【发布时间】：2022-02-21 16:38:07
【问题描述】：
我正在尝试在 ThingsBoard 实例中实现自定义 OAuth2 实现，因为我已经在 php 中实现了 OAuth2 服务器
https://github.com/bshaffer/oauth2-demo-php
http://brentertainment.com/oauth2/
根据他们的 bshaffer 演示，它工作正常，当我将它与第三方应用程序thingboard 实例集成时，第一步工作正常，直到身份验证，之后它重定向到登录页面，说明 Oauth2 错误但不知道它在这里是什么是 OAuth2 服务器的示例 URL 和响应
http://34.226.xxx.xx/oauth2/web/lockdin/authorize
http://34.226.xxx.xx/oauth2/web/lockdin/token
http://34.226.xxx.xx/oauth2/web/lockdin/resource
第 1 步：
第 2 步：
授权发生在它发送回成功响应之后
在这之后它失败了
我已经测试了这个手动生成令牌之后的步骤，它工作正常
http://34.226.xxx.xx/oauth2/web/lockdin/token它给了我回应
{
"access_token": "4a01f8b9e8548420425c8f335eda2a3dbde7ef75",
"expires_in": 3600,
"token_type": "Bearer",
"scope": "email",
"refresh_token": "ccbb9b8a03949e0e013acdb7f8e79426aa1a0a58"
}
和资源 api 我得到以下响应
{
"email":"test@gmail.com",
"firstName":"Dave",
"lastName":"Johnson",
"profile":1828838378
}
对此的任何帮助将不胜感激
编辑：请找到终点的来源
Authorize.php
namespace OAuth2Demo\Server\Controllers;
use Silex\Application;
class Authorize
{
public static function addRoutes($routing)
{
$routing->get('/authorize', array(new self(), 'authorize'))->bind('authorize');
$routing->post('/authorize', array(new self(), 'authorizeFormSubmit'))->bind('authorize_post');
}
public function authorize(Application $app)
{
$server = $app['oauth_server'];
$response = $app['oauth_response'];
if (!$server->validateAuthorizeRequest($app['request'], $response)) {
return $server->getResponse();
}
return $app['twig']->render('server/authorize.twig', array(
'client_id' => $app['request']->query->get('client_id'),
'response_type' => $app['request']->query->get('response_type')
));
}
public function authorizeFormSubmit(Application $app)
{
$server = $app['oauth_server'];
$response = $app['oauth_response'];
$authorized = (bool) $app['request']->request->get('authorize');
return $server->handleAuthorizeRequest($app['request'], $response, $authorized);
}
}
Token.php
namespace OAuth2Demo\Server\Controllers;
use Silex\Application;
class Token
{
public static function addRoutes($routing)
{
$routing->post('/token', array(new self(), 'token'))->bind('grant');
}
public function token(Application $app)
{
$server = $app['oauth_server'];
$response = $app['oauth_response'];
return $server->handleTokenRequest($app['request'], $response);
}
}
Resource.php
namespace OAuth2Demo\Server\Controllers;
use Silex\Application;
use Symfony\Component\HttpFoundation\Response;
class Resource
{
public static function addRoutes($routing)
{
$routing->get('/resource', array(new self(), 'resource'))->bind('access');
}
public function resource(Application $app)
{
$server = $app['oauth_server'];
$response = $app['oauth_response'];
if (!$server->verifyResourceRequest($app['request'], $response)) {
return $server->getResponse();
} else {
$api_response = array(
"email"=> "xxx@gmail.com",
"name"=> "Pattatharasu Nataraj",
"family_name"=>"Nataraj",
"given_name"=>"Pattatharasu",
"middle_name"=>"",
"nickname"=>"",
"picture"=>"",
"updated_at"=>""
);
return new Response(json_encode($api_response));
}
}
}
Server.php
class Server implements ControllerProviderInterface
{
public function setup(Application $app)
{
if (!file_exists($sqliteFile = __DIR__.'/../../../data/oauth.sqlite')) {
$this->generateSqliteDb();
}
$storage = new Pdo(array('dsn' => 'mysql:host=localhost;dbname=demoapp'));
$grantTypes = array(
'authorization_code' => new AuthorizationCode($storage),
'user_credentials' => new UserCredentials($storage),
'refresh_token' => new RefreshToken($storage, array(
'always_issue_new_refresh_token' => true,
)),
);
$server = new OAuth2Server($storage, array(
'enforce_state' => true,
'allow_implicit' => true,
'use_openid_connect' => true,
'issuer' => $_SERVER['HTTP_HOST'],
),$grantTypes);
$server->addStorage($this->getKeyStorage(), 'public_key');
$app['oauth_server'] = $server;
$app['oauth_response'] = new BridgeResponse();
}
public function connect(Application $app)
{
$this->setup($app);
$routing = $app['controllers_factory'];
Controllers\Authorize::addRoutes($routing);
Controllers\Token::addRoutes($routing);
Controllers\Resource::addRoutes($routing);
return $routing;
}
private function generateSqliteDb()
{
include_once($this->getProjectRoot().'/data/rebuild_db.php');
}
private function getKeyStorage()
{
$publicKey = file_get_contents($this->getProjectRoot().'/data/pubkey.pem');
$privateKey = file_get_contents($this->getProjectRoot().'/data/privkey.pem');
$keyStorage = new Memory(array('keys' => array(
'public_key' => $publicKey,
'private_key' => $privateKey,
)));
return $keyStorage;
}
private function getProjectRoot()
{
return dirname(dirname(dirname(__DIR__)));
}
}
【问题讨论】：
-
after that it is redirecting to login page stating Oauth2 error- 什么是重定向到登录页面？您的 OAuth 服务器、后端代码、前端代码？是什么触发了重定向？另外，您得到的确切错误是什么？After this Its getting failed- 错误是什么？服务器的日志说什么？您如何调用令牌端点？为了帮助您回答这个问题，我们需要比“它失败了”更多的信息。也许您可以显示相关的错误响应、日志，也许还有一些代码？ -
请求您与 fiddler 进行检查，以便您可以追踪失败的位置。如果是回调函数即将在您的主应用程序中调用，则应该是匿名的。在进行网络检查 TLS 握手之前，现在大多数网站在提供对任何内容的访问之前都需要非常安全的握手，前提是调用的 URI 都是正确的。
-
还要检查托管实例，有时它会显示 2 个实例，一个用于主应用程序，而 owin 用于其他应用程序。
-
请点击以下链接，我也遇到了同样的问题。你可能会有所了解stackoverflow.com/questions/70861411/…
-
希望您在 okta 中配置了相同的单点登录 URL：{base uri}/saml2/acs 示例：localhost:2687/saml2/acs 受众 URI（SP 实体 ID）：{base uri}/saml2 示例：@ 987654331@
标签： php oauth-2.0 thingsboard