oidc.client.RelyingPartyUtils.createSessionDataObject(RelyingPartyUtils.java:1299)
        at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:529)
        ... 31 more
Caused by: java.lang.UnsupportedOperationException: JsonObject
        at com.google.gson.JsonElement.getAsString(JsonElement.java:191)
        at com.ibm.ws.security.openidconnect.token.JsonTokenUtil.fromJsonToken(JsonTokenUtil.java:154)
        at com.ibm.ws.security.openidconnect.token.JWT.fromJsonToken(JWT.java:553)
        at com.ibm.ws.security.openidconnect.token.JWT.verify(JWT.java:886)
        at com.ibm.ws.security.openidconnect.token.IDToken.verify(IDToken.java:578)
        at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:471)
        ... 37 more

2 个答案:

答案 0 :(得分：1)

您的日志表明，错误地将您的服务器标识为潜在的安全风险之后，我们对String[] args = new String[] {"bash","/home/cery/workspace/pytorch-CycleGAN-and-pix2pix/photo.sh"}; Process proc = Runtime.getRuntime().exec(args); 端点的请求已被阻止。 我们已经略微更改了配置，请重试，如果您仍然遇到任何问题，请告知我们。

谢谢，
塔尔

从您的日志中-

/token

答案 1 :(得分：1)

在tWAS OIDC Client中发现一个错误，该错误在解析非平面JSON结构JWT时将其崩溃。 tWAS团队正在解决此问题。

相关问题
最新问题