负载均衡器“令牌 endpoints 的无效HTTP请求”-Java 学习之路

我在负载均衡器后面有一个IdentityServer问题，
为了清楚我是否正在使用直接ips，evertything按预期工作 .

目前我在LB上有一个SSL配置，其中包含一个有效的证书，该证书可重定向到托管在2台Linux机器上的HTTP docker-engines .

我在我的客户端上使用MVC混合流程：

app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
{
    AuthenticationScheme = "oidc",
    SignInScheme = "Cookies",
    Authority = settings.Server,
    RequireHttpsMetadata = "false",
    ClientId = "MyMvcClient",
    ClientSecret = "MyMvcSuperPassword",
    ResponseType =  "code id_token",
    GetClaimsFromUserInfoEndpoint = true,
    SaveTokens = true,
    TokenValidationParameters = new TokenValidationParameters
    {
        NameClaimType = JwtClaimTypes.Name,
        RoleClaimType = JwtClaimTypes.Role,
    },
    Events = new OpenIdConnectEvents()
    {
        OnRemoteFailure = context =>
        {
            context.Response.Redirect("/error");
            context.HandleResponse();
            return Task.FromResult(0);
        }
    },
    "Scope": { "openid", "profile", "email", "myclient", "offline_access" }
});

在服务器端，我有以下设置：

public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<IdentityDbContext>(builder);
    services.AddIdentity<ApplicationUser, ApplicationRole>()
        .AddEntityFrameworkStores<IdentityDbContext, Guid>()
        .AddUserStore<UserStore<ApplicationUser, ApplicationRole, IdentityDbContext, Guid>>()
        .AddRoleStore<RoleStore<ApplicationRole, IdentityDbContext, Guid>>()
        .AddUserManager<LdapUserManager>()
        .AddSignInManager<LdapSignInManager>()
        .AddDefaultTokenProviders()
        .AddIdentityServerUserClaimsPrincipalFactory();
    ...
    string redisSettings = $"{redisHost}:{redisPort},ssl={redisSsl},abortConnect={redisAbortConnect},password={redisPassword}";
    services.AddDataProtection().PersistKeysToRedis(redis, redisKey);
    ...
    // Adds IdentityServer
    services.AddIdentityServer()
        .AddSigningCredential(new X509Certificate2("IdentityServerAuth.pfx"))
        .AddConfigurationStore(builder)
        .AddOperationalStore(builder)
        .AddAspNetIdentity<ApplicationUser>()
        .AddProfileService<IdentityProfileService>();
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory, IServiceProvider serviceProvider)
{
    app.UseIdentity();
    app.UseForwardedHeaders(new ForwardedHeadersOptions
    {
        ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
    });
    // Adds IdentityServer
    app.UseIdentityServer();
}

正如我已经提到的，它适用于没有Load balancer的配置，但客户端失败并显示错误“Message contains error：'invalid_request'，error_description：'error_description为null'，error_uri：'error_uri为null' . ”

在服务器端，我收到信息：IdentityServer4.Hosting.IdentityServerMiddleware [0]调用IdentityServer endpoints ：IdentityServer4.Endpoints.TokenEndpoint for / connect / token warn：IdentityServer4.Endpoints.TokenEndpoint [0]无效的令牌 endpoints 的HTTP请求

1 回答

0
我已经解决了这个问题 . 找到的解决方案是跟踪Request.HttpContext.Connection.RemoteIpAddress它是无效的，并且等于负载均衡器的IP . 所以解决方案是使用以下方法添加Ip：
```
options.KnownProxies.Clear();
options.KnownProxies.Add(IPAddress.Parse("LoadBalancer IP"));
app.UseForwardedHeaders(options);
```
或通过掩码，例如192.168.1.0/8：
```
options.KnownNetworks.Clear();
options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("192.168.1.0"), 8));
app.UseForwardedHeaders(options);
```
在这种情况下，客户端的IP将传递给身份服务器，您将不会收到异常：
```
Invalid HTTP request for token endpoint
```
回复于 2024-05-03T15:09:14+08:00

负载均衡器“令牌 endpoints 的无效HTTP请求”

1 回答

相关问题