KeyClope返回“无效参数：重定向\u uri”

Question

[Edit-1]在oauth2配置中添加作用域，添加grafana服务，删除oauth密钥斗篷登录。此链接中引用了配置

[更新]我可以登录在KeyCloak页面，但它不能路由我到Grafana服务。看看OAuth2日志，奇怪的是，由KeyCloak生成的访问令牌是Github验证的，而不是KeyCloak：）））-

解决方案：

- 'traefik.http.middlewares.oauth-keycloak.forwardauth.address=http://oauth-keycloak:4185/oauth2/auth'

OAuth2代理的日志

paddy_oauth-keycloak.1.nd9v50gfv9kc@staging    | 123.28.110.207 - 411d7575-fb97-42ca-87ed-d57cad683b31 - - [2021/09/30 02:04:53] grafana.my-domain.com GET - "/oauth2/start?rd=https%3A%2F%2Fgrafana.my-domain.com%2F" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" 302 419 0.000
paddy_oauth-keycloak.1.nd9v50gfv9kc@staging    | [2021/09/30 02:05:00] [internal_util.go:74] token validation request failed: status 400 - {"error":"invalid_request","error_description":"Token not provided"}
paddy_oauth-keycloak.1.nd9v50gfv9kc@staging    | [2021/09/30 02:05:00] [internal_util.go:69] 400 GET https://keycloak.my-domain.com/auth/realms/staging/protocol/openid-connect/userinfo?access_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJYa1NjbzduRjlaTUpiWDRXVU5mTlhJS2FwOG9ZMHZ1THVZZU1SUk9EQ1J3In0.eyJleHAiOjE2MzI5Njc4MDAsImlhdCI6MTYzMjk2NzUwMCwiYXV0aF90aW1lIjoxNjMyOTY3NDk5LCJqdGkiOiI4NGJjZjdiNC0yN2YzLTQ4NDktYjUzNi05OTNkNTczNzA5OWYiLCJpc3MiOiJodHRwczovL2tleWNsb2FrLnN0YWdpbmcucHJlY2lzaW9uYWcub3JnL2F1dGgvcmVhbG1zL3N0YWdpbmciLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiNzk1NjE1YWUtN2VkNi00MWI3LWE5YWUtMjBkZmZhMTc1NjBhIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoiYXV0aGVudGljYXRpb24iLCJzZXNzaW9uX3N0YXRlIjoiZTVjM2FkMDMtNzhmNi00ZmE4LThhOTgtZTdkYjk1YjZiNmEzIiwiYWNyIjoiMSIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsImRlZmF1bHQtcm9sZXMtc3RhZ2luZyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW5... {"error":"invalid_request","error_description":"Token not provided"}
paddy_oauth-keycloak.1.nd9v50gfv9kc@staging    | 123.28.110.207 - 39bea317-002b-4366-858c-01aa6f6901b6 - [e-mail] [2021/09/30 02:05:00] [AuthSuccess] Authenticated via OAuth2: Session{email:[e-mail] user: PreferredUsername: token:true groups:[/pader]}

我正在为系统中的身份验证设置keydepeat和oauth2。该系统在docker swarm模式下运行，并使用traefik反向代理。我按照以下指南设置oauth2容器：https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider/#keycloak-身份验证提供程序

我在开发领域创建了一个新的客户端，有效重定向URL是https://oauth-keycloak.my-domain.com/oauth2/callback（它是Oauth URL），如果请求未经身份验证，则使用traefik转发auth将请求路由到KeyCloak。

对于2种情况，我得到了无效参数：重定向uri：

• 我访问了Grafana，请求被路由到Keyclope

我已经搜索并尝试了一些建议，但它们对我不起作用。希望你们能帮忙。我真的很感激。

这是我的docker swarm配置：

  keycloak:
    image: quay.io/keycloak/keycloak:15.0.2
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.keycloak.rule=Host(`keycloak.my-domain.com`)"
        - "traefik.http.routers.keycloak.entrypoints=websecure"
        - "traefik.http.routers.keycloak.tls=true"
        - "traefik.http.routers.keycloak.tls.certresolver=leresolver"
        # Set up service
        - "traefik.http.routers.keycloak.service=keycloak-svc"
        - "traefik.http.services.keycloak-svc.loadbalancer.server.port=8080"
    environment:
      - "DB_VENDOR=POSTGRES"
      - "DB_ADDR=postgis"
      - "DB_DATABASE=${POSTGRES_DB}"
      - "DB_USER=${POSTGRES_USER}"
      - "DB_PASSWORD=${POSTGRES_PASSWORD}"
      - "KEYCLOAK_USER="
      - "KEYCLOAK_PASSWORD="
      - "PROXY_ADDRESS_FORWARDING=true"
      - "KEYCLOAK_LOGLEVEL=DEBUG" # DEBUG, ERROR, INFO

  grafana:
    image: grafana/grafana
    deploy:
      resources:
        limits:
          memory: 256M
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.grafana.rule=Host(`grafana.my-domain.com`)"
        - "traefik.http.routers.grafana.entrypoints=websecure"
        - "traefik.http.routers.grafana.tls=true"
        - "traefik.http.routers.grafana.tls.certresolver=leresolver"
        # Basic HTTP authentication
        - "traefik.http.routers.grafana.middlewares=oauth-keycloak"
        # Set up service
        - "traefik.http.services.grafana-svc.loadbalancer.server.port=3000"
        - "traefik.http.routers.grafana.service=grafana-svc"
    environment:
      - GF_SECURITY_ADMIN_USER=my-username
      - GF_SECURITY_ADMIN_PASSWORD=my-pasword
      - GF_USERS_ALLOW_SIGN_UP=true
    volumes:
      - "/home/app/grafana:/var/lib/grafana"

  oauth-keycloak:
    image: quay.io/oauth2-proxy/oauth2-proxy
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.oauth-keycloak.rule=Host(`oauth-keycloak.my-domain.com`) || PathPrefix(`/oauth2`)"
        - "traefik.http.routers.oauth-keycloak.entrypoints=websecure"
        - "traefik.http.routers.oauth-keycloak.tls=true"
        - "traefik.http.routers.oauth-keycloak.tls.certresolver=leresolver"
        # Set up service
        - "traefik.http.routers.oauth-keycloak.service=oauth-keycloak-svc"
        - "traefik.http.services.oauth-keycloak-svc.loadbalancer.server.port=4185"
        # Set up middlewares
        - 'traefik.http.middlewares.oauth-keycloak.forwardauth.address=http://oauth-keycloak:4185'
        - 'traefik.http.middlewares.oauth-keycloak.forwardauth.trustForwardHeader=true'
        - 'traefik.http.middlewares.oauth-keycloak.forwardauth.authResponseHeaders=X-Forwarded-User'
        # - "traefik.http.middlewares.oauth-keycloak-signin.errors.service=oauth-keycloak-svc"
        # - "traefik.http.middlewares.oauth-keycloak-signin.errors.status=401-403"
        # - "traefik.http.middlewares.oauth-keycloak-signin.errors.query=/oauth2/sign_in"
    environment:
      OAUTH2_PROXY_CLIENT_ID: 'development'
      OAUTH2_PROXY_CLIENT_SECRET: '' 
      OAUTH2_PROXY_PROVIDER: 'keycloak'
      OAUTH2_PROXY_SCOPE: 'profile email address phone'
      OAUTH2_PROXY_LOGIN_URL: 'https://keycloak.my-domain.com/auth/realms/development/protocol/openid-connect/auth'
      OAUTH2_PROXY_REDEEM_URL: 'https://keycloak.my-domain.com/auth/realms/development/protocol/openid-connect/token'
      OAUTH2_PROXY_PROFILE_URL: 'https://keycloak.my-domain.com/auth/realms/development/protocol/openid-connect/userinfo'
      OAUTH2_PROXY_VALIDATE_URL: 'https://keycloak.my-domain.com/auth/realms/development/protocol/openid-connect/userinfo'
      
      OAUTH2_PROXY_COOKIE_DOMAINS: 'my-domain.com'
      OAUTH2_PROXY_HTTP_ADDRESS: '0.0.0.0:4185'
      OAUTH2_PROXY_COOKIE_REFRESH: '1h'
      OAUTH2_PROXY_COOKIE_SECURE: 'false'
      OAUTH2_PROXY_COOKIE_SECRET: '0Y18nYVtNLzKQroYQpi0jw=='
      OAUTH2_PROXY_EMAIL_DOMAINS: 'my-domain.com'
      OAUTH2_PROXY_REVERSE_PROXY: 'true'
      OAUTH2_PROXY_WHITELIST_DOMAINS: 'my-domain.com'
      OAUTH2_PROXY_SHOW_DEBUG_ON_ERROR: 'true'

Answer 1

您为https://oauth-keycloak.my-domain.com/oauth2/callback正如您所说。在访问grafana的情况下，重定向uri应该是https://grafana.my-domain.com/oauth2/callback。您还需要将其添加到有效重定向URI的列表中。