如何配置两个反向代理后面的密钥斗篷？

时间：2019-05-29 14:42:42

标签： java apache reverse-proxy keycloak

我有一个关于Apache用作反向代理和Keycloak的问题。 除了我的反向代理外，还有另一个反向代理，供客户的应用程序使用。

我想登录Keycloak的管理控制台。 尝试在本地执行此操作可以按预期进行：http://localhost/application1/auth/admin/ 显示登录表单，我可以成功登录。

但是尝试从外部URL登录不起作用： https://externalurl.com/application1/auth/admin/

显示登录表单，我提交表单，然后再次显示（空）表单。 正确设置了Cookie AUTH_SESSION_ID，KC_RESTART，KEYCLOAK_IDENTITY和KEYCLOAK_SESSION。

Apache的access.log中的视图显示以下内容： （本地和工作电话）

10.1.7.192 - - [29/May/2019:11:16:27 +0200] "GET /auth/admin/master/console HTTP/1.1" 302 -
10.1.7.192 - - [29/May/2019:11:16:28 +0200] "GET /auth/admin/master/console/ HTTP/1.1" 200 8198
10.1.7.192 - - [29/May/2019:11:16:29 +0200] "GET /auth/admin/master/console/config HTTP/1.1" 200 195
10.1.7.192 - - [29/May/2019:11:16:29 +0200] "GET /auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fexternalurl.com%2Fapplication1%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=cef5a6cb-4327-45e7-8e97-0b3e74a27ea6&response_mode=fragment&response_type=code&scope=openid&nonce=35edfb09-a16a-41dc-83d6-453393e61391 HTTP/1.1" 200 3120
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "POST /auth/realms/master/login-actions/authenticate?session_code=5iqyNYW56tGETAGGHLEp54m5JbEXU4us-kDe1S1k10Q&execution=ee5e5166-6dcf-47d1-a130-521aaedfd08d&client_id=security-admin-console&tab_id=VF8WaW2--uM HTTP/1.1" 302 -
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/admin/master/console/ HTTP/1.1" 200 8198
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/admin/master/console/config HTTP/1.1" 200 195
--- differences start here
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/admin/master/console/ HTTP/1.1" 200 8198
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/admin/master/console/config HTTP/1.1" 200 195
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fexternalurl.com%2Fapplication1%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=8931d4e0-d9b6-41fc-92ef-1e937d5c7704&response_mode=fragment&response_type=code&scope=openid&nonce=fedd80bb-a5e0-4ea1-ad6e-77a8ab0b9938 HTTP/1.1" 200 3120

但是尝试从外部客户端我会收到此消息：

::1 - - [29/May/2019:11:14:54 +0200] "GET /application1/auth/admin/master/console HTTP/1.1" 302 -
::1 - - [29/May/2019:11:14:55 +0200] "GET /application1/auth/admin/master/console/ HTTP/1.1" 200 8198
::1 - - [29/May/2019:11:14:55 +0200] "GET /application1/auth/admin/master/console/config HTTP/1.1" 200 183
::1 - - [29/May/2019:11:14:55 +0200] "GET /application1/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=http%3A%2F%2Flocalhost%2Fapplication1%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=6815eac5-5809-4965-a802-b6ba9479a8d8&response_mode=fragment&response_type=code&scope=openid&nonce=852c3a37-90ed-4bdc-a9dd-50c4ec1291aa HTTP/1.1" 200 3108
::1 - - [29/May/2019:11:15:02 +0200] "POST /application1/auth/realms/master/login-actions/authenticate?session_code=Ehw_zcZmjJruVvIJiajTLqBbN49M7wbsRSoCi24y8MQ&execution=ee5e5166-6dcf-47d1-a130-521aaedfd08d&client_id=security-admin-console&tab_id=qV6HNXsVgtU HTTP/1.1" 302 -
::1 - - [29/May/2019:11:15:02 +0200] "GET /application1/auth/admin/master/console/ HTTP/1.1" 200 8198
::1 - - [29/May/2019:11:15:02 +0200] "GET /application1/auth/admin/master/console/config HTTP/1.1" 200 183
--- differences start here
::1 - - [29/May/2019:11:15:03 +0200] "POST /application1/auth/realms/master/protocol/openid-connect/token HTTP/1.1" 200 3102
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/admin/master/console/messages.json?lang=en HTTP/1.1" 200 116906
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/admin/master/console/whoami HTTP/1.1" 200 443
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/realms/master/protocol/openid-connect/login-status-iframe.html/init?client_id=security-admin-console&origin=http%3A%2F%2Flocalhost HTTP/1.1" 204 -
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/admin/serverinfo HTTP/1.1" 200 142210
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/admin/realms HTTP/1.1" 200 3113
::1 - - [29/May/2019:11:15:04 +0200] "GET /application1/auth/admin/realms/master HTTP/1.1" 200 3111
::1 - - [29/May/2019:11:15:04 +0200] "GET /application1/auth/admin/realms HTTP/1.1" 200 3113
::1 - - [29/May/2019:11:15:04 +0200] "GET /application1/auth/admin/realms HTTP/1.1" 200 3113
::1 - - [29/May/2019:11:15:04 +0200] "GET /application1/auth/admin/realms HTTP/1.1" 200 3113

当然，Keycloak的standalone.xml设置为：

<web-context>application1/auth</web-context>

和

<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true" proxy-address-forwarding="true"/>

最后是我的apache配置的相关部分：

DumpIOInput On
DumpIOOutput On
LogLevel debug
ForensicLog logs/forensic.txt

ProxyPreserveHost Off
RemoteIPHeader X-Forwarded-For

LogLevel debug

<LocationMatch "^/(application1/auth)/*">
    ProxyPass http://localhost:8180
    ProxyPassReverse http://localhost:8180
</LocationMatch>

<LocationMatch "^/(auth)/*">
    ProxyPass http://localhost:8180/application1
    ProxyPassReverse http://localhost:8180/application1
</LocationMatch>

###This reads the value of X-ORIG-HOST into TempValue
SetEnvIf X-ORIG-HOST ".+" TempValue=$0
###This will overwrite the value of "Host" if it was already set
RequestHeader set Host %{TempValue}e env=TempValue

ProxyPassReverseCookiePath "/application1/" "/"

有人可以帮助我，也可以给我提示下一个地方吗？ 谢谢！

1 个答案:

答案 0 :(得分：1)

类似的问题是在传递给keycloak的nginx代理之上有一个ssl反向代理（haproxy）。有了白页而不是管理控制台。显然，这是由于refreshpermissions js函数在keycloak上请求whoami api并获得401。尝试使用x转发的标头进行的所有操作均未成功。

相关问题
最新问题