将 krakend 与 keycloak 集成的问题答案

【问题标题】：Problem of integration krakend with keycloak将 krakend 与 keycloak 集成的问题
【发布时间】：2022-07-11 23:44:16
【问题描述】：

我在 k8s 中部署了 keycloak bitnami 图表和 krakend。我也有一个测试 api，我想在访问它之前进行身份验证。我可以从 keycloak 获取有效的 jwt 令牌，但是当我尝试通过 krakend 访问我的 api 时，它返回 401 错误非常感谢任何帮助。

软件版本：钥匙斗篷：16.1.1 crakend：2.0.4

{
  "$schema": "https://www.krakend.io/schema/v3.json",
  "version": 3,
  "timeout": "3000ms",
  "cache_ttl": "300s",
  "output_encoding": "json",
  "port": 8080,
  "endpoints": [
      {
          "endpoint": "/mock/parents/{id}",
          "method": "GET",
          "input_headers": [
             "Authorization"
           ],
          "extra_config": {
              "auth/validator": {
                  "alg": "RS256",
                  "jwk-url": "http://keycloak-headless:8080/auth/realms/master/protocol/openid-connect/certs",
                  "disable_jwk_security": true,
                  "roles_key_is_nested": true,
                  "roles_key": "realm_access.roles",
                  "roles": ["test-app-parent"],
                  "operation_debug": true
              }
          },
          "output_encoding": "json",
          "concurrent_calls": 1,
          "backend": [
              {
                  "url_pattern": "/parents/{id}",
                  "encoding": "json",
                  "sd": "static",
                  "extra_config": {},
                  "host": [
                    "http://testapp-service:8400"
                  ],
                  "disable_host_sanitize": false,
                  "blacklist": [
                      "super_secret_field"
                  ]
              },
              {
                  "url_pattern": "/siblings/{id}",
                  "encoding": "json",
                  "sd": "static",
                  "extra_config": {},
                  "host": [
                      "http://testapp-service:8400"
                  ],
                  "blacklist": [
                      "sibling_id"
                  ],
                  "group": "extra_info",
                  "disable_host_sanitize": false
              },
              {
                  "url_pattern": "/parents/{id}/children",
                  "encoding": "json",
                  "sd": "static",
                  "extra_config": {},
                  "host": [
                      "http://testapp-service:8400"
                  ],
                  "disable_host_sanitize": false,
                  "mapping": {
                      "content": "cars"
                  },
                  "whitelist": [
                      "content"
                  ]
              }
          ]
      },
      {
          "endpoint": "/mock/bogus-new-api/{path}",
          "method": "GET",
          "extra_config": {
              "auth/validator": {
                  "alg": "RS256",
                  "jwk-url": "http://keycloak-headless:8080/auth/realms/master/protocol/openid-connect/certs",
                  "disable_jwk_security": true
              },
              "github.com/devopsfaith/krakend/proxy": {
                  "static": {
                      "data": {
                          "new_field_a": 123,
                          "new_field_b": [
                              "arr1",
                              "arr2"
                          ],
                          "new_field_c": {
                              "obj": "obj1"
                          }
                      },
                      "strategy": "always"
                  }
              }
          },
          "output_encoding": "json",
          "concurrent_calls": 1,
          "backend": [
              {
                  "url_pattern": "/not-finished-yet",
                  "encoding": "json",
                  "sd": "static",
                  "extra_config": {},
                  "host": [
                      "nothing-here"
                  ],
                  "disable_host_sanitize": false
              }
          ]
      }
  ]
 }

【问题讨论】：

您的 KrakenD 容器可以访问您的“keycloak-headless”容器吗？如果无法从 Kraken 访问 jwk-url，那么您将得到 401。
是的。当然，krakend 可以访问 kk
你有解决这个问题的办法吗？尝试使用 api-gateway karkend 访问后端时，我也得到相同的 401
您是否尝试过关注“jwk_url”（删除“auth/”）？ keycloak-headless:8080/realms/master/protocol/openid-connect/… 验证访问地址 http:///realms//protocol/openid-connect/certs
我也有同样的问题 :(

标签： authentication oauth-2.0 keycloak api-gateway krakend

【解决方案1】：

天哪，这让我发疯了。

在最后一个版本更新中，他们将 jwk-url 更改为 jwk_url。

https://github.com/krakendio/krakend-ce/issues/495#issuecomment-1138397005

在我修复它对我有用之后。

【讨论】：