密钥泄漏:访问令牌验证端点 [英] Keycloak: Access token validation end point

问题描述

以独立模式运行密钥斗篷，并使用用于验证api调用的node.js适配器创建了微服务.

Running keycloak on standalone mode.and created a micro-service by using node.js adapter for authenticating api calls.

jwt令牌与每个api调用一起发送.只有发送的令牌是有效令牌时，它才会响应.

jwt token from the keyclaok is sending along with each api calls. it will only respond if the token sent is a valid one.

• 我如何验证微服务中的访问令牌?
• keycloak是否提供任何令牌验证?

推荐答案

在 troger19的答案上进行扩展:

问题1:如何验证微服务中的访问令牌?

Question 1: How can I validate the access token from the micro service?

实现一个功能，以检查每个对承载令牌的请求，并在将该令牌传递给api的路由处理程序之前，将该令牌发送给您的keycloak服务器在userinfo端点进行验证.

Implement a function to inspect each request for a bearer token and send that token off for validation by your keycloak server at the userinfo endpoint before it is passed to your api's route handlers.

通过请求众所周知的配置，您可以找到密钥斗篷服务器的特定终结点(例如userinfo路由).

You can find your keycloak server's specific endpoints (like the userinfo route) by requesting its well-known configuration.

如果您在节点api中使用expressjs，则可能如下所示:

If you are using expressjs in your node api this might look like the following:

const express = require("express");
const request = require("request");

const app = express();

/*
 * additional express app config
 * app.use(bodyParser.json());
 * app.use(bodyParser.urlencoded({ extended: false }));
 */

const keycloakHost = 'your keycloak host';
const keycloakPort = 'your keycloak port';
const realmName = 'your keycloak realm';

// check each request for a valid bearer token
app.use((req, res, next) => {
  // assumes bearer token is passed as an authorization header
  if (req.headers.authorization) {
    // configure the request to your keycloak server
    const options = {
      method: 'GET',
      url: `https://${keycloakHost}:${keycloakPort}/auth/realms/${realmName}/protocol/openid-connect/userinfo`,
      headers: {
        // add the token you received to the userinfo request, sent to keycloak
        Authorization: req.headers.authorization,
      },
    };

    // send a request to the userinfo endpoint on keycloak
    request(options, (error, response, body) => {
      if (error) throw new Error(error);

      // if the request status isn't "OK", the token is invalid
      if (response.statusCode !== 200) {
        res.status(401).json({
          error: `unauthorized`,
        });
      }
      // the token is valid pass request onto your next function
      else {
        next();
      }
    });
  } else {
    // there is no token, don't process request further
    res.status(401).json({
    error: `unauthorized`,
  });
});

// configure your other routes
app.use('/some-route', (req, res) => {
  /*
  * api route logic
  */
});


// catch 404 and forward to error handler
app.use((req, res, next) => {
  const err = new Error('Not Found');
  err.status = 404;
  next(err);
});

问题2:Keycloak是否提供令牌验证?

Question 2: Is there any token validation availed by Keycloak?

向Keycloak的userinfo端点进行请求是一种验证令牌有效的简便方法.

Making a request to Keycloak's userinfo endpoint is an easy way to verify that your token is valid.

来自有效令牌的用户信息响应:

状态:200 OK

Status: 200 OK

{
    "sub": "xxx-xxx-xxx-xxx-xxx",
    "name": "John Smith",
    "preferred_username": "jsmith",
    "given_name": "John",
    "family_name": "Smith",
    "email": "[e-mail]"
}

来自无效的有效令牌的用户信息响应:

状态:401未经授权

Status: 401 Unauthorized

{
    "error": "invalid_token",
    "error_description": "Token invalid: Token is not active"
}

其他信息:

Keycloak提供了自己的npm软件包，称为 keycloak-connect .该文档描述了路由上的简单身份验证，要求用户登录才能访问资源:

Keycloak provides its own npm package called keycloak-connect. The documentation describes simple authentication on routes, requiring users to be logged in to access a resource:

app.get( '/complain', keycloak.protect(), complaintHandler );

我还没有发现这种方法仅适用于仅承载身份验证.以我的经验，在路由上实施这种简单的身份验证方法会导致访问被拒绝"响应. 此问题还询问如何使用Keycloak访问令牌对rest api进行身份验证. 已接受的答案建议使用keycloak-connect提供的简单身份验证方法，但要在Alex的评论中指出:

I have not found this method to work using bearer-only authentication. In my experience, implementing this simple authentication method on a route results in an "access denied" response. This question also asks about how to authenticate a rest api using a Keycloak access token. The accepted answer recommends using the simple authentication method provided by keycloak-connect as well but as Alex states in the comments:

"keyloak.protect()函数(不)从以下位置获取承载令牌 标头.我仍在寻找仅做承载的解决方案 身份验证– Alex 17年11月2日在14:02

"The keyloak.protect() function (doesn't) get the bearer token from the header. I'm still searching for this solution to do bearer only authentication – alex Nov 2 '17 at 14:02

这篇关于密钥泄漏:访问令牌验证端点的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！