Question

完成以下设置：

我分别为postgres数据库，java应用程序，keycloak和nginx-server（运行angularjs-app）创建了一个docker-container。

使用docker-compose，结果设置为：

version: '3.3'
services:
  nginx:
    build:
      context: frontend
    image: 127.0.0.1:5000/abe_frontend
    ports:
      - "80:80"
    logging:
      driver: "json-file"
      options:
        max-size: "100k"
        max-file: "10"
    restart: unless-stopped

  backend:
    build:
      context: backend
    image: 127.0.0.1:5000/abe_backend
    volumes:
      - ./data/abe_backend/data:/abedata
    expose:
      - "8080"
    depends_on:
      - postgres
    environment:
      SPRING_PROFILES_ACTIVE: docker
      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/abe_db
      DB_USER: abe_user
      DB_PASSWORD: test
      KEYCLOAK_ENABLED: "true"
      KEYCLOAK_URL: "http://keycloak:8080/auth"
     KEYCLOAK_REALM: abe
      KEYCLOAK_RESOURCE: "abe_backend"
    logging:
      driver: "json-file"
      options:
        max-size: "100k"
        max-file: "10"
    restart: unless-stopped


  postgres:
    build:
      context: postgres
    image: 127.0.0.1:5000/abe_postgres
    volumes:
      - ./data/postgres/data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    environment:
      POSTGRES_DB: postgres
      POSTGRES_USER: admin
      POSTGRES_PASSWORD: "test"
      PG_DATA: "/var/lib/postgresql/data/pgdata"
      KEYCLOAK_DB: "keycloak_db"
      KEYCLOAK_DB_USER: "keycloak_admin"
      KEYCLOAK_DB_PASSWORD: "test"
      ABE_DB: "abe_db"
      ABE_DB_USER: "abe_user"
      ABE_DB_PASSWORD: "test"
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"

  keycloak:
    build:
      context: keycloak
    image: 127.0.0.1:5000/abe_keycloak
#    expose:
#      - "8080"
    ports:
      - "8282:8080"
    depends_on:
      - postgres
    environment:
      DB_VENDOR: "POSTGRES"
      DP_PORT: "5432"
      DB_ADDR: "postgres"
      DB_DATABASE: "keycloak_db"
      DB_USER: "keycloak_admin"
      DB_PASSWORD: "test"
      KEYCLOAK_USER: "admin"
      KEYCLOAK_PASSWORD: "test"
      PROXY_ADDRESS_FORWARDING: "true"
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"

从keycloak服务器上下载了angularjs.app中的

keycloak.json：

{
  "realm": "abe",
  "auth-server-url": "http://localhost:8282/auth/",
  "ssl-required": "external",
  "resource": "abe_frontend",
  "public-client": true,
  "confidential-port": 0
}

反向nginx代理传递对前端和密钥斗篷的请求：

location /service {
    include /etc/nginx/cors.conf;
    proxy_set_header Host $host;
    proxy_pass http://backend:8080/;
}

location /auth/ {
    proxy_pass http://keycloak:8080/auth/;
    proxy_set_header    Host               $host;
    proxy_set_header    X-Real-IP          $remote_addr;
    proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Host   $host;
    proxy_set_header    X-Forwarded-Server $host;
    proxy_set_header    X-Forwarded-Port   $server_port;
    proxy_set_header    X-Forwarded-Proto  $scheme;
}

现在，当我在localhost：80中启动angularjs-app时，后端容器的控制台输出中出现以下错误：

 Failed to verify token: org.keycloak.common.VerificationException: Invalid token issuer. Expected 'http://keycloak:8080/auth/realms/abe', but was 'http://localhost:8282/auth/realms/abe'

Answer 1

由于您在Keycloak和前端都有代理，因此必须使用它，并确保令牌发行者，身份验证服务器和url相同。

假设您通过代理（localhost：80）访问应用程序，那么在您的情况下，有效的配置可能是：

"auth-server-url": "http://localhost/auth/"

和

location /auth/ {
    ...
    proxy_set_header    Host               localhost
    proxy_set_header    X-Forwarded-Host   localhost
    ...
}

为了使事情变得更好和更好，您稍后需要在拥有代理主机名或公共DNS名称后，而不是localhost。

反向代理后面的密钥斗篷验证失败

1 个答案: