JakartaEE 10 OpenIdAuthenticationMechanism 因 Auth0 而失败

【问题标题】：JakartaEE 10 OpenIdAuthenticationMechanism failed with Auth0JakartaEE 10 OpenIdAuthenticationMechanism 因 Auth0 而失败
【发布时间】：2022-12-06 02:18:43
【问题描述】：

得到help from the Redhat guy，最后我的示例与 Local KeyCloak（在 Docker 中）以及 Okta 一起工作。

我的例子在这里：https://github.com/hantsy/jakartaee10-sandbox/tree/master/security-oidc

在准备示例代码时，我使用了以下堆栈。

  • Java 17
  • 雅加达 EE 10
  • Wildfly 预览版 27.0.0.Alpha5

但是对于 Auth0，它总是在返回我的应用程序时抛出 NPE。

Error processing request
Context Path:
/security-oidc-examples

Servlet Path:
/callback

Path Info:
null

Query String:
code=uaOVw2pkvGnnrG-IcVR8qTsu7U2-B8zM2ig6OGBp_6olR&state=48e113ef-4bad-4c29-910e-a41cab8ca968

Stack Trace:

java.lang.NullPointerException: Cannot invoke "com.nimbusds.jwt.JWTClaimsSet.getClaims()" because "jwtClaimsSet" is null
    at org.glassfish.soteria@3.0.0//org.glassfish.soteria.mechanisms.openid.domain.AccessTokenImpl.<init>(AccessTokenImpl.java:64)
    at org.wildfly.security.jakarta.security@3.0.0.Beta4//org.wildfly.security.soteria.original.OpenIdCredential.<init>(OpenIdCredential.java:58)
    at org.wildfly.security.jakarta.security@3.0.0.Beta4//org.wildfly.security.soteria.original.OpenIdAuthenticationMechanism.validateAuthorizationCode(OpenIdAuthenticationMechanism.java:354)
    at org.wildfly.security.jakarta.security@3.0.0.Beta4//org.wildfly.security.soteria.original.OpenIdAuthenticationMechanism.authenticate(OpenIdAuthenticationMechanism.java:273)
    at org.wildfly.security.jakarta.security@3.0.0.Beta4//org.wildfly.security.soteria.original.OpenIdAuthenticationMechanism.validateRequest(OpenIdAuthenticationMechanism.java:171)
    at org.wildfly.security.jakarta.security@3.0.0.Beta4//org.wildfly.security.soteria.original.OpenIdAuthenticationMechanism$Proxy$_$$_WeldClientProxy.validateRequest(Unknown Source)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:568)
    at org.jboss.weld.core@5.0.1.Final//org.jboss.weld.bean.proxy.AbstractBeanInstance.invoke(AbstractBeanInstance.java:38)
    at org.jboss.weld.core@5.0.1.Final//org.jboss.weld.bean.proxy.ProxyMethodHandler.invoke(ProxyMethodHandler.java:106)
    at deployment.security-oidc-examples.war//org.jboss.weld.generated.proxies.security.enterprise.authentication.mechanism.http.HttpAuthenticationMechanism$397943940$Proxy$_$$_WeldClientProxy.validateRequest(Unknown Source)
    at org.glassfish.soteria@3.0.0//org.glassfish.soteria.mechanisms.jaspic.HttpBridgeServerAuthModule.validateRequest(HttpBridgeServerAuthModule.java:89)
    at org.wildfly.security.jakarta.authentication@3.0.0.Beta4//org.wildfly.security.auth.jaspi.impl.ElytronServerAuthContext.validateRequest(ElytronServerAuthContext.java:85)
    at org.wildfly.security.jakarta.authentication@3.0.0.Beta4//org.wildfly.security.auth.jaspi.impl.WrappingServerAuthContext.lambda$validateRequest$0(WrappingServerAuthContext.java:50)
    at org.wildfly.security.jakarta.authentication@3.0.0.Beta4//org.wildfly.security.auth.jaspi.impl.ThreadLocalCallbackHandler.get(ThreadLocalCallbackHandler.java:56)
    at org.wildfly.security.jakarta.authentication@3.0.0.Beta4//org.wildfly.security.auth.jaspi.impl.WrappingServerAuthContext.validateRequest(WrappingServerAuthContext.java:50)
    at org.wildfly.security.elytron-web.undertow-server-servlet@3.0.0.Beta1//org.wildfly.elytron.web.undertow.server.servlet.ServletSecurityContextImpl.authenticate(ServletSecurityContextImpl.java:174)
    at org.wildfly.security.elytron-web.undertow-server-servlet@3.0.0.Beta1//org.wildfly.elytron.web.undertow.server.servlet.ServletSecurityContextImpl.authenticate(ServletSecurityContextImpl.java:99)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:55)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
    at org.wildfly.security.elytron-web.undertow-server-servlet@3.0.0.Beta1//org.wildfly.elytron.web.undertow.server.servlet.CleanUpHandler.handleRequest(CleanUpHandler.java:38)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at org.wildfly.extension.undertow@27.0.0.Alpha5//org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at org.wildfly.extension.undertow@27.0.0.Alpha5//org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:275)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:134)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:131)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
    at org.wildfly.extension.undertow@27.0.0.Alpha5//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1431)
    at org.wildfly.extension.undertow@27.0.0.Alpha5//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1431)
    at org.wildfly.extension.undertow@27.0.0.Alpha5//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1431)
    at org.wildfly.extension.undertow@27.0.0.Alpha5//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1431)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:255)
    at io.undertow.servlet@2.3.0.Alpha2//io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:100)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.server.Connectors.executeRootHandler(Connectors.java:387)
    at io.undertow.core@2.3.0.Alpha2//io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:859)
    at org.jboss.threads@2.4.0.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
    at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990)
    at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
    at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
    at org.jboss.xnio@3.8.7.Final//org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
    at java.base/java.lang.Thread.run(Thread.java:833)

我检查了 auth0 控制台，在用户历史选项卡中有一个客户端登录和成功交换日志。因此访问令牌在 Auth0 端被授权。

要重现它，请按照下列步骤操作：

更新：试过 WildFly 27.0.0.Beta1，得到了同样的异常。

【问题讨论】：

  • 您是否在初始请求中包括范围？这就是我今天早些时候遇到的问题。我什么都没有，添加以下内容使一切正常：``` spring.security.oauth2.client.registration.auth0.client-secret: <your-client-secret> spring.security.oauth2.client.registration.auth0.scope =openid，个人资料，电子邮件```
  • 我检查了@OpenIdAuthenticationMechanismDefinition的scope属性，默认值是{"openid","email","profile"}，我没有在我的代码中设置它，所以应该使用默认值。
  • @MattRaible 而且我检查了 Auth0 控制台中的用户历史选项卡，有一个成功的交换日志。

标签： jakarta-ee oauth-2.0 openid-connect auth0 jakarta-ee-security-api


【解决方案1】：

最后我通过将 jwksReadTimeout = 5000 添加到 @OpenIdAuthenticationMechanismDefinition 来让它工作。

Jakarta EE Security 实现不会向开发人员抛出原始异常消息，很难找到根本原因。我试图克隆 soteria 项目并添加一些调试信息并更改为捕获 AccessTokenImpl 中的所有异常（catch(Exception e){}），我使用我的自定义构建版本替换 WildFly 内置模块，终于找到了原因。

这可能只是我这边的一个特定网络问题。

【讨论】：

    【解决方案2】：

    我在 Jakarta EE 10 OIDC、Auth0 和 Wildfly 27 中遇到了完全相同的问题。我发现 Auth0 默认返回一个不透明的令牌，除非指定了受众。 Jakarta 的 Security 3 无法验证不透明令牌或从中获取任何声明，导致 jwtClaimsSet is null 错误。

    我发现我必须在注释的extraParameters参数中添加一个观众。受众是在 Auth0 上创建的 API。这导致 Auth0 发送一个非不透明的令牌，然后 Jakarta 能够对其进行解压和验证。

    @OpenIdAuthenticationMechanismDefinition(
        providerURI = "${openIdConfig.issuerUri}",
        clientId = "${openIdConfig.clientId}",
        clientSecret = "${openIdConfig.clientSecret}",
        redirectURI = "${baseURL}/callback",
        // default 500ms caused timeouts for me
        jwksConnectTimeout = 5000,
        jwksReadTimeout = 5000,
        extraParameters = {"audience=http://my-api"}
)

    【讨论】：

      猜你喜欢
      • 1970-01-01
      • 2018-09-21
      • 2021-07-14
      • 1970-01-01
      • 2018-02-16
      • 2012-10-03
      • 2014-07-16
      • 2021-11-23
      • 2018-10-04
      相关资源
      最近更新 更多
      热门标签
      Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode