HTTPS 代理背后的 WireCloud 和 Horizo​​n

Question

我们正在运行一个代理，它为互联网提供 HTTPS 页面。因此，它将请求重定向到我们的 DMZ，其中页面作为 HTTP 页面提供。

我们将 WireCloud 设置为在子域中运行：wirecloud.example.com。 Horizo​​n 在 Horizo​​n.example.com 上运行。

在 Horizo​​n 中，回调 URL 设置为：http://wirecloud.example.com/complete/fiware/，在 Wirecloud 的 settings.py 中设置了 FIWARE_IDM_SERVER = 'http://horizon.example.com'。

现在，当wirecloud.example.com/login 被调用时，它被我们的代理重定向到https，然后被wireclound 重定向到horizo​​n，然后被我们的代理重定向到https://horizon.example.com/oauth2/authorize/?state=STATE_KEY&redirect_uri=http://wirecloud.example.com/complete/fiware/&response_type=code&client_id=CLIENT_ID。如果用户未登录并且现在这样做了，则 redirect_uri 将转换为：http%253A%252F%252Fwirecloud.example.com%252Fcomplete%252Ffiware%252F 导致此错误的原因：{"state": "STATE_KEY", "error": "invalid_redirect_uri"} (HTTP 400)。如果用户已经登录并尝试授权应用程序 (WireCloud)，则会引发 405 错误：

Environment:


Request Method: GET
Request URL: http://wirecloud.example.com/complete/fiware/?state=STATE_KEY&code=CODE

Django Version: 1.9.6
Python Version: 2.7.9
Installed Applications:
('django.contrib.auth',
 'django.contrib.contenttypes',
 'django.contrib.sessions',
 'django.contrib.messages',
 'django.contrib.staticfiles',
 'django.contrib.admin',
 'wirecloud.commons',
 'compressor',
 'wirecloud.catalogue',
 'wirecloud.platform',
 'wirecloud.oauth2provider',
 'wirecloud.fiware',
 'social.apps.django_app.default')
Installed Middleware:
('wirecloud.commons.middleware.URLMiddleware',)



Traceback:

File "/opt/wc/venv/lib/python2.7/site-packages/django/core/handlers/base.py" in get_response
  149.                     response = self.process_exception_by_middleware(e, request)

File "/opt/wc/venv/lib/python2.7/site-packages/django/core/handlers/base.py" in get_response
  147.                     response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/django/views/decorators/cache.py" in _wrapped_view_func
  57.         response = view_func(request, *args, **kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/django/views/decorators/csrf.py" in wrapped_view
  58.         return view_func(*args, **kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/social/apps/django_app/utils.py" in wrapper
  51.             return func(request, backend, *args, **kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/social/apps/django_app/views.py" in complete
  28.                        redirect_name=REDIRECT_FIELD_NAME, *args, **kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/social/actions.py" in do_complete
  43.         user = backend.complete(user=user, *args, **kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/social/backends/base.py" in complete
  41.         return self.auth_complete(*args, **kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/social/utils.py" in wrapper
  229.             return func(*args, **kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/social/backends/oauth.py" in auth_complete
  383.             method=self.ACCESS_TOKEN_METHOD

File "/opt/wc/venv/lib/python2.7/site-packages/social/backends/oauth.py" in request_access_token
  361.         return self.get_json(*args, **kwargs)

File "/opt/wc/venv/lib/python2.7/site-packages/social/backends/base.py" in get_json
  229.         return self.request(url, *args, **kwargs).json()

File "/opt/wc/venv/lib/python2.7/site-packages/social/backends/base.py" in request
  225.         response.raise_for_status()

File "/opt/wc/venv/lib/python2.7/site-packages/requests/models.py" in raise_for_status
  844.             raise HTTPError(http_error_msg, response=self)

Exception Type: HTTPError at /complete/fiware/
Exception Value: 405 Client Error: METHOD NOT ALLOWED for url: https://horizon.example.com/oauth2/token

那么我们需要如何配置 WireCloud 和/或 Horizo​​n 和/或我们的代理才能使其正常工作？

Answer 1

编辑您的 settings.py 文件并添加以下行以强制 WireCloud 使用 https 作为内部 URL：

FORCE_PROTO = 'https'
SOCIAL_AUTH_REDIRECT_IS_HTTPS = True

这应该使 WireCloud 使用https://wirecloud.example.com/complete/fiware/ 作为redirect_uri。有关详细信息，请参阅FORCE_PROTO。

关于这个例外：

Exception Type: HTTPError at /complete/fiware/
Exception Value: 405 Client Error: METHOD NOT ALLOWED for url: https://horizon.example.com/oauth2/token

我需要更多信息才能 100% 确定，但在网络可见性方面似乎存在问题。我认为 WireCloud 机器正在请求 https://horizon.example.com/oauth2/token URL，但此请求并未通过您的代理/前端服务器。如果您有一个有效的令牌，您可以通过从 WireCloud 机器和外部机器执行以下行来确认这种情况：

curl -v https://horizon.example.com/oauth2/token?access_token=*****