Updated jwt issuer validation of microservices for keycloak

etc/k8s/eshoponabp/charts/administration/templates/administration-deployment.yaml

@@ -29,10 +29,6 @@ spec:
           value: "{{ .Values.config.remoteServices.useCurrentToken }}" 
         - name: App__CorsOrigins
           value: "{{ .Values.config.corsOrigins }}"
-        - name: IdentityClients__Default__Authority
-          value: "{{ .Values.synchedCommunication.authority }}"
-        - name: IdentityClients__Default__RequireHttps
-          value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
         - name: "ConnectionStrings__AdministrationService"
           value: "{{ .Values.config.connectionStrings.administrationService }}"
         - name: "DOTNET_ENVIRONMENT"
@@ -43,6 +39,8 @@ spec:
           value: "{{ .Values.config.authServer.authority }}"
         - name: "AuthServer__RequireHttpsMetadata"
           value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
+        - name: "AuthServer__MetadataAddress"
+          value: "{{ .Values.config.authServer.metadataAddress }}"
         - name: "AuthServer__SwaggerClientId"
           value: "{{ .Values.config.authServer.swaggerClientId }}"
         - name: "AuthServer__SwaggerClientSecret"

etc/k8s/eshoponabp/charts/administration/values.yaml

@@ -4,10 +4,10 @@ config:
   connectionStrings:
     administrationService: #
   authServer:
-    authority: http://eshop-st-authserver
+    authority: http://eshop-st-keycloak:8080
     requireHttpsMetadata: "false"
+    metadataAddress: http://eshop-st-keycloak:8080
     swaggerClientId: WebGateway_Swagger
-    swaggerClientSecret: "1q2w3e*"
   remoteServices:
     abpIdentityBaseUrl: #
     useCurrentToken: "false"

etc/k8s/eshoponabp/charts/basket/templates/basket-deployment.yaml

@@ -39,6 +39,8 @@ spec:
           value: "{{ .Values.config.authServer.authority }}"
         - name: "AuthServer__RequireHttpsMetadata"
           value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
+        - name: "AuthServer__MetadataAddress"
+          value: "{{ .Values.config.authServer.metadataAddress }}"
         - name: "AuthServer__SwaggerClientId"
           value: "{{ .Values.config.swaggerClientId }}"
         - name: "AuthServer__SwaggerClientSecret"

etc/k8s/eshoponabp/charts/basket/values.yaml

@@ -6,6 +6,7 @@ config:
   authServer:
     authority: http://eshop-st-authserver
     requireHttpsMetadata: "false"
+    metadataAddress: http://eshop-st-keycloak:8080
     swaggerClientId: "WebGateway_Swagger"
     swaggerClientSecret: "1q2w3e*"
   dotnetEnv: Staging

etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml

@@ -45,6 +45,8 @@ spec:
           value: "{{ .Values.config.authServer.authority }}"
         - name: "AuthServer__RequireHttpsMetadata"
           value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
+        - name: "AuthServer__MetadataAddress"
+          value: "{{ .Values.config.authServer.metadataAddress }}"
         - name: "AuthServer__SwaggerClientId"
           value: "{{ .Values.config.authServer.swaggerClientId }}"
         - name: "AuthServer__SwaggerClientSecret"

etc/k8s/eshoponabp/charts/catalog/values.yaml

@@ -7,6 +7,7 @@ config:
   authServer:
     authority: http://eshop-st-authserver
     requireHttpsMetadata: "false"
+    metadataAddress: http://eshop-st-keycloak:8080
     swaggerClientId: WebGateway_Swagger
     swaggerClientSecret: "1q2w3e*"
   dotnetEnv: Staging

etc/k8s/eshoponabp/charts/cmskit/templates/cmskit-deployment.yaml

@@ -41,6 +41,8 @@ spec:
           value: "{{ .Values.config.authServer.authority }}"
         - name: "AuthServer__RequireHttpsMetadata"
           value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
+        - name: "AuthServer__MetadataAddress"
+          value: "{{ .Values.config.authServer.metadataAddress }}"
         - name: "AuthServer__SwaggerClientId"
           value: "{{ .Values.config.authServer.swaggerClientId }}"
         - name: "AuthServer__SwaggerClientSecret"

etc/k8s/eshoponabp/charts/cmskit/values.yaml

@@ -7,6 +7,7 @@ config:
   authServer:
     authority: http://eshop-st-authserver
     requireHttpsMetadata: "false"
+    metadataAddress: http://eshop-st-keycloak:8080
     swaggerClientId: WebGateway_Swagger
     swaggerClientSecret: "1q2w3e*"
   remoteServices:

etc/k8s/eshoponabp/charts/identity/templates/identity-deployment.yaml

@@ -49,6 +49,8 @@ spec:
           value: "{{ .Values.config.authServer.authority }}"
         - name: "AuthServer__RequireHttpsMetadata"
           value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
+        - name: "AuthServer__MetadataAddress"
+          value: "{{ .Values.config.authServer.metadataAddress }}"
         - name: "AuthServer__SwaggerClientId"
           value: "{{ .Values.config.authServer.swaggerClientId }}"
         - name: "AuthServer__SwaggerClientSecret"

etc/k8s/eshoponabp/charts/identity/values.yaml

@@ -7,6 +7,7 @@ config:
   authServer:
     authority: http://eshop-st-authserver
     requireHttpsMetadata: "false"
+    metadataAddress: http://eshop-st-keycloak:8080
     swaggerClientId: WebGateway_Swagger
     swaggerClientSecret: "1q2w3e*"
   keycloak:

etc/k8s/eshoponabp/charts/ordering/templates/ordering-deployment.yaml

@@ -41,6 +41,8 @@ spec:
           value: "{{ .Values.config.authServer.authority }}"
         - name: "AuthServer__RequireHttpsMetadata"
           value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
+        - name: "AuthServer__MetadataAddress"
+          value: "{{ .Values.config.authServer.metadataAddress }}"
         - name: "AuthServer__SwaggerClientId"
           value: "{{ .Values.config.authServer.swaggerClientId }}"
         - name: "AuthServer__SwaggerClientSecret"

etc/k8s/eshoponabp/charts/ordering/values.yaml

@@ -7,6 +7,7 @@ config:
   authServer:
     authority: http://eshop-st-authserver
     requireHttpsMetadata: "false"
+    metadataAddress: http://eshop-st-keycloak:8080
     swaggerClientId: WebGateway_Swagger
     swaggerClientSecret: "1q2w3e*"
   dotnetEnv: Staging

etc/k8s/eshoponabp/charts/payment/templates/payment-deployment.yaml

@@ -41,6 +41,8 @@ spec:
           value: "{{ .Values.config.authServer.authority }}"
         - name: "AuthServer__RequireHttpsMetadata"
           value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
+        - name: "AuthServer__MetadataAddress"
+          value: "{{ .Values.config.authServer.metadataAddress }}"
         - name: "AuthServer__SwaggerClientId"
           value: "{{ .Values.config.authServer.swaggerClientId }}"
         - name: "AuthServer__SwaggerClientSecret"

etc/k8s/eshoponabp/charts/payment/values.yaml

@@ -7,6 +7,7 @@ config:
   authServer:
     authority: http://eshop-st-authserver
     requireHttpsMetadata: "false"
+    metadataAddress: http://eshop-st-keycloak:8080
     swaggerClientId: WebGateway_Swagger
     swaggerClientSecret: "1q2w3e*"
   dotnetEnv: Staging

etc/k8s/eshoponabp/values.st.yaml

@@ -70,7 +70,7 @@ public-web:
 identity:
   config:
     selfUrl: https://identity.eshoponabp.dev
-    corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev
+    corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev,https://admin.eshoponabp.dev
     connectionStrings:
       identityService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Identity;User ID=postgres;password=myPassw0rd;Pooling=false"
       administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false"
@@ -80,8 +80,9 @@ identity:
       adminPassword: 1q2w3E*
       realmName: master
     authServer:
-      authority: http://account.eshoponabp.dev
+      authority: https://account.eshoponabp.dev/realms/master
       requireHttpsMetadata: "false"
+      metadataAddress: http://eshop-st-keycloak:8080/realms/master
       swaggerClientId: WebGateway_Swagger
       swaggerClientSecret: "1q2w3e*"
     dotnetEnv: Staging
@@ -116,8 +117,9 @@ administration:
     connectionStrings:
       administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false"
     authServer:
-      authority: http://account.eshoponabp.dev
+      authority: https://account.eshoponabp.dev/realms/master
       requireHttpsMetadata: "false"
+      metadataAddress: http://eshop-st-keycloak:8080/realms/master
       swaggerClientId: WebGateway_Swagger
       swaggerClientSecret: "1q2w3e*"
     remoteServices:
@@ -223,8 +225,9 @@ basket:
     connectionStrings:
       administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false"
     authServer:
-      authority: http://account.eshoponabp.dev
+      authority: https://account.eshoponabp.dev/realms/master
       requireHttpsMetadata: "false"
+      metadataAddress: http://eshop-st-keycloak:8080/realms/master
       swaggerClientId: WebGateway_Swagger
       swaggerClientSecret: "1q2w3e*"
     dotnetEnv: Staging
@@ -250,8 +253,9 @@ catalog:
       catalogService: "mongodb://eshop-st-mongodb/EShopOnAbp_Catalog"
       administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false"
     authServer:
-      authority: http://account.eshoponabp.dev
+      authority: https://account.eshoponabp.dev/realms/master
       requireHttpsMetadata: "false"
+      metadataAddress: http://eshop-st-keycloak:8080/realms/master
       swaggerClientId: WebGateway_Swagger
       swaggerClientSecret: "1q2w3e*"
     dotnetEnv: Staging
@@ -274,13 +278,14 @@ catalog:
 ordering:
   config:
     selfUrl: https://ordering.eshoponabp.dev
-    corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev
+    corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev,https://admin.eshoponabp.dev
     connectionStrings:
       orderingService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Ordering;User ID=postgres;password=myPassw0rd;Pooling=false"
       administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false"
     authServer:
-      authority: http://account.eshoponabp.dev
+      authority: https://account.eshoponabp.dev/realms/master
       requireHttpsMetadata: "false"
+      metadataAddress: http://eshop-st-keycloak:8080/realms/master
       swaggerClientId: WebGateway_Swagger
       swaggerClientSecret: "1q2w3e*"
     dotnetEnv: Staging
@@ -298,13 +303,14 @@ ordering:
 cmskit:
   config:
     selfUrl: https://cmskit.eshoponabp.dev
-    corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev
+    corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev,https://admin.eshoponabp.dev
     connectionStrings:
       cmskitervice: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Cmskit;User ID=postgres;password=myPassw0rd;Pooling=false"
       administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false"
     authServer:
-      authority: http://account.eshoponabp.dev
+      authority: https://account.eshoponabp.dev/realms/master
       requireHttpsMetadata: "false"
+      metadataAddress: http://eshop-st-keycloak:8080/realms/master
       swaggerClientId: WebGateway_Swagger
       swaggerClientSecret: "1q2w3e*"
     remoteServices:
@@ -326,13 +332,14 @@ cmskit:
 payment:
   config:
     selfUrl: https://payment.eshoponabp.dev
-    corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev
+    corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev,https://admin.eshoponabp.dev
     connectionStrings:
       paymentService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Payment;User ID=postgres;password=myPassw0rd;Pooling=false"
       administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false"
     authServer:
       authority: http://account.eshoponabp.dev
       requireHttpsMetadata: "false"
+      metadataAddress: http://eshop-st-keycloak:8080/realms/master
       swaggerClientId: WebGateway_Swagger
       swaggerClientSecret: "1q2w3e*"
     remoteServices:

shared/EShopOnAbp.Shared.Hosting.Microservices/JwtBearerConfigurationHelper.cs

@@ -1,6 +1,7 @@
-using Microsoft.AspNetCore.Authentication.JwtBearer;
+using System;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.Extensions.DependencyInjection;
-using System;
+using Microsoft.IdentityModel.Tokens;
 using Volo.Abp.Modularity;
 
 namespace EShopOnAbp.Shared.Hosting.Microservices;
@@ -19,6 +20,18 @@ public static class JwtBearerConfigurationHelper
                 options.Authority = configuration["AuthServer:Authority"];
                 options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]);
                 options.Audience = audience;
+                // IDX10204: Unable to validate issuer on K8s if not set
+                options.TokenValidationParameters = new TokenValidationParameters()
+                {
+                    ValidIssuers = new[]
+                        { configuration["AuthServer:Authority"], configuration["AuthServer:MetadataAddress"] },
+                    // IDX10500: Signature validation failed. No security keys were provided to validate the signature on K8s
+                    SignatureValidator = delegate(string token, TokenValidationParameters parameters)
+                    {
+                        var jwt = new Microsoft.IdentityModel.JsonWebTokens.JsonWebToken(token);
+                        return jwt;
+                    }
+                };
             });
     }
 }