Question

我正在尝试让Ruby Oauth2.0客户端与Ory Hydra docker-compose 5分钟演示进行交谈。我被困在客户端应用程序的令牌的身份验证代码交换上。 LOG在下面。看起来主要的问题是以下“ hashedPassword不是给定密码的哈希”。

HYDRA服务器的调试日志


time="2019-06-04T21:32:09Z" level=info msg="started handling request" method=POST remote="172.19.0.2:35482" request=/oauth2/token
hydra_1

time="2019-06-04T21:32:09Z" level=error msg="An error occurred" debug="crypto/bcrypt: hashedPassword is not the hash of the given password" description="Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method)" error=invalid_client
hydra_1

time="2019-06-04T21:32:09Z" level=info msg="completed handling request" measure#hydra/public: http://127.0.0.1:4444/.latency=92931900 method=POST remote="172.19.0.2:35482" request=/oauth2/token status=401 text_status=Unauthorized took=92.9319ms

我已经读过here，看来这是“可能”。

这是我在hydra中注册客户端“ test-app9”的方式：

docker-compose -f quickstart.yml exec hydra hydra clients create --endpoint http://127.0.0.1:4445 --id test-app9 --secret secret--skip-tls-verify --grant-types authorization_code,refresh_token,client_credentials,implicit --response-types token,code,id_token --scope profile --callbacks http://127.0.0.1:8088/auth/callback --token-endpoint-auth-method client_secret_post -g client_credentials

我确实可以从docker-compose演示中看到客户端出现在postgres DB中。密码“秘密”在数据库中散列了。

这是我作为Oauth2.0客户端的单个Sinatra文件：

require 'rubygems'
require 'sinatra'
require 'oauth2'
require 'json'

OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

# If you add your authentication in the header then use ~Sclient_secret_basic~T
# If you add your authentication details in the post use ~Sclient_secret_post~T

def client
  OAuth2::Client.new('test-app9',
                     'secret',
#                     'c2VjcmV0',
                     :site => "http://127.0.0.1:4445",
                     :logger => Logger.new('example.log'),
                     :authorize_url => "http://127.0.0.1:4444/oauth2/auth",
                     :token_url => "http://hydra:4444/oauth2/token")
end

set :root, File.dirname(__FILE__)
set :views, Proc.new { File.join(root, "views") }
set :run, true
set :port, 80

get "/" do
  erb :index
end

get '/auth' do
  authorization_url = client.auth_code.authorize_url(:redirect_uri => redirect_uri, :response_type => "code", :scope => "profile", :state => "pqrst1234")
  puts "Redirecting to URL: #{authorization_url.inspect}"
  redirect authorization_url
end

get '/auth/callback' do
  begin
    access_token = client.auth_code.get_token(params[:code], :redirect_uri => redirect_uri, :client_id => "test-app9", :client_secret => 'secret', :headers => {'Authorization' => 'basic_auth_header', 'client_id' => 'test-app9', 'client_secret' => 'c2VjcmV0'} )
    api_url = "/me.json"
    me = JSON.parse(access_token.get(api_url).body)
    erb "<p>Your data:\n#{me.inspect}</p>"
  rescue OAuth2::Error => e
    erb %(<p>Wassup #{$!}</p><p><a href="/auth">Retry</a></p>)
  end
end

get '/auth/failure' do
  erb "<h1>Authentication Failed:</h1><h3>message:<h3> <pre>#{params}</pre>"
end

def redirect_uri(path = '/auth/callback', query = nil)
  uri = URI.parse(request.url)
  uri.path  = path
  uri.query = query
  uri.to_s
end

__END__

一些有趣的注释：

显然，我使用哪个OAuth2客户端启动秘密。我可以使用“秘密”或base64编码的“ c2VjcmV0”字符串。无论哪种方式，我都会进入令牌交换部分。
我很努力，最终以我认为是在标头和正文中设置的正确方法放置client_id和client_secret。

我已经尝试了许多变体。似乎无法获得author of this显然成功的正确语法，或者我遇到了一个错误（可疑）。

有人可以在这里帮助吗？

更新自己修复此问题。问题是创建客户端“应用”时的语法问题。这是更正的版本。

docker-compose -f quickstart.yml exec hydra hydra clients create --endpoint http://127.0.0.1:4445 --id test-app10 --secret secret --skip-tls-verify --grant-types authorization_code,refresh_token,client_credentials,implicit --response-types token,code,id_token --scope profile --callbacks http://127.0.0.1:8088/auth/callback --token-endpoint-auth-method client_secret_post -g client_credentials

Ruby Oauth2.0：client_secret_post无法与Ory Hyda一起使用

0 个答案: