Несанкционированная ошибка при обращении к конечной точке userinfo

Я настроил OAuth2 client приложение, использующее Okta и работающее через Authorization_codeпоток грантов. Приложение может получить код аутентификации и токен, но пытается попасть в конечную точку userinfo и получить ошибку 401, когда я указал файл.

Я включил отладку для org.springframework.securityпакет, но не получает много деталей. Где я ошибаюсь?

Обновление: я получаю эту ошибку, когда у меня есть user-info-uri свойство в конфигурации, и в случае удаления конечная точка становится доступной.

application.yml

      server:
  port: 8555
spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: masked
            client-secret: masked
        provider:
          okta:
            authorization-uri: https://domain/oauth2/default/v1/authorize
            token-uri: https://domain/oauth2/default/v1/token
            user-info-uri: https://domain/oauth2/v1/userinfo
            jwk-set-uri: https://domain/oauth2/default/v1/keys

debug: true
logging:
  level:
    org.springframework.security: debug

ApplicationSecurityConfiguration

      @Configuration
public class ApplicationSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .oauth2Login();
    }
}

Обновлять:

Я запустил приложение в режиме отладки и смог собрать следующие журналы

          : Reading to [org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse] as "application/json;charset=UTF-8"
2021-12-16 19:42:40.180 DEBUG 11880 --- [nio-8555-exec-3] o.s.web.client.RestTemplate              : HTTP GET https://dev-7858070.okta.com/oauth2/default/v1/keys
2021-12-16 19:42:40.180 DEBUG 11880 --- [nio-8555-exec-3] o.s.web.client.RestTemplate              : Accept=[text/plain, application/json, application/*+json, */*]
2021-12-16 19:42:40.757 DEBUG 11880 --- [nio-8555-exec-3] jdk.event.security                       : ValidationChain: 1341898239, 128597027, -1751274746
2021-12-16 19:42:41.032 DEBUG 11880 --- [nio-8555-exec-3] jdk.event.security                       :  TLSHandshake: dev-7858070.okta.com:443, TLSv1.2, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -1751274746
2021-12-16 19:42:41.033 DEBUG 11880 --- [nio-8555-exec-3] s.n.www.protocol.http.HttpURLConnection  : sun.net.www.MessageHeader@6172186f5 pairs: {GET /oauth2/default/v1/keys HTTP/1.1: null}{Accept: application/json, application/jwk-set+json}{User-Agent: Java/11.0.7}{Host: dev-7858070.okta.com}{Connection: keep-alive}
2021-12-16 19:42:41.493 DEBUG 11880 --- [nio-8555-exec-3] s.n.www.protocol.http.HttpURLConnection  : sun.net.www.MessageHeader@5920bb2c17 pairs: {null: HTTP/1.1 200 OK}{Date: Thu, 16 Dec 2021 14:12:41 GMT}{Content-Type: application/json}{Transfer-Encoding: chunked}{Connection: keep-alive}{Server: nginx}{Public-Key-Pins-Report-Only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"}{x-xss-protection: 0}{p3p: CP="HONK"}{content-security-policy: default-src 'self' dev-7858070.okta.com *.oktacdn.com; connect-src 'self' dev-7858070.okta.com dev-7858070-admin.okta.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' dev-7858070.okta.com *.oktacdn.com; style-src 'unsafe-inline' 'self' dev-7858070.okta.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com; frame-src 'self' dev-7858070.okta.com dev-7858070-admin.okta.com login.okta.com; img-src 'self' dev-7858070.okta.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com data: blob:; font-src 'self' dev-7858070.okta.com data: *.oktacdn.com fonts.gstatic.com}{expect-ct: report-uri="https://oktaexpectct.report-uri.com/r/t/ct/reportOnly", max-age=0}{cache-control: max-age=5751840, must-revalidate}{expires: Mon, 21 Feb 2022 03:56:41 GMT}{vary: Origin}{x-content-type-options: nosniff}{Strict-Transport-Security: max-age=315360000; includeSubDomains}{X-Okta-Request-Id: YbtJWMz4hSJnMbK89S9YAAAABd8}
2021-12-16 19:42:41.493 DEBUG 11880 --- [nio-8555-exec-3] o.s.web.client.RestTemplate              : Response 200 OK
2021-12-16 19:42:41.493 DEBUG 11880 --- [nio-8555-exec-3] o.s.web.client.RestTemplate              : Reading to [java.lang.String] as "application/json"
2021-12-16 19:42:41.502 DEBUG 11880 --- [nio-8555-exec-3] o.s.web.client.RestTemplate              : HTTP GET https://dev-7858070.okta.com/oauth2/v1/userinfo
2021-12-16 19:42:41.503 DEBUG 11880 --- [nio-8555-exec-3] o.s.web.client.RestTemplate              : Accept=[application/json, application/*+json]
2021-12-16 19:42:41.503 DEBUG 11880 --- [nio-8555-exec-3] s.n.www.protocol.http.HttpURLConnection  : sun.net.www.MessageHeader@3bdc7ab6 pairs: {GET /oauth2/v1/userinfo HTTP/1.1: null}{Accept: application/json}{Authorization: Bearer eyJraWQiOiJ3Wi0tT29HeTlURnFReVlfN1hPXzgzdnlmYlE3LWtuYUFIOUQ3MmN5S0F3IiwiYWxnIjoiUlMyNTYifQ.eyJ2ZXIiOjEsImp0aSI6IkFULlkzSldCaVMxUDYxeXR1ekZtUjUxMDlCRVM5MThKRWUwcTNkbFItSTlrWG8iLCJpc3MiOiJodHRwczovL2Rldi03ODU4MDcwLm9rdGEuY29tL29hdXRoMi9kZWZhdWx0IiwiYXVkIjoiYXBpOi8vZGVmYXVsdCIsImlhdCI6MTYzOTY2Mzk1OSwiZXhwIjoxNjM5NjkzOTU5LCJjaWQiOiIwb2EzYzk3dDFtaVBUa0pqVjVkNyIsInVpZCI6IjAwdTNteXk1c09sOVNEYnYzNWQ2Iiwic2NwIjpbIm9wZW5pZCIsInByb2ZpbGUiLCJlbWFpbCJdLCJzdWIiOiJwcmFkZWVwLmt1bWFyNDRAZ21haWwuY29tIiwiZ3JvdXBzIjpbIkV2ZXJ5b25lIiwic3VwZXJfYWRtaW5zIiwiYWRtaW5zIl19.PWdjnf4WCOpCCn84U-v3V8cdgVferDihMq5BYPcOlYR3yQbLHUdeHvXus22r_sre0mVJVbEQycF8z0fpkuAgOXLh-8KEEWj6WuEisvzW6dE9xwULODzZS5gE9ntolwcqix64DWX0BegFK1_WdZhRTTyM07RVdR2XFBq7POdiDb2Vkk9_dfc7--n3ax2eFFnsWaj3nXV95mRQD-xD_0MG-2k9JpzdpbS6M6KJ1egtu9fBCwD8U-bsFQbDe4LL58RGSeLvpAIqJochUhzS1cSl4_UNUwgS9l7V-MHDzt_53_BAyGRM2WiqnWmeG43sgXroRj2KQiRkX0XSHn268WnJiw}{User-Agent: Java/11.0.7}{Host: dev-7858070.okta.com}{Connection: keep-alive}
2021-12-16 19:42:42.008 DEBUG 11880 --- [nio-8555-exec-3] s.n.www.protocol.http.HttpURLConnection  : sun.net.www.MessageHeader@3b99722114 pairs: {null: HTTP/1.1 401 Unauthorized}{Date: Thu, 16 Dec 2021 14:12:41 GMT}{Content-Length: 0}{Connection: keep-alive}{Server: nginx}{Public-Key-Pins-Report-Only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"}{x-okta-request-id: YbtJWdz9vdX0rhB3Ae0VzAAADGc}{x-xss-protection: 0}{p3p: CP="HONK"}{access-control-expose-headers: WWW-Authenticate}{www-authenticate: Bearer authorization_uri="http://dev-7858070.okta.com/oauth2/v1/authorize", realm="http://dev-7858070.okta.com", scope="openid", error="invalid_token", error_description="The access token is invalid.", resource="/oauth2/v1/userinfo"}{content-language: en}{Strict-Transport-Security: max-age=315360000; includeSubDomains}{set-cookie: sid=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/}
2021-12-16 19:42:42.011 DEBUG 11880 --- [nio-8555-exec-3] o.s.web.client.RestTemplate              : Response 401 UNAUTHORIZED
2021-12-16 19:42:42.014 DEBUG 11880 --- [nio-8555-exec-3] .s.a.DefaultAuthenticationEventPublisher : No event was found for the exception org.springframework.security.oauth2.core.OAuth2AuthenticationException
2021-12-16 19:42:42.014 DEBUG 11880 --- [nio-8555-exec-3] o.s.s.web.DefaultRedirectStrategy        : Redirecting to /login?error
2021-12-16 19:42:42.014 DEBUG 11880 --- [nio-8555-exec-3] w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
2021-12-16 19:42:42.015 DEBUG 11880 --- [nio-8555-exec-3] w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
2021-12-16 19:42:42.015 DEBUG 11880 --- [nio-8555-exec-3] s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request

Судя по журналам, кажется, что клиентское приложение использует access token получить user-info конечная точка и, следовательно, ответ 401.

Источник

1 ответ

Я смог решить эту проблему. конечная точка информации о пользователе была неверной. Конечная точка информации о пользователе должна быть user-info-uri: https://dev-7858070.okta.com/oauth2/default/v1/userinfo. defaultотсутствовал в URL.

Источник
Другие вопросы по тегам