钥匙斗篷弹簧靴总是给找不到指定孩子的公钥

【问题标题】：keycloak spring boot is always giving Didn't find publicKey for specified kid钥匙斗篷弹簧靴总是给找不到指定孩子的公钥
【发布时间】：2021-08-04 03:21:04
【问题描述】：

我正在尝试解决“找不到指定孩子的公钥”的问题。有人可以在这里提出可能的错误。问题是预检请求通过了，但它以某种方式尝试验证我的请求，即使我已经登录并且虽然标头中存在 Bearerdetails，但它仍然说验证失败。

Spring 安全配置：

@Configuration
@EnableWebSecurity
@KeycloakConfiguration
// @ConditionalOnProperty(name = "keycloak.enabled", havingValue = "true", matchIfMissing = true)
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
@EnableGlobalMethodSecurity(jsr250Enabled = true)
public class SpringKeycloakSecurityConfiguration extends KeycloakWebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests()
                .anyRequest()
                .permitAll();
        http.cors().and().csrf().disable();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }

    @Bean
    public KeycloakConfigResolver KeycloakConfigResolver() {
        return new KeycloakSpringBootConfigResolver();
    }

来自后端的响应：

STATUS: 401 Unauthorized
HEADERS
cache-control:
private
connection:
keep-alive
content-length:
0
date:
Wed, 04 Aug 2021 03:00:58 GMT
expires:
Thu, 01 Jan 1970 00:00:00 GMT
keep-alive:
timeout=60
www-authenticate:
Bearer realm="xxx.com", error="invalid_token", error_description="Didn't find publicKey for specified kid"

后端日志：

2021-08-03 09:48:43.706 DEBUG 6840 --- [nio-8080-exec-4] o.a.coyote.http11.Http11InputBuffer      : Received [GET /2021-07-14/ui/uiobject?locale=en-US HTTP/1.1
host: localhost:8080
proxy-connection: keep-alive
sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"
accept: */*
authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJOUnBIMm1LSjU4aWkwUHYyMkpWOHczWjVvX2ZXT1JvV0g0RGFXSFY4UU04In0.eyJleHAiOjE2Mjc5NTc0NjgsImlhdCI6MTYyNzk1NzM5NSwiYXV0aF90aW1lIjoxNjI3OTIxNDY4LCJqdGkiOiI0ODRmYWIyZC1iNzQwLTRlMmItYWNkYy04MjkwNzBiYTNlZjMiLCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjk5OTAvYXV0aC9yZWFsbXMvaWJjc2NvcnAuY29tIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjMxNTczNDRlLTdlOTUtNDNjMC1hM2U0LWQ5NDY3OTQ0MjVmMiIsInR5cCI6IkJlYXJlciIsImF6cCI6ImliY3Njb3JwLmNvbSIsIm5vbmNlIjoiNGI0OTVjYTYtMzA5My00NTBhLTkwOGMtOWEyYTBmZDcyMzU4Iiwic2Vzc2lvbl9zdGF0ZSI6IjYxZmMzYjFlLWY3NTAtNDBlYy1hMDYzLTg3OWI3YmJiZTVhNiIsImFjciI6IjAiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovL2xvY2FsaG9zdDo4MDgwIiwiKiIsImh0dHA6Ly9sb2NhbGhvc3Q6MzAwMCJdLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiZXJtIiwib2ZmbGluZV9hY2Nlc3MiLCJhZG1pbiIsInVtYV9hdXRob3JpemF0aW9uIiwidXNlciIsImRlZmF1bHQtcm9sZXMtaWJjc2NvcnAuY29tIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiaWJjc2NvcnAuY29tIjp7InJvbGVzIjpbImFkbWluIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJqYW1lcyJ9.JVjLkSr5nAyLGyB3pBm9PnR0IJnhLROGeXiunphJa-avU_Bo-k-xmqcNKVHShF6YSWk1Ou36TlmNKIh3igTfhS4cPObGsnjxCLGrkYLELOxhpLVeB3Cqqn7Goy3LSjuuXJMtrPa4RcDuA3e8ltrjdoxcPFzQ0qLMlp_hk014gX8jendDPwDqcAbxy098Ptc5aNGV1gWSJtff65U_eIrWwWPRp8ow9Qd_jIilgmmi-AubC8ftFDXbmEoolOS_2sO6_FGCoyV4kEjf5orsj3e5Ucv3kK2Ie1lAz39IJYyrk0Txq974tMVwVbWA3lLPsfx0AecZrvJrPAOIDS2KmwmvWg
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
tenant: xxx.com
origin: http://localhost:3000
sec-fetch-site: same-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: http://localhost:3000/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
Connection: keep-alive

]

2021-08-03 09:48:43.711 DEBUG 6840 --- [nio-8080-exec-4] o.k.adapters.PreAuthActionsHandler       : adminRequest http://localhost:8080/2021-07-14/ui/uiobject?locale=en-US
2021-08-03 09:48:43.711 DEBUG 6840 --- [nio-8080-exec-4] o.k.adapters.PreAuthActionsHandler       : checkCorsPreflight http://localhost:8080/2021-07-14/ui/uiobject?locale=en-US
2021-08-03 09:48:43.712 DEBUG 6840 --- [nio-8080-exec-4] o.a.c.authenticator.AuthenticatorBase    : Security checking request GET /2021-07-14/ui/uiobject
2021-08-03 09:48:43.712 DEBUG 6840 --- [nio-8080-exec-4] org.apache.catalina.realm.RealmBase      :   Checking constraint 'SecurityConstraint[UiEndpoints]' against GET /ui/uiobject --> true
2021-08-03 09:48:43.712 DEBUG 6840 --- [nio-8080-exec-4] org.apache.catalina.realm.RealmBase      :   Checking constraint 'SecurityConstraint[UiEndpoints]' against GET /ui/uiobject --> true
2021-08-03 09:48:43.712 DEBUG 6840 --- [nio-8080-exec-4] o.a.c.authenticator.AuthenticatorBase    : Calling hasUserDataPermission()
2021-08-03 09:48:43.712 DEBUG 6840 --- [nio-8080-exec-4] org.apache.catalina.realm.RealmBase      :   User data constraint has no restrictions
2021-08-03 09:48:43.714 DEBUG 6840 --- [nio-8080-exec-4] o.a.c.authenticator.AuthenticatorBase    : Calling authenticate()
2021-08-03 09:48:43.714 DEBUG 6840 --- [nio-8080-exec-4] o.k.a.BearerTokenRequestAuthenticator    : Found [1] values in authorization header, selecting the first value for Bearer.
2021-08-03 09:48:43.715 DEBUG 6840 --- [nio-8080-exec-4] o.k.a.BearerTokenRequestAuthenticator    : Verifying access_token
2021-08-03 09:48:43.717 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.i.c.t.ThreadSafeClientConnManager  : Get connection: {s}->https://authentication.xxx.com:443, timeout = 0
2021-08-03 09:48:43.717 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.impl.conn.tsccm.ConnPoolByRoute    : [{s}->https://authentication.xxx.com:443] total kept alive: 1, total issued: 0, total allocated: 1 out of 20
2021-08-03 09:48:43.717 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.impl.conn.tsccm.ConnPoolByRoute    : Getting free connection [{s}->https://authentication.xxx.com:443][null]
2021-08-03 09:48:43.717 DEBUG 6840 --- [nio-8080-exec-4] o.a.http.impl.client.DefaultHttpClient   : Stale connection check
2021-08-03 09:48:43.723 DEBUG 6840 --- [nio-8080-exec-4] o.a.http.impl.client.DefaultHttpClient   : Stale connection detected
2021-08-03 09:48:43.724 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.impl.conn.DefaultClientConnection  : Connection 0.0.0.0:52467<->52.200.236.105:443 closed
2021-08-03 09:48:43.779 DEBUG 6840 --- [nio-8080-exec-4] .a.h.i.c.DefaultClientConnectionOperator : Connecting to authentication.xxx.com:443
2021-08-03 09:48:43.953 DEBUG 6840 --- [nio-8080-exec-4] jdk.event.security                       : ValidationChain: -1472444962, -1011578998, -2069289871
2021-08-03 09:48:44.144 DEBUG 6840 --- [nio-8080-exec-4] jdk.event.security                       :  TLSHandshake: authentication.xxx.com:443, TLSv1.2, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -2069289871
2021-08-03 09:48:44.145 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.client.protocol.RequestAddCookies  : CookieSpec selected: compatibility
2021-08-03 09:48:44.145 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.client.protocol.RequestAuthCache   : Auth cache not set in the context
2021-08-03 09:48:44.145 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.c.p.RequestTargetAuthentication    : Target auth state: UNCHALLENGED
2021-08-03 09:48:44.145 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.c.p.RequestProxyAuthentication     : Proxy auth state: UNCHALLENGED
2021-08-03 09:48:44.145 DEBUG 6840 --- [nio-8080-exec-4] o.a.http.impl.client.DefaultHttpClient   : Attempt 1 to execute request
2021-08-03 09:48:44.145 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.impl.conn.DefaultClientConnection  : Sending request: GET /auth/realms/xxx.com/protocol/openid-connect/certs HTTP/1.1
2021-08-03 09:48:44.145 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  >> "GET /auth/realms/xxx.com/protocol/openid-connect/certs HTTP/1.1[\r][\n]"
2021-08-03 09:48:44.146 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  >> "Host: authentication.xxx.com[\r][\n]"
2021-08-03 09:48:44.146 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  >> "Connection: Keep-Alive[\r][\n]"
2021-08-03 09:48:44.146 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  >> "[\r][\n]"
2021-08-03 09:48:44.146 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : >> GET /auth/realms/xxx.com/protocol/openid-connect/certs HTTP/1.1
2021-08-03 09:48:44.146 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : >> Host: authentication.xxx.com
2021-08-03 09:48:44.146 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : >> Connection: Keep-Alive
2021-08-03 09:48:44.217 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "HTTP/1.1 200 OK[\r][\n]"
2021-08-03 09:48:44.217 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "Date: Tue, 03 Aug 2021 16:48:43 GMT[\r][\n]"
2021-08-03 09:48:44.217 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "Content-Type: application/json[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "Content-Length: 1478[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "Connection: keep-alive[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "Cache-Control: no-cache[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "X-XSS-Protection: 1; mode=block[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "X-Frame-Options: SAMEORIGIN[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "Referrer-Policy: no-referrer[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "Strict-Transport-Security: max-age=31536000; includeSubDomains[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "X-Content-Type-Options: nosniff[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "[\r][\n]"
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.impl.conn.DefaultClientConnection  : Receiving response: HTTP/1.1 200 OK
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << HTTP/1.1 200 OK
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << Date: Tue, 03 Aug 2021 16:48:43 GMT
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << Content-Type: application/json
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << Content-Length: 1478
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << Connection: keep-alive
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << Cache-Control: no-cache
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << X-XSS-Protection: 1; mode=block
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << X-Frame-Options: SAMEORIGIN
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << Referrer-Policy: no-referrer
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << Strict-Transport-Security: max-age=31536000; includeSubDomains
2021-08-03 09:48:44.219 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.headers                  : << X-Content-Type-Options: nosniff
2021-08-03 09:48:44.220 DEBUG 6840 --- [nio-8080-exec-4] o.a.http.impl.client.DefaultHttpClient   : Connection can be kept alive indefinitely
2021-08-03 09:48:44.220 DEBUG 6840 --- [nio-8080-exec-4] org.apache.http.wire                     :  << "{"keys":[{"kid":"ZT0YsuS7Lgsh37eN3WVVPrIL7Kb3qRz_lMwAtLHfYDY","kty":"RSA","alg":"RS256","use":"sig","n":"s-FCK6-rgMANfL2JIEB4kEL5i6zW3IIxFN_PTyWmpdopDX9ptjVoFesp34FV5jpz1oYrssn9y_IFhKTpBuqqV7g65eHap0HeUIO5InKI7HL5hRmbrxYTJoOnoOQnQte6pvTdAc313GExRg3zAT_MM_iawyqRrVq9kfcdcpNe5qIyKNlt_pyPvvIM5rNKOd4L8Bt1zYPK1Nik1JPKmJLkXugHjn4SdDRaCRT1k2zcomx4ZUPtHBfajXgKK1rxbNZnFK8E8IAZGAUGHOFQFbFMdKYqRLrkgg4tZTcYHaGdL9Wx6n8_uQjTGmCRCvsQfGtlSPVSPMKnCEK6HkeHg0RG-Q","e":"AQAB","x5c":["MIICpzCCAY8CBgF6IAemUjANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxpYmNzY29ycC5jb20wHhcNMjEwNjE4MTY0ODMwWhcNMzEwNjE4MTY1MDEwWjAXMRUwEwYDVQQDDAxpYmNzY29ycC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCz4UIrr6uAwA18vYkgQHiQQvmLrNbcgjEU389PJaal2ikNf2m2NWgV6ynfgVXmOnPWhiuyyf3L8gWEpOkG6qpXuDrl4dqnQd5Qg7kicojscvmFGZuvFhMmg6eg5CdC17qm9N0BzfXcYTFGDfMBP8wz+JrDKpGtWr2R9x1yk17mojIo2W3+nI++8gzms0o53gvwG3XNg8rU2KTUk8qYkuRe6AeOfhJ0NFoJFPWTbNyibHhlQ+0cF9qNeAorWvFs1mcUrwTwgBkYBQYc4VAVsUx0pipEuuSCDi1lNxgdoZ0v1bHqfz+5CNMaYJEK+xB8a2VI9VI8wqcIQroeR4eDREb5AgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFmNA6eMkMaVlh31Soqr7al6kiMbz2mZlrejllMovCUbR0+tjNEh2MxgjMNTMJDUpq+caQHJDDETMGrvvUCHc2yRZSxt+Ky3ovY5ERGJbB5u/LGMFapyltDwuWbEwAkakcsAWsuvpu+0ALr+HoJWYCizGeXyjwC6lIYyFHbi9XxLSuRgbrsSwyoawdC/RncCwzecMjmbNZUsB4ST73mB2ao9tZtPaWMTVJpTt3stN6kRB/LzQ6VvBlVujwVqt/55GnB4A3uac/akaeMbP0RgqjLpF8tI0ZUOh3euM689PtT+RNKMY/gUqsR+0givNpXyZVdRsONlSBA8B0tZ9lo7n/k="],"x5t":"j3eCSy2GZJuewVR9a_Tz0u5fdeU","x5t#S256":"Q3KrFXwqJWv0xSrba9g2XqNwxM2hMPDKkUvJRieu3LA"}]}"
2021-08-03 09:48:44.221 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.i.c.t.ThreadSafeClientConnManager  : Released connection is reusable.
2021-08-03 09:48:44.221 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.impl.conn.tsccm.ConnPoolByRoute    : Releasing connection [{s}->https://authentication.xxx.com:443][null]
2021-08-03 09:48:44.221 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.impl.conn.tsccm.ConnPoolByRoute    : Pooling connection [{s}->https://authentication.xxx.com:443][null]; keep alive indefinitely
2021-08-03 09:48:44.221 DEBUG 6840 --- [nio-8080-exec-4] o.a.h.impl.conn.tsccm.ConnPoolByRoute    : Notifying no-one, there are no waiting threads
2021-08-03 09:48:44.221 DEBUG 6840 --- [nio-8080-exec-4] o.k.a.rotation.JWKPublicKeyLocator       : Realm public keys successfully retrieved for client xxx.com. New kids: [ZT0YsuS7Lgsh37eN3WVVPrIL7Kb3qRz_lMwAtLHfYDY]
2021-08-03 09:48:44.221 ERROR 6840 --- [nio-8080-exec-4] o.k.a.rotation.AdapterTokenVerifier      : Didn't find publicKey for kid: NRpH2mKJ58ii0Pv22JV8w3Z5o_fWORoWH4DaWHV8QM8
2021-08-03 09:48:44.221 DEBUG 6840 --- [nio-8080-exec-4] o.k.a.BearerTokenRequestAuthenticator    : Failed to verify token
2021-08-03 09:48:44.221 DEBUG 6840 --- [nio-8080-exec-4] o.k.adapters.RequestAuthenticator        : Bearer FAILED
2021-08-03 09:48:44.221 DEBUG 6840 --- [nio-8080-exec-4] o.a.c.authenticator.AuthenticatorBase    : Failed authenticate() test

【问题讨论】：

    标签： spring-boot keycloak spring-security-oauth2


    【解决方案1】：

    我找到了解决这个问题的方法-> 我使用的 keycloak 服务器配置部分来自本地，部分来自舞台环境。 UI 代码具有 keycloak 的本地服务器详细信息，后端服务器具有阶段服务器详细信息。来自浏览器的 JWT 令牌给出了清晰的图片，因为它与我拥有的服务器端配置不匹配。这导致了身份验证错误。

    【讨论】：

      猜你喜欢
      • 1970-01-01
      • 1970-01-01
      • 2019-03-03
      • 2019-08-02
      • 1970-01-01
      • 2019-06-23
      • 2021-10-30
      • 2019-09-07
      • 2021-01-30
      相关资源
      最近更新 更多
      热门标签
      Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode