ssl - Azure App Service 证书 (dev) 问题上的身份服务器 4 部署

Question

我在 Azure 应用服务上部署身份服务器时遇到问题。以下是设置。

JSclient 在本地托管。Auth Server 在 Azure App Service 上。

                var certificate = SSLHelper.GetCertificateCurrentUserMyStore(signingsslthumbprint);
            builder
                .AddSigningCredential(certificate)
                .AddSecretParser<ClientAssertionSecretParser>()
                .AddSecretValidator<PrivateKeyJwtSecretValidator>()
                .AddAspNetIdentity<User>()
                .AddProfileService<ProfileService>();

我创建了两个证书，一个用于签名，另一个用于交换。

`New-SelfsignedCertificateEx -Subject "CN=devsignature"-EKU 1.3.6.1.5.5.7.3.3 -KeySpec "Signature"-KeyUsage "DigitalSignature"-StoreLocation "CurrentUser"-SAN $domains -SignatureAlgorithm "SHA256"- KeyLength 2048 -FriendlyName "DevSignature"-NotAfter $([System.DateTime]::Now.AddYears(15)) -可导出

New-SelfsignedCertificateEx -Subject "CN=*.mydomain.com"-EKU 1.3.6.1.5.5.7.3.1 -KeySpec "Exchange"-KeyUsage "DigitalSignature"-StoreLocation "CurrentUser"-SAN $domains -SignatureAlgorithm "SHA256"-KeyLength 2048 -FriendlyName "DEVExchange"-NotAfter $([System.DateTime]::Now.AddYears(15)) -Exportable`

以下是用于检索所有证书的应用服务设置。

当我在 Windows 机器上(不是本地机器而是在另一台服务器上)部署身份验证服务器时，这会起作用。然而，当我部署到 IIS 时......

   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>d__6.MoveNext() | Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.Invoke

119 | 2017-05-14 20:32:04.4131 | RD0003FF635548 |错误 |异常处理程序中间件 | AsyncTaskMethodBuilder.Start => d__8.MoveNext => ExceptionHandlerMiddleware.Invoke |发生未处理的异常:未配置签名凭据。无法创建 JWT token EXCEPTIONSystem.InvalidOperationException:未配置签名凭据。无法创建 JWT token

我正在使用开发证书(不是真实的)。因此，这是为了分阶段部署。

过去两天一直在尝试这个，但无法让它工作。

编辑:这甚至没有访问 api 服务器。这正是 JSClient 登录重定向到-> AuthServer 的时候。

有人可以帮忙吗？

谢谢，

编辑:

多亏了@moritzg 和@Austin Dimmer，我才更进一步。现在，当我使用 token 调用 webapi 时，它会抛出“IDX10803:无法从以下位置获取配置:”https://myauthserver.com/.well-known/openid-configuration '.

有什么想法吗？

编辑2:

以下是来自 api 服务器的调试日志

643 | RD0003FF635548 | DEBUG | LoggingConnectionFilter | MoveNextRunner.InvokeMoveNext => <ReadAsync>d__16.MoveNext =>

LoggingStream.Log | ReadAsync[2266] 47 45 54 20 2F 61 70 69 2F 63 6F 6F 6D 6D 6F 6E 2F 63 61 74 61 ................ GET /api/myendpoint HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/plain Accept-Encoding: gzip, deflate, sdch, br Accept-Language: en-US,en;q=0.8 Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IkVEQTYsdfsdfdsfsdfdsfdscHM6......... Cookie: ARRAffinity=e414d40c85d90229be06c3c9de2fzxczxczxc3....... Host: myapiserver Max-Forwards: 10 Referer: https://myapiserver/swagger/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 X-LiveUpgrade: 1 X-WAWS-Unencoded-URL: /api/myendpoint X-Original-URL: /api/myendpoint X-ARR-LOG-ID: 7c2afdfe4c-d3ea-dfer-9570-ffgfgfgfgfd DISGUISED-HOST: myapiserver X-SITE-DEPLOYMENT-ID: myapiserver WAS-DEFAULT-HOSTNAME: myapiserver.azurewebsites.net X-Forwarded-For: XXX.XXX.XXX.XXX:XXXXX, XXX.XXX.XXX.XXX:XXXXX X-ARR-SSL: 2048|256|C=XX, S=XXXXX, L=XXXXX, O=XXXX, OU=IT, CN=.mydoamin.com, E=xxx@xxx.com|C=XX, S=XXXXX, L=XXXX, O=XXXXX, OU=IT, CN=.mydomain.com, E=xxx@xxx.com MS-ASPNETCORE-TOKEN: XXX-XXX-XXX-XXXX-XXXXXXXXX X-Forwarded-Proto: https

| Microsoft.AspNetCore.Server.Kestrel.Filter.Internal.LoggingStream.Log 650 | RD0003FF635548 | DEBUG | LoggingConnectionFilter | StreamSocketOutput.ProducingComplete => LoggingStream.Write => LoggingStream.Log | Write[111] 48 54 54 50 2F 31 2E 31 20 35 30 30 20 49 6E 74 65 72 6E 61 6C 20 53 65 72 76 65 72 20 45 72 72 6F 72 0D 0A 44 61 74 65 3A 20 57 65 64 2C 20 31 37 20 4D 61 ...... HTTP/1.1 500 Internal Server Error Date: XXXXXXXXXXXXXXXXXXXXXX Content-Length: 0 Server: Kestrel

| Microsoft.AspNetCore.Server.Kestrel.Filter.Internal.LoggingStream.Log 651 | RD0003FF635548 | DEBUG | Kestrel | Frame.WriteSuffix => Connection.Microsoft.AspNetCore.Server.Kestrel.Internal.Http.IConnectionControl.End => KestrelTrace.ConnectionKeepAlive | Connection id "0HL4SVIU4EDP3" completed keep alive response. | Microsoft.AspNetCore.Server.Kestrel.Internal.KestrelTrace.ConnectionKeepAlive

以下是来自 API 服务器的错误日志

at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>d__6.MoveNext()

| Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware+d__6.MoveNext 610 | RD0003FF635548 | ERROR | Kestrel | d__2.MoveNext => Frame.ReportApplicationError => KestrelTrace.ApplicationError | Connection id "0HL4SVIU4EDP2": An unhandled exception was thrown by the application.EXCEPTIONSystem.InvalidOperationException: IDX10803: Unable to obtain configuration from: 'https://myauthserver/.well-known/openid-configuration'. ---> System.IO.IOException: IDX10804: Unable to retrieve document from: 'https://myauthserver/.well-known/openid-configuration'. ---> System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.WinHttpException: A security error occurred at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
at System.Net.Http.WinHttpHandler.d__105.MoveNext()
--- End of inner exception stack trace --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Net.Http.HttpClient.d__58.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.d__8.MoveNext() --- End of inner exception stack trace --- at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.d__8.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.d__3.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
at Microsoft.IdentityModel.Protocols.ConfigurationManager1.<GetConfigurationAsync>d__24.MoveNext()
--- End of inner exception stack trace --- at Microsoft.IdentityModel.Protocols.ConfigurationManager1.d__24.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter1.GetResult()
at
Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown --- at
System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at
Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown --- at
System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
task) at
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task) at System.Runtime.CompilerServices.TaskAwaiter1.GetResult() at Microsoft.AspNetCore.Authentication.AuthenticationHandler1.<InitializeAsync>d__52.MoveNext()
--- End of stack trace from previous location where exception was thrown --- at
System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
task) at
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task) at System.Runtime.CompilerServices.TaskAwaiter.GetResult()<br/>
at
Microsoft.AspNetCore.Authentication.AuthenticationMiddleware1.d__18.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at IdentityServer4.AccessTokenValidation.IdentityServerAuthenticationMiddleware.d__7.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.d__7.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.d__6.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.d__6.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
at Microsoft.AspNetCore.Server.IISIntegration.IISMiddleware.d__8.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
at Microsoft.AspNetCore.Hosting.Internal.RequestServicesContainerMiddleware.d__3.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
at Microsoft.AspNetCore.Server.Kestrel.Internal.Http.Frame`1.d__2.MoveNext() | Microsoft.AspNetCore.Server.Kestrel.Internal.KestrelTrace.ApplicationError

Identity Server (AuthServer) 本身没有生成日志。

我在调试日志中发现了以下有趣的地方

WAS-DEFAULT-HOSTNAME: myapiserver.azurewebsites.net

这是指向 Azurewebsite url 而不是 myapiserver.mydomain.com 我已经在 azure 域设置上配置了它。不确定这是否对此有任何影响，但无论如何......

最终编辑:

我已经找到了这个问题的根源。基本上在 App 服务中，您只能访问 CurrentUser 的个人商店，这意味着自签名证书将不起作用。您将需要购买一个真正的。 (不赞成 Mircorsoft Azure!)。

谢谢

Answer 1

您确定您的设置正确吗？这是我们制作证书的方式:

• 将证书上传到 Azure SSL
• 使用带有指纹的WEBSITE_LOAD_CERTIFICATES

然后在我的 ConfigureServices 中像这样使用它:`

var certs = new X509Certificate2Collection();

if (CurrentEnvironment.IsDevelopment())
{
       certs.Add(new X509Certificate2(Configuration["X509Certificate:CertificateName"], Configuration["X509Certificate:CertificatePassword"]));
 } else
 {
       var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
       store.Open(OpenFlags.ReadOnly);
       certs = store.Certificates.Find(X509FindType.FindByThumbprint, Configuration["WEBSITE_LOAD_CERTIFICATES"], false);
 }

然后:.AddSigningCredential(certs[0])