带反向代理的Ory Hydra 403 [英] Ory Hydra 403 With Reverse Proxy

查看：21
本文介绍了带反向代理的Ory Hydra 403的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我正在尝试让Ory Hydra在Docker-Compose with Nginx中工作。由于我的迭代方法，在添加Nginx之前，我已经有了一个工作系统。换句话说，它以前是有效的，现在却不起作用了。

我认为可能会影响此过程的更改包括：nginx、Hydra的主机名、我的演示应用程序中的OAuth2配置。另外，我的设置基于Kratos-Hydra integration demo。当然，Kratos和用户界面现在也可以从Nginx访问，所以显然也发生了变化，但我不认为这会造成问题。

因此，当我尝试访问我的演示应用程序中的安全终结点时，会发生以下情况：

  • 重定向至kratos-用户界面进行登录
  • 输入详细信息并发送请求
  • 登录成功
  • 九头蛇返回403：不允许您执行此操作。

nginx：

# kratos-selfservice-ui-node
server {
    server_name self.localhost;

    proxy_set_header Host self.localhost;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://self:3000;
    }
}

# kratos
server {
    server_name login.localhost;

    #proxy_set_header Host ...;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://kratos:4433;
    }
}

#hydra
server {
    server_name oidc.localhost;

    #proxy_set_header Host 127.0.0.1:4444;
    #proxy_set_header Host oidc.localhost;
    #proxy_set_header X-Real-IP $remote_addr;
    #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://hydra:4444;
    }
}

请求：

GET /oauth2/auth?client_id=auth-code-client&login_verifier=8b5f6d3f964c4470ab2e42fac90ae1c2&nonce=XTr2FJETXFsr6kxw3SlZsbh7rbQ_RMw8SdK3MeMCAs0&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin%2Foauth2%2Fcode%2Fhydra&response_type=code&scope=openid+profile&state=4OSX7C_A84-u-6MlUZOlzjAAXiBYIzbKGfGwcAp1n1M%3D HTTP/1.1
Host: hydra:4444
User-Agent: <stuff>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://self.localhost/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

docker-compose中的九头蛇条目：

  # OIDC Server
  # Configured to use Kratos for identities
  hydra:
    image: oryd/hydra:v1.6.0-alpine
    container_name: hydra
    depends_on:
      - hydra-migrate
    #ports:
      #- 4444:4444 # Public port
      #- 4445:4445 # Admin port
      #- 5555:5555 # Port for hydra token user
    command:
      serve all --dangerous-force-http
    volumes:
      -
        type: bind
        source: ./config/hydra
        target: /home/ory
    environment:
      - DSN=postgres://pguser:secret@postgres:5432/hydra?sslmode=disable
      - OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public,pairwise
      - LOG_LEAK_SENSITIVE_VALUES=true
      ##- URLS_SELF_ISSUER=http://127.0.0.1:4444
      ##- URLS_SELF_PUBLIC=http://127.0.0.1:4444
      #- URLS_SELF_ISSUER=http://hydra:4444
      #- URLS_SELF_PUBLIC=http://hydra:4444
      - URLS_SELF_ISSUER=http://oidc.localhost
      - URLS_SELF_PUBLIC=http://oidc.localhost
      - URLS_CONSENT=http://self.localhost/auth/hydra/consent
      - URLS_LOGIN=http://self.localhost/auth/hydra/login
      - URLS_LOGOUT=http://self.localhost/logout
      - SECRETS_SYSTEM=youReallyNeedToChangeThis
      - OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=youReallyNeedToChangeThis
      - OAUTH2_EXPOSE_INTERNAL_ERRORS=true;
      - OAUTH2_INCLUDE_LEGACY_ERROR_FIELDS=true
    restart: on-failure
    networks:
      - <ory>

Spring Boot App配置：

spring:
  security:
    oauth2:
      client:
        registration:
          hydra:
            client-name: Demo OIDC Client with Spring Boot :D
            client-id: auth-code-client
            client-secret: secret
        provider:
          hydra:
            issuer-uri: http://oidc.localhost/

这是我创建的客户端：

docker exec hydra 
    hydra clients create 
    --endpoint http://127.0.0.1:4445 
    --id auth-code-client 
    --secret secret 
    --grant-types authorization_code,refresh_token 
    --response-types code,id_token 
    --scope openid,profile 
    --callbacks http://localhost:8080/login/oauth2/code/hydra

/etc/host我添加的内容：

# Dev stuff
127.0.0.1   self.localhost
127.0.0.1   login.localhost
127.0.0.1   oidc.localhost
127.0.0.1   oidc-demo.localhost
127.0.0.1   hello.localhost

九头蛇日志：

  < THIS IS FROM THE INITIAL REQUEST TO THE KRATOS UI >
time=2022-01-24T12:49:00Z level=info msg=started handling request http_request=map[headers:map[accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:response_type=code&client_id=auth-code-client&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4%3D&redirect_uri=http://localhost:8080/login/oauth2/code/hydra remote:192.168.16.11:43608 scheme:http]

time=2022-01-24T12:49:00Z level=info msg=access allowed audience=audit http_request=map[headers:map[accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:response_type=code&client_id=auth-code-client&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4%3D&redirect_uri=http://localhost:8080/login/oauth2/code/hydra remote:192.168.16.11:43608 scheme:http] service_name=ORY Hydra service_version=v1.6.0

time=2022-01-24T12:49:00Z level=info msg=completed handling request http_request=map[headers:map[accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:response_type=code&client_id=auth-code-client&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4%3D&redirect_uri=http://localhost:8080/login/oauth2/code/hydra remote:192.168.16.11:43608 scheme:http] http_response=map[status:302 text_status:Found took:15.9869ms]

time=2022-01-24T12:49:00Z level=info msg=started handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:GET path:/oauth2/auth/requests/login query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54218 scheme:http]

time=2022-01-24T12:49:00Z level=info msg=completed handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:GET path:/oauth2/auth/requests/login query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54218 scheme:http] http_response=map[status:200 text_status:OK took:3.034ms]

 < THIS IS AFTER LOGIN >

time=2022-01-24T12:49:59Z level=info msg=started handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:GET path:/oauth2/auth/requests/login query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54292 scheme:http]

time=2022-01-24T12:49:59Z level=info msg=completed handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:GET path:/oauth2/auth/requests/login query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54292 scheme:http] http_response=map[status:200 text_status:OK took:3.7631ms]

time=2022-01-24T12:49:59Z level=info msg=started handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:PUT path:/oauth2/auth/requests/login/accept query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54296 scheme:http]

time=2022-01-24T12:49:59Z level=info msg=completed handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:PUT path:/oauth2/auth/requests/login/accept query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54296 scheme:http] http_response=map[status:200 text_status:OK took:8.8812ms]

time=2022-01-24T12:49:59Z level=info msg=started handling request http_request=map[headers:map[accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache referer:http://self.localhost/ user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:client_id=auth-code-client&login_verifier=fedb596a040648b8b626e0f7e4f3f04a&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin%2Foauth2%2Fcode%2Fhydra&response_type=code&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4%3D remote:192.168.16.11:43694 scheme:http]

time=2022-01-24T12:49:59Z level=info msg=access denied audience=audit error=map[message:request_forbidden reason:You are not allowed to perform this action. status:Forbidden status_code:403] http_request=map[headers:map[accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache referer:http://self.localhost/ user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:client_id=auth-code-client&login_verifier=fedb596a040648b8b626e0f7e4f3f04a&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin%2Foauth2%2Fcode%2Fhydra&response_type=code&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4%3D remote:192.168.16.11:43694 scheme:http] service_name=ORY Hydra service_version=v1.6.0

time=2022-01-24T12:49:59Z level=info msg=completed handling request http_request=map[headers:map[accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache referer:http://self.localhost/ user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:client_id=auth-code-client&login_verifier=fedb596a040648b8b626e0f7e4f3f04a&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin%2Foauth2%2Fcode%2Fhydra&response_type=code&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4%3D remote:192.168.16.11:43694 scheme:http] http_response=map[status:302 text_status:Found took:8.6448ms]

更新

在将此问题发布到stackoverflow.com之前尝试所有内容的过程中，我重新使用了一个运行正常的较旧的GIT提交。

坏消息，它不再起作用了。我签出并构建了官方的kratos-九头蛇集成($ git status -> On branch hydra-integration Your branch is up to date with 'origin/hydra-integration'.)，并执行了所需的步骤，现在我得到了如下结果：

$ docker exec hydra_hydra_1                   
    hydra token user 
    --client-id auth-code-client 
    --client-secret secret 
    --endpoint http://127.0.0.1:4444/ 
    --port 5555 
    --scope openid,offline 
Config file not found because "Config File ".hydra" Not Found in "[/home/ory]""
Setting up home route on http://127.0.0.1:5555/
Setting up callback listener on http://127.0.0.1:5555/callback
Press ctrl + c on Linux / Windows or cmd + c on OSX to end the process.
If your browser does not open automatically, navigate to:

    http://127.0.0.1:5555/

 < then I navigate to 127.0.0.1:5555, click on authorize application, I have to enter log in details, and then I get redirected to an error page >

Got error: The request is not allowed
http: Server closed

浏览器不会添加太多信息：

An error occurred
request_forbidden

The request is not allowed

You are not allowed to perform this action.

我尝试删除所有容器、图像、卷和网络、浏览器cookie、使用不同的浏览器、重新启动docker、重新启动我的计算机。同样的问题。

奇怪的是，应用程序总是要求我登录，即使当我手动转到用户界面URL时我已经登录了。我记得如果我已经登录了，它不会要求我再次登录？

更新

出于某种原因，我在水力学集成分支上，而不是在水力学集成-2021，这就是为什么回到基础上不起作用的原因。那是我的错误。

实际项目没有工作，但在重新评估了所需的工作和优点/缺点/要求后，我决定从Kratos切换到werther。

推荐答案

要使这一点保持正常，我首先要更新为良好的内部和外部URL。问题的症结在于，您需要使用浏览器等中使用的互联网URL来配置Ory Hydra(在集群内运行)，这将与Ory Hydra的物理URL不同。

类似的安全示例

这感觉与您的设置类似-值得花点时间来了解资源：

查看上面第三个链接顶部的base-url属性，浏览器等Internet客户端使用该属性连接到授权服务器。您可以在Hydra中设置类似这样的属性。

这篇关于带反向代理的Ory Hydra 403的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！

查看全文
相关文章
其他开发最新文章
热门教程
热门工具
登录 关闭
扫码关注1秒登录
发送“验证码”获取 | 15天全站免登陆