OryHydra403帶反向代理

我正在嘗試讓 Ory Hydra 使用 Nginx 在 Docker-Compose 中作業。由于我的迭代方法，在添加 Nginx 之前我已經有了一個作業系統。換句話說，它可以作業，但現在不行。

我認為可能會影響此程序的更改是：Nginx、Hydra 的主機名、我的演示應用程式中的 oauth2 配置。此外，我的設定基于Kratos-Hydra 集成演示。當然，現在也可以從 Nginx 訪問 Kratos 和 UI，因此顯然也發生了變化，但我認為這不會導致問題。

因此，當我嘗試在演示應用程式中訪問安全端點時，會發生以下情況：

• 重定向到 kratos-ui 進行登錄
• 輸入詳細資訊并發送請求
• 登錄成功
• Hydra 回傳 403：不允許您執行此操作。

Nginx：

# kratos-selfservice-ui-node
server {
    server_name self.localhost;

    proxy_set_header Host self.localhost;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://self:3000;
    }
}

# kratos
server {
    server_name login.localhost;

    #proxy_set_header Host ...;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://kratos:4433;
    }
}

#hydra
server {
    server_name oidc.localhost;

    #proxy_set_header Host 127.0.0.1:4444;
    #proxy_set_header Host oidc.localhost;
    #proxy_set_header X-Real-IP $remote_addr;
    #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://hydra:4444;
    }
}

要求：

GET /oauth2/auth?client_id=auth-code-client&login_verifier=8b5f6d3f964c4470ab2e42fac90ae1c2&nonce=XTr2FJETXFsr6kxw3SlZsbh7rbQ_RMw8SdK3MeMCAs0&redirect_uri=http://localhost:8080/login/oauth2/code/hydra&response_type=code&scope=openid profile&state=4OSX7C_A84-u-6MlUZOlzjAAXiBYIzbKGfGwcAp1n1M= HTTP/1.1
Host: hydra:4444
User-Agent: <stuff>
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://self.localhost/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

docker-compose 中的 Hydra 條目：

  # OIDC Server
  # Configured to use Kratos for identities
  hydra:
    image: oryd/hydra:v1.6.0-alpine
    container_name: hydra
    depends_on:
      - hydra-migrate
    #ports:
      #- 4444:4444 # Public port
      #- 4445:4445 # Admin port
      #- 5555:5555 # Port for hydra token user
    command:
      serve all --dangerous-force-http
    volumes:
      -
        type: bind
        source: ./config/hydra
        target: /home/ory
    environment:
      - DSN=postgres://pguser:secret@postgres:5432/hydra?sslmode=disable
      - OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public,pairwise
      - LOG_LEAK_SENSITIVE_VALUES=true
      ##- URLS_SELF_ISSUER=http://127.0.0.1:4444
      ##- URLS_SELF_PUBLIC=http://127.0.0.1:4444
      #- URLS_SELF_ISSUER=http://hydra:4444
      #- URLS_SELF_PUBLIC=http://hydra:4444
      - URLS_SELF_ISSUER=http://oidc.localhost
      - URLS_SELF_PUBLIC=http://oidc.localhost
      - URLS_CONSENT=http://self.localhost/auth/hydra/consent
      - URLS_LOGIN=http://self.localhost/auth/hydra/login
      - URLS_LOGOUT=http://self.localhost/logout
      - SECRETS_SYSTEM=youReallyNeedToChangeThis
      - OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=youReallyNeedToChangeThis
      - OAUTH2_EXPOSE_INTERNAL_ERRORS=true;
      - OAUTH2_INCLUDE_LEGACY_ERROR_FIELDS=true
    restart: on-failure
    networks:
      - <ory>

Spring Boot 應用程式配置：

spring:
  security:
    oauth2:
      client:
        registration:
          hydra:
            client-name: Demo OIDC Client with Spring Boot :D
            client-id: auth-code-client
            client-secret: secret
        provider:
          hydra:
            issuer-uri: http://oidc.localhost/

And here's the client that I created:

docker exec hydra \
    hydra clients create \
    --endpoint http://127.0.0.1:4445 \
    --id auth-code-client \
    --secret secret \
    --grant-types authorization_code,refresh_token \
    --response-types code,id_token \
    --scope openid,profile \
    --callbacks http://localhost:8080/login/oauth2/code/hydra

/etc/hosts stuff I added:

# Dev stuff
127.0.0.1   self.localhost
127.0.0.1   login.localhost
127.0.0.1   oidc.localhost
127.0.0.1   oidc-demo.localhost
127.0.0.1   hello.localhost

Hydra logs:

  < THIS IS FROM THE INITIAL REQUEST TO THE KRATOS UI >
time=2022-01-24T12:49:00Z level=info msg=started handling request http_request=map[headers:map[accept:text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:response_type=code&client_id=auth-code-client&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4=&redirect_uri=http://localhost:8080/login/oauth2/code/hydra remote:192.168.16.11:43608 scheme:http]

time=2022-01-24T12:49:00Z level=info msg=access allowed audience=audit http_request=map[headers:map[accept:text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:response_type=code&client_id=auth-code-client&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4=&redirect_uri=http://localhost:8080/login/oauth2/code/hydra remote:192.168.16.11:43608 scheme:http] service_name=ORY Hydra service_version=v1.6.0

time=2022-01-24T12:49:00Z level=info msg=completed handling request http_request=map[headers:map[accept:text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:response_type=code&client_id=auth-code-client&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4=&redirect_uri=http://localhost:8080/login/oauth2/code/hydra remote:192.168.16.11:43608 scheme:http] http_response=map[status:302 text_status:Found took:15.9869ms]

time=2022-01-24T12:49:00Z level=info msg=started handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:GET path:/oauth2/auth/requests/login query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54218 scheme:http]

time=2022-01-24T12:49:00Z level=info msg=completed handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:GET path:/oauth2/auth/requests/login query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54218 scheme:http] http_response=map[status:200 text_status:OK took:3.034ms]

 < THIS IS AFTER LOGIN >

time=2022-01-24T12:49:59Z level=info msg=started handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:GET path:/oauth2/auth/requests/login query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54292 scheme:http]

time=2022-01-24T12:49:59Z level=info msg=completed handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:GET path:/oauth2/auth/requests/login query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54292 scheme:http] http_response=map[status:200 text_status:OK took:3.7631ms]

time=2022-01-24T12:49:59Z level=info msg=started handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:PUT path:/oauth2/auth/requests/login/accept query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54296 scheme:http]

time=2022-01-24T12:49:59Z level=info msg=completed handling request http_request=map[headers:map[accept:application/json] host:hydra:4445 method:PUT path:/oauth2/auth/requests/login/accept query:login_challenge=3a6891edb669434f821a0d5413519bfe remote:192.168.16.2:54296 scheme:http] http_response=map[status:200 text_status:OK took:8.8812ms]

time=2022-01-24T12:49:59Z level=info msg=started handling request http_request=map[headers:map[accept:text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache referer:http://self.localhost/ user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:client_id=auth-code-client&login_verifier=fedb596a040648b8b626e0f7e4f3f04a&redirect_uri=http://localhost:8080/login/oauth2/code/hydra&response_type=code&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4= remote:192.168.16.11:43694 scheme:http]

time=2022-01-24T12:49:59Z level=info msg=access denied audience=audit error=map[message:request_forbidden reason:You are not allowed to perform this action. status:Forbidden status_code:403] http_request=map[headers:map[accept:text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache referer:http://self.localhost/ user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:client_id=auth-code-client&login_verifier=fedb596a040648b8b626e0f7e4f3f04a&redirect_uri=http://localhost:8080/login/oauth2/code/hydra&response_type=code&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4= remote:192.168.16.11:43694 scheme:http] service_name=ORY Hydra service_version=v1.6.0

time=2022-01-24T12:49:59Z level=info msg=completed handling request http_request=map[headers:map[accept:text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 accept-encoding:gzip, deflate accept-language:en-US,en;q=0.5 cache-control:no-cache referer:http://self.localhost/ user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:client_id=auth-code-client&login_verifier=fedb596a040648b8b626e0f7e4f3f04a&redirect_uri=http://localhost:8080/login/oauth2/code/hydra&response_type=code&state=-__end_skoEpW7KSAfzng1yZyOdJoF2-Cfzls-dccD4= remote:192.168.16.11:43694 scheme:http] http_response=map[status:302 text_status:Found took:8.6448ms]

Update

In the course of trying out everything before posting this question to stackoverflow.com, I went back to an older git commit which was working.

$ docker exec hydra_hydra_1 \                  
    hydra token user \
    --client-id auth-code-client \
    --client-secret secret \
    --endpoint http://127.0.0.1:4444/ \
    --port 5555 \
    --scope openid,offline 
Config file not found because "Config File ".hydra" Not Found in "[/home/ory]""
Setting up home route on http://127.0.0.1:5555/
Setting up callback listener on http://127.0.0.1:5555/callback
Press ctrl   c on Linux / Windows or cmd   c on OSX to end the process.
If your browser does not open automatically, navigate to:

    http://127.0.0.1:5555/

 < then I navigate to 127.0.0.1:5555, click on authorize application, I have to enter log in details, and then I get redirected to an error page >

Got error: The request is not allowed
http: Server closed

An error occurred
request_forbidden

The request is not allowed

You are not allowed to perform this action.

Something that seems odd is that the app always asks me to log in, even if I am logged in already when I go to the UI url manually. I remember that if I was already logged in, it wouldn't ask me to log in again?

Update

出于某種原因，我在 hydra-integration 分支上，而不是 hydra-integration-2021，這就是為什么回到基礎不起作用的原因。那是我的錯誤。

實際專案不起作用，但在重新評估所需的作業和好處/缺點/要求后，我決定從 Kratos 切換到werther。

uj5u.com熱心網友回復：

為了讓這一點更加理智，我首先會更新到良好的內部和外部 URL。問題的癥結在于您需要使用瀏覽器等中使用的 Internet URL 配置 Ory Hydra（在集群內運行），這與 Ory Hydra 的物理 URL 不同。

類似的例子

這感覺與您的設定類似 - 如果您花一點時間了解資源，我希望它能幫助您解決問題并規劃部署。

• 碼頭工人撰寫
• 教程文章
• 授權服務器配置

查看上面第三個鏈接頂部的 base-url 屬性，這是 Internet 客戶端（例如瀏覽器）用于連接到授權服務器的內容。您可以在 Hydra 中設定這樣的屬性。

標籤：

上一篇：DjangoAPI端點504僅在經過身份驗證時超時

下一篇：Nginxpod在自簽名證書示例中使用其偵聽埠進行回應