java - Keycloak 适配器 pkix 路径构建失败

Question

我目前正在尝试将我的 spring boot 微服务连接到 keycloak，以验证来自前端的所有 token 并验证用户。为此，我将 keycloak 适配器用于 spring boot。这是我第一次使用 Keycloak 作为身份提供者，我正在尝试弄清楚如何使用它。到目前为止，我已经成功地使用简单的 rest API 从 Keycloak 获取所有用户和有关领域的信息。

现在我想使用 keycloak 提供的适配器，但遇到证书错误(我发布了所有相关日志):

2019-08-27 09:19:58.529 DEBUG 14236 --- [nio-8080-exec-4] o.k.adapters.PreAuthActionsHandler       : adminRequest http://localhost:8080/data/23
2019-08-27 09:19:58.569 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.a.ClientCredentialsProviderUtils   : Using provider 'secret' for authentication of client 'authentication-service'
2019-08-27 09:19:58.572 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.a.ClientCredentialsProviderUtils   : Loaded clientCredentialsProvider secret
2019-08-27 09:19:58.574 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.a.ClientCredentialsProviderUtils   : Loaded clientCredentialsProvider jwt
2019-08-27 09:19:58.576 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.a.ClientCredentialsProviderUtils   : Loaded clientCredentialsProvider secret-jwt
2019-08-27 09:19:58.577 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.a.ClientCredentialsProviderUtils   : Loaded clientCredentialsProvider secret
2019-08-27 09:19:58.577 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.a.ClientCredentialsProviderUtils   : Loaded clientCredentialsProvider jwt
2019-08-27 09:19:58.577 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.a.ClientCredentialsProviderUtils   : Loaded clientCredentialsProvider secret-jwt
2019-08-27 09:19:58.587 DEBUG 14236 --- [nio-8080-exec-4] o.keycloak.adapters.KeycloakDeployment   : resolveUrls
2019-08-27 09:19:58.589 DEBUG 14236 --- [nio-8080-exec-4] o.k.adapters.KeycloakDeploymentBuilder   : Use authServerUrl: https://192.168.222.153:8444/auth/, tokenUrl: https://192.168.222.153:8444/auth/realms/GRCC/protocol/openid-connect/token, relativeUrls: NEVER
2019-08-27 09:19:58.601 TRACE 14236 --- [nio-8080-exec-4] o.k.adapters.RequestAuthenticator        : --> authenticate()
2019-08-27 09:19:58.603 TRACE 14236 --- [nio-8080-exec-4] o.k.adapters.RequestAuthenticator        : try bearer
2019-08-27 09:19:58.604 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.BearerTokenRequestAuthenticator    : Found [1] values in authorization header, selecting the first value for Bearer.
2019-08-27 09:19:58.604 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.BearerTokenRequestAuthenticator    : Verifying access_token
2019-08-27 09:19:58.690 TRACE 14236 --- [nio-8080-exec-4] o.k.a.BearerTokenRequestAuthenticator    :    access_token: eyJhbGciOiJSUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJjT3hqT1pOQWtieXhPM0diQ1BLWVNVS2lVY3JPZTRLRXFLN21qQ2JpZHA0In0.eyJqdGkiOiI1N2I0MGU0Ny1kMGQ5LTQ4NWItYmQyNi1hOTViNTczMTU2NzQiLCJleHAiOjE1NjY4MjYwMTMsIm5iZiI6MCwiaWF0IjoxNTY2ODI1NzEzLCJpc3MiOiJodHRwczovLzE5Mi4xNjguMjIyLjE1Mzo4NDQ0L2F1dGgvcmVhbG1zL0dSQ0MiLCJhdWQiOlsicmVhbG0tbWFuYWdlbWVudCIsImFjY291bnQiXSwic3ViIjoiOTYyMWZmMDItYjUwMy00NDk2LTg1ZWUtYjQ3NzJhZDRkMDE1IiwidHlwIjoiQmVhcmVyIiwiYXpwIjoiYXV0aGVudGljYXRpb24tc2VydmljZSIsImF1dGhfdGltZSI6MTU2NjgyNTY5Miwic2Vzc2lvbl9zdGF0ZSI6IjFlMjg4MDgzLWUxODgtNDhhMC04YzcxLTY4MTFiOWFkYzVmYyIsImFjciI6IjEiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhdXRoZW50aWNhdGlvbi1zZXJ2aWNlIjp7InJvbGVzIjpbIlVTRVIiXX0sImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwidXNlcl9uYW1lIjoibGxlbWFpcmUiLCJuYW1lIjoiTG_Dr2MgTGVtYWlyZSIsInByZWZlcnJlZF91c2VybmFtZSI6ImxsZW1haXJlIiwiZ2l2ZW5fbmFtZSI6Ikxvw69jIiwiZmFtaWx5X25hbWUiOiJMZW1haXJlIiwiZW1haWwiOiJsb2ljLmxlbWFpcmVAaXJpc2NvcnBvcmF0ZS5jb20ifQ.signature
2019-08-27 09:19:58.752 TRACE 14236 --- [nio-8080-exec-4] o.k.a.rotation.JWKPublicKeyLocator       : Going to send request to retrieve new set of realm public keys for client authentication-service
2019-08-27 09:19:59.166 ERROR 14236 --- [nio-8080-exec-4] o.k.a.rotation.JWKPublicKeyLocator       : Error when sending request to retrieve realm keys

org.keycloak.adapters.HttpClientAdapterException: IO error
    at org.keycloak.adapters.HttpAdapterUtils.sendJsonHttpRequest(HttpAdapterUtils.java:58) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.rotation.JWKPublicKeyLocator.sendRequest(JWKPublicKeyLocator.java:99) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.rotation.JWKPublicKeyLocator.getPublicKey(JWKPublicKeyLocator.java:63) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.rotation.AdapterTokenVerifier.getPublicKey(AdapterTokenVerifier.java:121) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.rotation.AdapterTokenVerifier.createVerifier(AdapterTokenVerifier.java:111) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.rotation.AdapterTokenVerifier.verifyToken(AdapterTokenVerifier.java:47) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.BearerTokenRequestAuthenticator.authenticateToken(BearerTokenRequestAuthenticator.java:103) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.BearerTokenRequestAuthenticator.authenticate(BearerTokenRequestAuthenticator.java:88) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:68) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.authenticateInternal(AbstractKeycloakAuthenticatorValve.java:203) [spring-boot-container-bundle-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve.authenticate(KeycloakAuthenticatorValve.java:50) [spring-boot-container-bundle-6.0.1.jar:6.0.1]
    at org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve.doAuthenticate(KeycloakAuthenticatorValve.java:57) [spring-boot-container-bundle-6.0.1.jar:6.0.1]
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:572) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.invoke(AbstractKeycloakAuthenticatorValve.java:181) [spring-boot-container-bundle-6.0.1.jar:6.0.1]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:853) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1587) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [na:na]
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [na:na]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.21.jar:9.0.21]
    at java.base/java.lang.Thread.run(Thread.java:834) [na:na]
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:128) [na:na]
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321) [na:na]
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:264) [na:na]
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:259) [na:na]
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:642) [na:na]
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:461) [na:na]
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:361) [na:na]
    at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392) [na:na]
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444) [na:na]
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421) [na:na]
    at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:178) [na:na]
    at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164) [na:na]
    at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1152) [na:na]
    at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1063) [na:na]
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:402) [na:na]
    at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:570) [httpclient-4.5.9.jar:4.5.9]
    at org.keycloak.adapters.SniSSLSocketFactory.createLayeredSocket(SniSSLSocketFactory.java:114) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:554) [httpclient-4.5.9.jar:4.5.9]
    at org.keycloak.adapters.SniSSLSocketFactory.connectSocket(SniSSLSocketFactory.java:109) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:415) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:605) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:440) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) [httpclient-4.5.9.jar:4.5.9]
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) [httpclient-4.5.9.jar:4.5.9]
    at org.keycloak.adapters.HttpAdapterUtils.sendJsonHttpRequest(HttpAdapterUtils.java:37) [keycloak-adapter-core-6.0.1.jar:6.0.1]
    ... 26 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385) [na:na]
    at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:290) [na:na]
    at java.base/sun.security.validator.Validator.validate(Validator.java:264) [na:na]
    at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:321) [na:na]
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:221) [na:na]
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129) [na:na]
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:626) [na:na]
    ... 51 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) [na:na]
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) [na:na]
    at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297) [na:na]
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380) [na:na]
    ... 57 common frames omitted

2019-08-27 09:19:59.166 ERROR 14236 --- [nio-8080-exec-4] o.k.a.rotation.AdapterTokenVerifier      : Didn't find publicKey for kid: cOxjOZNAkbyxO3GbCPKYSUKiUcrOe4KEqK7mjCbidp4
2019-08-27 09:19:59.166 DEBUG 14236 --- [nio-8080-exec-4] o.k.a.BearerTokenRequestAuthenticator    : Failed to verify token
2019-08-27 09:19:59.169 DEBUG 14236 --- [nio-8080-exec-4] o.k.adapters.RequestAuthenticator        : Bearer FAILED

我在使用带有 RestEasy 的 rest API 时已经解决了这个问题，只需在过程中添加证书即可。

KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
String password = "changeit";
keystore.load(new ClassPathResource("truststore").getInputStream(), password.toCharArray());

.resteasyClient(new ResteasyClientBuilder().trustStore(keystore).connectionPoolSize(1).hostnameVerification(ResteasyClientBuilder.HostnameVerificationPolicy.ANY).build())

处理完DNS问题后，一切正常。但是现在，我在适配器方面遇到了完全相同的问题。

经过一些研究，我已经将证书添加到我的 java cacerts 中，甚至在 windows 上安装了证书。但这些都不起作用。我一直有同样的错误。

这是我的应用程序属性:

#Keycloak configuration
keycloak.auth-server-url=https://192.168.222.153:8444/auth/
keycloak.realm=GRCC
keycloak.resource=authentication-service
keycloak.verify-token-audience=true
keycloak.ssl-required=none
keycloak.credentials.secret=49632b4b-5f8d-43af-b10d-3ecea7c114cf
keycloak.principal-attribute=preferred_username

logging.level.org.keycloak=TRACE

keycloak.security-constraints[0].authRoles[0]=user
keycloak.security-constraints[0].securityCollections[0].patterns[0]=/projects/*
keycloak.security-constraints[0].securityCollections[0].patterns[1]=/data/*

还有我的 keycloak 配置:

我还尝试在应用程序属性中使用 keycloak truststore 参数，但它也不起作用。

我使用 Keycloak 的方式有什么问题吗？

提前致谢

Answer 1

想办法!

我使用的是领域证书而不是 Keycloak 全局证书。

要获取领域证书，您需要向JVM 提供全局证书。

使用 openssl 调用获取正确的证书显示有两种不同类型的证书。