From c7c6d883cac5e6ce36e548ab21677f9c1d44f6f2 Mon Sep 17 00:00:00 2001 From: Galip Tolga Erdem Date: Mon, 15 Jan 2024 16:57:37 -0500 Subject: [PATCH] Updated jwt issuer validation of microservices for keycloak --- .../templates/administration-deployment.yaml | 6 ++--- .../charts/administration/values.yaml | 4 +-- .../basket/templates/basket-deployment.yaml | 2 ++ etc/k8s/eshoponabp/charts/basket/values.yaml | 1 + .../catalog/templates/catalog-deployment.yaml | 2 ++ etc/k8s/eshoponabp/charts/catalog/values.yaml | 1 + .../cmskit/templates/cmskit-deployment.yaml | 2 ++ etc/k8s/eshoponabp/charts/cmskit/values.yaml | 1 + .../templates/identity-deployment.yaml | 2 ++ .../eshoponabp/charts/identity/values.yaml | 1 + .../templates/ordering-deployment.yaml | 2 ++ .../eshoponabp/charts/ordering/values.yaml | 1 + .../payment/templates/payment-deployment.yaml | 2 ++ etc/k8s/eshoponabp/charts/payment/values.yaml | 1 + etc/k8s/eshoponabp/values.st.yaml | 27 ++++++++++++------- .../JwtBearerConfigurationHelper.cs | 17 ++++++++++-- 16 files changed, 54 insertions(+), 18 deletions(-) diff --git a/etc/k8s/eshoponabp/charts/administration/templates/administration-deployment.yaml b/etc/k8s/eshoponabp/charts/administration/templates/administration-deployment.yaml index 889f6e8a..c5902d11 100644 --- a/etc/k8s/eshoponabp/charts/administration/templates/administration-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/administration/templates/administration-deployment.yaml @@ -29,10 +29,6 @@ spec: value: "{{ .Values.config.remoteServices.useCurrentToken }}" - name: App__CorsOrigins value: "{{ .Values.config.corsOrigins }}" - - name: IdentityClients__Default__Authority - value: "{{ .Values.synchedCommunication.authority }}" - - name: IdentityClients__Default__RequireHttps - value: "{{ .Values.config.authServer.requireHttpsMetadata }}" - name: "ConnectionStrings__AdministrationService" value: "{{ .Values.config.connectionStrings.administrationService }}" - name: "DOTNET_ENVIRONMENT" @@ -43,6 +39,8 @@ spec: value: "{{ .Values.config.authServer.authority }}" - name: "AuthServer__RequireHttpsMetadata" value: "{{ .Values.config.authServer.requireHttpsMetadata }}" + - name: "AuthServer__MetadataAddress" + value: "{{ .Values.config.authServer.metadataAddress }}" - name: "AuthServer__SwaggerClientId" value: "{{ .Values.config.authServer.swaggerClientId }}" - name: "AuthServer__SwaggerClientSecret" diff --git a/etc/k8s/eshoponabp/charts/administration/values.yaml b/etc/k8s/eshoponabp/charts/administration/values.yaml index ce4c296b..038199e8 100644 --- a/etc/k8s/eshoponabp/charts/administration/values.yaml +++ b/etc/k8s/eshoponabp/charts/administration/values.yaml @@ -4,10 +4,10 @@ config: connectionStrings: administrationService: # authServer: - authority: http://eshop-st-authserver + authority: http://eshop-st-keycloak:8080 requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080 swaggerClientId: WebGateway_Swagger - swaggerClientSecret: "1q2w3e*" remoteServices: abpIdentityBaseUrl: # useCurrentToken: "false" diff --git a/etc/k8s/eshoponabp/charts/basket/templates/basket-deployment.yaml b/etc/k8s/eshoponabp/charts/basket/templates/basket-deployment.yaml index 67110761..913ef657 100644 --- a/etc/k8s/eshoponabp/charts/basket/templates/basket-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/basket/templates/basket-deployment.yaml @@ -39,6 +39,8 @@ spec: value: "{{ .Values.config.authServer.authority }}" - name: "AuthServer__RequireHttpsMetadata" value: "{{ .Values.config.authServer.requireHttpsMetadata }}" + - name: "AuthServer__MetadataAddress" + value: "{{ .Values.config.authServer.metadataAddress }}" - name: "AuthServer__SwaggerClientId" value: "{{ .Values.config.swaggerClientId }}" - name: "AuthServer__SwaggerClientSecret" diff --git a/etc/k8s/eshoponabp/charts/basket/values.yaml b/etc/k8s/eshoponabp/charts/basket/values.yaml index 88c5fb4c..df2dda03 100644 --- a/etc/k8s/eshoponabp/charts/basket/values.yaml +++ b/etc/k8s/eshoponabp/charts/basket/values.yaml @@ -6,6 +6,7 @@ config: authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080 swaggerClientId: "WebGateway_Swagger" swaggerClientSecret: "1q2w3e*" dotnetEnv: Staging diff --git a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml index dd0cfa19..af72a3c7 100644 --- a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml @@ -45,6 +45,8 @@ spec: value: "{{ .Values.config.authServer.authority }}" - name: "AuthServer__RequireHttpsMetadata" value: "{{ .Values.config.authServer.requireHttpsMetadata }}" + - name: "AuthServer__MetadataAddress" + value: "{{ .Values.config.authServer.metadataAddress }}" - name: "AuthServer__SwaggerClientId" value: "{{ .Values.config.authServer.swaggerClientId }}" - name: "AuthServer__SwaggerClientSecret" diff --git a/etc/k8s/eshoponabp/charts/catalog/values.yaml b/etc/k8s/eshoponabp/charts/catalog/values.yaml index 4e09e976..a27e26ab 100644 --- a/etc/k8s/eshoponabp/charts/catalog/values.yaml +++ b/etc/k8s/eshoponabp/charts/catalog/values.yaml @@ -7,6 +7,7 @@ config: authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080 swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" dotnetEnv: Staging diff --git a/etc/k8s/eshoponabp/charts/cmskit/templates/cmskit-deployment.yaml b/etc/k8s/eshoponabp/charts/cmskit/templates/cmskit-deployment.yaml index da0340d5..a9d38fea 100644 --- a/etc/k8s/eshoponabp/charts/cmskit/templates/cmskit-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/cmskit/templates/cmskit-deployment.yaml @@ -41,6 +41,8 @@ spec: value: "{{ .Values.config.authServer.authority }}" - name: "AuthServer__RequireHttpsMetadata" value: "{{ .Values.config.authServer.requireHttpsMetadata }}" + - name: "AuthServer__MetadataAddress" + value: "{{ .Values.config.authServer.metadataAddress }}" - name: "AuthServer__SwaggerClientId" value: "{{ .Values.config.authServer.swaggerClientId }}" - name: "AuthServer__SwaggerClientSecret" diff --git a/etc/k8s/eshoponabp/charts/cmskit/values.yaml b/etc/k8s/eshoponabp/charts/cmskit/values.yaml index 185b1685..b1850731 100644 --- a/etc/k8s/eshoponabp/charts/cmskit/values.yaml +++ b/etc/k8s/eshoponabp/charts/cmskit/values.yaml @@ -7,6 +7,7 @@ config: authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080 swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" remoteServices: diff --git a/etc/k8s/eshoponabp/charts/identity/templates/identity-deployment.yaml b/etc/k8s/eshoponabp/charts/identity/templates/identity-deployment.yaml index f67284ec..cdb4a5f4 100644 --- a/etc/k8s/eshoponabp/charts/identity/templates/identity-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/identity/templates/identity-deployment.yaml @@ -49,6 +49,8 @@ spec: value: "{{ .Values.config.authServer.authority }}" - name: "AuthServer__RequireHttpsMetadata" value: "{{ .Values.config.authServer.requireHttpsMetadata }}" + - name: "AuthServer__MetadataAddress" + value: "{{ .Values.config.authServer.metadataAddress }}" - name: "AuthServer__SwaggerClientId" value: "{{ .Values.config.authServer.swaggerClientId }}" - name: "AuthServer__SwaggerClientSecret" diff --git a/etc/k8s/eshoponabp/charts/identity/values.yaml b/etc/k8s/eshoponabp/charts/identity/values.yaml index 133228ea..02535f3f 100644 --- a/etc/k8s/eshoponabp/charts/identity/values.yaml +++ b/etc/k8s/eshoponabp/charts/identity/values.yaml @@ -7,6 +7,7 @@ config: authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080 swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" keycloak: diff --git a/etc/k8s/eshoponabp/charts/ordering/templates/ordering-deployment.yaml b/etc/k8s/eshoponabp/charts/ordering/templates/ordering-deployment.yaml index 3ad228eb..98b3fde9 100644 --- a/etc/k8s/eshoponabp/charts/ordering/templates/ordering-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/ordering/templates/ordering-deployment.yaml @@ -41,6 +41,8 @@ spec: value: "{{ .Values.config.authServer.authority }}" - name: "AuthServer__RequireHttpsMetadata" value: "{{ .Values.config.authServer.requireHttpsMetadata }}" + - name: "AuthServer__MetadataAddress" + value: "{{ .Values.config.authServer.metadataAddress }}" - name: "AuthServer__SwaggerClientId" value: "{{ .Values.config.authServer.swaggerClientId }}" - name: "AuthServer__SwaggerClientSecret" diff --git a/etc/k8s/eshoponabp/charts/ordering/values.yaml b/etc/k8s/eshoponabp/charts/ordering/values.yaml index a427d0cf..da234936 100644 --- a/etc/k8s/eshoponabp/charts/ordering/values.yaml +++ b/etc/k8s/eshoponabp/charts/ordering/values.yaml @@ -7,6 +7,7 @@ config: authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080 swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" dotnetEnv: Staging diff --git a/etc/k8s/eshoponabp/charts/payment/templates/payment-deployment.yaml b/etc/k8s/eshoponabp/charts/payment/templates/payment-deployment.yaml index 30753515..2ac12514 100644 --- a/etc/k8s/eshoponabp/charts/payment/templates/payment-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/payment/templates/payment-deployment.yaml @@ -41,6 +41,8 @@ spec: value: "{{ .Values.config.authServer.authority }}" - name: "AuthServer__RequireHttpsMetadata" value: "{{ .Values.config.authServer.requireHttpsMetadata }}" + - name: "AuthServer__MetadataAddress" + value: "{{ .Values.config.authServer.metadataAddress }}" - name: "AuthServer__SwaggerClientId" value: "{{ .Values.config.authServer.swaggerClientId }}" - name: "AuthServer__SwaggerClientSecret" diff --git a/etc/k8s/eshoponabp/charts/payment/values.yaml b/etc/k8s/eshoponabp/charts/payment/values.yaml index d641f59b..fa51d483 100644 --- a/etc/k8s/eshoponabp/charts/payment/values.yaml +++ b/etc/k8s/eshoponabp/charts/payment/values.yaml @@ -7,6 +7,7 @@ config: authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080 swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" dotnetEnv: Staging diff --git a/etc/k8s/eshoponabp/values.st.yaml b/etc/k8s/eshoponabp/values.st.yaml index a778b7fe..6cd0278d 100644 --- a/etc/k8s/eshoponabp/values.st.yaml +++ b/etc/k8s/eshoponabp/values.st.yaml @@ -70,7 +70,7 @@ public-web: identity: config: selfUrl: https://identity.eshoponabp.dev - corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev + corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev,https://admin.eshoponabp.dev connectionStrings: identityService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Identity;User ID=postgres;password=myPassw0rd;Pooling=false" administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false" @@ -80,8 +80,9 @@ identity: adminPassword: 1q2w3E* realmName: master authServer: - authority: http://account.eshoponabp.dev + authority: https://account.eshoponabp.dev/realms/master requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080/realms/master swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" dotnetEnv: Staging @@ -116,8 +117,9 @@ administration: connectionStrings: administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false" authServer: - authority: http://account.eshoponabp.dev + authority: https://account.eshoponabp.dev/realms/master requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080/realms/master swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" remoteServices: @@ -223,8 +225,9 @@ basket: connectionStrings: administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false" authServer: - authority: http://account.eshoponabp.dev + authority: https://account.eshoponabp.dev/realms/master requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080/realms/master swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" dotnetEnv: Staging @@ -250,8 +253,9 @@ catalog: catalogService: "mongodb://eshop-st-mongodb/EShopOnAbp_Catalog" administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false" authServer: - authority: http://account.eshoponabp.dev + authority: https://account.eshoponabp.dev/realms/master requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080/realms/master swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" dotnetEnv: Staging @@ -274,13 +278,14 @@ catalog: ordering: config: selfUrl: https://ordering.eshoponabp.dev - corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev + corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev,https://admin.eshoponabp.dev connectionStrings: orderingService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Ordering;User ID=postgres;password=myPassw0rd;Pooling=false" administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false" authServer: - authority: http://account.eshoponabp.dev + authority: https://account.eshoponabp.dev/realms/master requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080/realms/master swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" dotnetEnv: Staging @@ -298,13 +303,14 @@ ordering: cmskit: config: selfUrl: https://cmskit.eshoponabp.dev - corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev + corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev,https://admin.eshoponabp.dev connectionStrings: cmskitervice: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Cmskit;User ID=postgres;password=myPassw0rd;Pooling=false" administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false" authServer: - authority: http://account.eshoponabp.dev + authority: https://account.eshoponabp.dev/realms/master requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080/realms/master swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" remoteServices: @@ -326,13 +332,14 @@ cmskit: payment: config: selfUrl: https://payment.eshoponabp.dev - corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev + corsOrigins: https://gateway-web.eshoponabp.dev,https://gateway-public.eshoponabp.dev,https://admin.eshoponabp.dev connectionStrings: paymentService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Payment;User ID=postgres;password=myPassw0rd;Pooling=false" administrationService: "Host=eshop-st-postgresdb;Port=5432;Database=EShopOnAbp_Administration;User ID=postgres;password=myPassw0rd;Pooling=false" authServer: authority: http://account.eshoponabp.dev requireHttpsMetadata: "false" + metadataAddress: http://eshop-st-keycloak:8080/realms/master swaggerClientId: WebGateway_Swagger swaggerClientSecret: "1q2w3e*" remoteServices: diff --git a/shared/EShopOnAbp.Shared.Hosting.Microservices/JwtBearerConfigurationHelper.cs b/shared/EShopOnAbp.Shared.Hosting.Microservices/JwtBearerConfigurationHelper.cs index b00229f1..9bf9c8fe 100644 --- a/shared/EShopOnAbp.Shared.Hosting.Microservices/JwtBearerConfigurationHelper.cs +++ b/shared/EShopOnAbp.Shared.Hosting.Microservices/JwtBearerConfigurationHelper.cs @@ -1,6 +1,7 @@ -using Microsoft.AspNetCore.Authentication.JwtBearer; +using System; +using Microsoft.AspNetCore.Authentication.JwtBearer; using Microsoft.Extensions.DependencyInjection; -using System; +using Microsoft.IdentityModel.Tokens; using Volo.Abp.Modularity; namespace EShopOnAbp.Shared.Hosting.Microservices; @@ -19,6 +20,18 @@ public static class JwtBearerConfigurationHelper options.Authority = configuration["AuthServer:Authority"]; options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); options.Audience = audience; + // IDX10204: Unable to validate issuer on K8s if not set + options.TokenValidationParameters = new TokenValidationParameters() + { + ValidIssuers = new[] + { configuration["AuthServer:Authority"], configuration["AuthServer:MetadataAddress"] }, + // IDX10500: Signature validation failed. No security keys were provided to validate the signature on K8s + SignatureValidator = delegate(string token, TokenValidationParameters parameters) + { + var jwt = new Microsoft.IdentityModel.JsonWebTokens.JsonWebToken(token); + return jwt; + } + }; }); } } \ No newline at end of file