jhipster：Rest服务调用在通过网关路由时返回“401 unauthorized”

Question

我有我认为是配置问题，但我似乎找不到它。以下是一些细节：

我们正在运行一个带有keycloak的JHipster网关。环境是Docker compose，据我所知，我们已经完成了JHipster文档中为Docker规定的必要工作。

我们使用oauth2作为身份验证类型。

对我来说，这表明服务正在运行，spring security可以使用我的JWT令牌。

现在，当我尝试通过网关路由到安全服务时，麻烦就开始了。我通过邮递员也用同样的意思。http://gatewayip：port/helloapp/api/hello

现在给我的响应是：键入“https://www.jhipster.tech/problem/problem/problem-with-message”title“unauthorized”status 401 detail“访问此资源需要完全身份验证”path“/api/hello”message“error.http.401”

编辑：

安全配置：

@EnableWebSecurity
@Import(SecurityProblemSupport.class)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

@Value("${spring.security.oauth2.client.provider.oidc.issuer-uri}")
private String issuerUri;

private final JHipsterProperties jHipsterProperties;
private final JwtAuthorityExtractor jwtAuthorityExtractor;
private final SecurityProblemSupport problemSupport;

public SecurityConfiguration(JwtAuthorityExtractor jwtAuthorityExtractor, JHipsterProperties jHipsterProperties, SecurityProblemSupport problemSupport) {
    this.problemSupport = problemSupport;
    this.jwtAuthorityExtractor = jwtAuthorityExtractor;
    this.jHipsterProperties = jHipsterProperties;
}

@Override
public void configure(HttpSecurity http) throws Exception {
    // @formatter:off
    http
        .csrf()
        .disable()
        .exceptionHandling()
            .authenticationEntryPoint(problemSupport)
            .accessDeniedHandler(problemSupport)
    .and()
        .headers()
        .contentSecurityPolicy("default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:")
    .and()
        .referrerPolicy(ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN)
    .and()
        .featurePolicy("geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'")
    .and()
        .frameOptions()
        .deny()
    .and()
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
    .and()
        .authorizeRequests()
        .antMatchers("/api/auth-info").permitAll()
        .antMatchers("/api/**").authenticated()//hasAuthority(AuthoritiesConstants.USER)//permitAll()
        .antMatchers("/management/health").permitAll()
        .antMatchers("/management/info").permitAll()
        .antMatchers("/management/prometheus").permitAll()
        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
    .and()
        .oauth2ResourceServer()
            .jwt()
            .jwtAuthenticationConverter(jwtAuthorityExtractor)
            .and()
        .and()
            .oauth2Client();
    // @formatter:on
}

编辑2:application.yml

security:
oauth2:
    client:
        access-token-uri: http://xxx.xxx.xxx.xxx:30080/auth/realms/test/protocol/openid-connect/token
        user-authorization-uri: http://xxx.xxx.xxx.xxx:30080/auth/realms/test/protocol/openid-connect/auth
        client-id: web_app
        client-secret: web_app
        scope: openid profile email

    resource:
        user-info-uri: http://xxx.xxx.xxx.xxx:30080/auth/realms/test/protocol/openid-connect/userinfo         

server:
 port: 40404

Answer 1

在打开登录SpringSecurity之后，通过添加

@Override
    public void configure(WebSecurity web){
        web.debug(true);
    }

在SecurityConfiguration.java类中，我们可以看到安全头不是由网关转发的。

这将我们引向以下页面:https://github.com/spring-cloud/spring-cloud-netflix/issues/3126

    zuul: # those values must be configured depending on the application specific needs
    .
    .
        ignore-security-headers: false
        ignored-headers: cookie,set-cookie
        sensitiveHeaders: Cookie,Set-Cookie
    .