Fork me on GitHub

.NetCore下使用IdentityServer4 & JwtBearer认证授权在CentOS Docker容器中运行遇到的坑及填坑

今天我把WebAPI部署到CentOS Docker容器中运行,发现原有在Windows下允许的JWTBearer配置出现了问题

在Window下我一直使用这个配置,没有问题

 services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                  .AddJwtBearer(options =>
                  {
                      options.Authority = _authorityconfig.Authority;
                      options.RequireHttpsMetadata = _authorityconfig.RequireHttpsMetadata;
                      options.Audience = "userservicesapi"; //scope;                 
                  }) ;

但是到Docker中出现了500服务器内部错误,我通过swagger excute看下,已经成功颁发了jwt token了

为什么会出现这个情况呢?

我在docker中通过如下查看日志情况

docker logs --tail 1000 containerid & name

这是错误信息

fail: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[3]
      Exception occurred while processing message.
System.InvalidOperationException: IDX20803: Unable to obtain configuration from: 'http://192.168.0.212:40000/.well-known/openid-configuration'. ---> System.IO.IOException: IDX20804: Unable to retrieve document from: 'http://192.168.0.212:40000/.well-known/openid-configuration'. ---> System.Net.Http.HttpRequestException: No route to host ---> System.Net.Sockets.SocketException: No route to host
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.CreateConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.WaitForCreatedConnectionAsync(ValueTask`1 creationTask)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()

无法获取到这个配置

http://192.168.0.212:40000/.well-known/openid-configuration

于是我通过

curl http://192.168.0.212:40000/.well-known/openid-configuration

发现是能够得到的,后来发现原来是因为没有设置获取配置的地址的属性:MetadataAddress

于是我们设置好了最后发布到容器中,发现还是不行,依然有这个错误信息,于是我仔细看了下错误问题 下面这段:

at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)

这段貌似是需要配置OpenIdConnectConfiguration,没错,当时我感觉就是它了,心动异常,所以在代码里加上了配置

 services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                  .AddJwtBearer(options =>
                  {
                      options.Authority = _authorityconfig.Authority;
                      options.RequireHttpsMetadata = _authorityconfig.RequireHttpsMetadata;
                      options.Audience = "userservicesapi"; //scope;
                      options.MetadataAddress = _authorityconfig.Authority + "/.well-known/openid-configuration";
                      options.Configuration = new   Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfiguration();
                  });

红色部分为新加入的配置信息,这样我再次重新打包发布到Docker中,请求虽然没出现之前的错误,然而授权后请求授权保护接口提示签名错误,授权失败,纠结一段时间之后,我在仔细看了错误信息中的如下信息:

Unable to retrieve document from: 'http://192.168.0.212:40000/.well-known/openid-configuration'. 
---> System.Net.Http.HttpRequestException: No route to host ---> System.Net.Sockets.SocketException: No route to host

No route to host 这个问题:分析了下原来是因为我虽然是同一个宿主机器,但是我是2个容器,存在容器与容器之间的网络访问问题,这里我防火墙开了40000端口后测试就没有问题了

 

当然你也可以把两个容器网络连在一起

这里就会衍生一个问题:同一个宿主机上的2个容器网络联系在一起或 不同宿主机之间的2个容器的网络联系在一起的处理,具体不说了~

 

posted @ 2018-11-14 14:45  龙码精神  阅读(7407)  评论(0编辑  收藏  举报