python - Cloud Endpoints 返回 401 Jwt issuer is not configured

Question

我正在尝试设置服务到服务身份验证，以便外部应用程序可以向 Cloud Run 应用程序(在 Cloud Endpoints API 网关后面)发出请求。

我已关注 Cloud Endpoints authentication between services文档，但是在尝试访问 Cloud Run 服务时我继续收到以下错误:

401: Jwt issuer is not configured

在 openapi 规范中，我设置了端点安全和 securityDefinition:

/endpoint_1:
  get:
     ...
     security:
       - service_account: []

securityDefinitions:
  service_account:
    authorizationUrl: ""
    flow: "implicit"
    type: "oauth2"
    x-google-issuer: "<service_account_email>"
    x-google-jwks_uri: "https://www.googleapis.com/robot/v1/metadata/x509/<service_account_email>"
    x-google-audiences: "https://<cloud-run-service>-pjcfvhz2qq-uc.a.run.app"

然后使用 ESPv2 Beta 将其部署到 Cloud Run，如 Cloud Endpoints documentation 所述.

部署完所有内容后，我尝试从我的本地计算机运行以下脚本以生成签名的 jwt 并向 Cloud Run 服务发出请求:

import os
import json
import time
import requests
import google.auth.crypt
import google.auth.jwt

now = int(time.time())
expiry_length = 3600
sa_email = '<service_account_email>'

payload = {
    'iat': now,
    'exp': now + expiry_length,
    'iss': sa_email,
    'sub': sa_email,
    'email': sa_email,
    'aud': 'https://<cloud-run-service>-pjcfvhz2qq-uc.a.run.app',
}

file_path = "service-account.json"

signer = google.auth.crypt.RSASigner.from_service_account_file(file_path)
signed_jwt = google.auth.jwt.encode(signer, payload)

headers = {
    'Authorization': 'Bearer {}'.format(signed_jwt.decode('utf-8')),
    'content-type': 'application/json',
}

url = "https://<cloud-run-service>-pjcfvhz2qq-uc.a.run.app/endpoint_1"
res = requests.get(url, headers=headers)
print(res.json())

获取请求的响应:

{'message': 'Jwt issuer is not configured', 'code': 401}

颁发者已在 openapi 规范中指定为与用于生成 JWT 的颁发者相匹配的服务帐户电子邮件。

任何关于Jwt issuer is not configured 实际含义的指导，我们都很感激。

Answer 1

我认为您需要 Google 签名的 JWT token ，而不是自签名 token 。尝试用这个更改代码的结尾(在 signed_jwt = ... 行之后)

    auth_url = "https://www.googleapis.com/oauth2/v4/token"

    params = {
        'assertion': signed_jwt, # You may need to decode the signed_jwt: signed_jwt.decode('utf-8')
        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
    }

    r = requests.post(auth_url, data=params)

    if r.ok:
        id_token = r.json()['id_token']

        headers = {
            'Authorization': 'Bearer {}'.format(id_token),
            'content-type': 'application/json',
        }

        url = "https://<cloud-run-service>-pjcfvhz2qq-uc.a.run.app/endpoint_1"
        res = requests.get(url, headers=headers)
        print(res.json())

    # For debugging
    print(r)
    print(vars(r))