Как превратить Azure токен доступа в приготовление сеанса ie? - PullRequest
Новая
       128

Как превратить Azure токен доступа в приготовление сеанса ie?

0 голосов
/ 19 июня 2020

У меня есть приложение Tomcat, настроенное на Azure ADFS SSO через SAML. SSO работает, однако теперь мне нужно получить доступ к моему приложению Tomcat через restful API с Azure ADFS SSO.

Мне удалось получить токен доступа из Azure AD SSO, выполнив 

curl -X POST -d 'grant_type=client_credentials&client_id=<APP_ID>&client_secret=<PASSWORD>&resource=https%3A%2F%2Fmanagement.azure.com%2F' https://login.microsoftonline.com/<TENANT_ID>/oauth2/token | jq .
      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                     Dload  Upload   Total   Spent    Left  Speed
    100  1592  100  1420  100   172   3169    383 --:--:-- --:--:-- --:--:--  3553
    {
      "token_type": "Bearer",
      "expires_in": "3599",
      "ext_expires_in": "3599",
      "expires_on": "1592338746",
      "not_before": "1592334846",
      "resource": "https://management.azure.com/",
      "access_token": "MY_TOKEN"
}

Если у меня не включен SSO, я обычно создавал ie в мое приложение Tomcat делает это 

curl -v -k -X POST 'https://<HOSTNAME>/<APP>/j_spring_security_check?j_username=<USERNAME>&j_password=<PASSWORD>' -c ./cookie.txt

Я пытался передать токен в качестве заголовка, но не работал 

curl -v -k -X POST 'https://<HOSTNAME>/<APP>/j_spring_security_check?j_username=<USERNAME>&j_password=<PASSWORD>' -c ./cookie.txt --header "Authorization: Bearer MY_TOKEN"

Cook ie .txt created. Затем я попытался вызвать GET API, но не получил ожидаемого ответа JSON, но вот подробный журнал от curl. 

curl -v -k -X GET 'https://<HOSTNAME>/<APP>/source/v1/getSources?type=EXTERNAL&count=2&sortAttr=name&sortDir=ASC' -b ./cookie.txt | jq .
Note: Unnecessary use of -X or --request, GET is already inferred.
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:04 --:--:--     0*   Trying 192.168.56.210...
* TCP_NODELAY set
  0     0    0     0    0     0      0      0 --:--:--  0:00:05 --:--:--     0* Connected to HOSTNAME> (192.168.56.210) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [223 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [81 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [859 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [333 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: C=blah; ST=us; L=us; O=blah; OU=blah; CN=blah
*  start date: Jun 16 14:21:29 2020 GMT
*  expire date: Sep 14 14:21:29 2020 GMT
*  issuer: C=blah; ST=us; L=us; O=blah; OU=blah; CN=blah
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
> GET /qdc/source/v1/getSources?type=EXTERNAL&count=2&sortAttr=name&sortDir=ASC HTTP/1.1
> Host: dfz.local:8443
> User-Agent: curl/7.64.1
> Accept: */*
> Cookie: JSESSIONID=1D244E5E4DBA30399E856E01909B0DDF
> 
< HTTP/1.1 302 Found
< Server: Apache-Coyote/1.1
< Cache-control: no-cache, no-store
< Pragma: no-cache
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Strict-Transport-Security: max-age=31536000 ; includeSubDomains
< Location: https://login.microsoftonline.com/f08ee33a-102b-4180-998b-3fdd8acc49ab/saml2?SAMLRequest=hZLNTsMwEIRfxdp7EseJwLGaogJCIIGoSODAzXGc1lViF69TIZ6e0B8BFzhantnxzufZxfvQk532aJwtIY0pEG2Va41dlfBc30QcLuYzlEPPtmIxhrV90m%2BjxkAmo0VxuClh9FY4iQaFlYNGEZSoFg%2F3gsVUbL0LTrkeyAJR%2BzBFXTmL46B9pf3OKP38dF%2FCOoQtiiRpu4%2B4d0r2gud5lry1KvlKSarqEcj1FG2sDPvnnhy9WxkbD0Z5h64LzvbG6li5Ieko1zrLZJRS1kR5ymlUFLyJsq5tuVQqL2Szn86A3Div9H7FEjrZowZyd12C5Oema7rNmVkVWdqwRm1yzlKzWVNTZJMGlxLR7PS3C3HUdxaDtKEERhmN6FmU8pqlIqOC8pin2SuQ5bGXS2MPff9VYnMQobit62W0fKxqIC8nbpMAjpTEPt3%2FxPP3YHliAvP%2FCAw6yFYGOUt%2BRs2Px9%2F%2FY%2F4J&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=HcbOW7%2BIOjXNr73H%2BKRHEtIbjJGPHa5CsXCeoSzVMVf5lCu07AEtpVPZmVw9IViBZcniKqhnC2zokz6ZOtVehsuNcSLDWpqViLLRicqBtRenmfe9RL5vI%2BlpcdS92wRT44V%2FMH1t3y7lILea34sLP2ySz0XVORSxL7FzEade3Q72cHQyu1xBuFlf9x7BUjxe8ZO5rZeGFsq98AQ9IwZIlJ3%2Fs%2F8Kp3eexw%2BmfVRhLU7eNLefDX%2BMfux%2BHvlKVlQpI6iHR1LSIEcNXX6nV%2BEAt7oa20FBDXV0PSGBy8hcBgzyPLhwFMWhe5%2BzUt9ssL2IO9kk8loWBNQek6x%2Bmpzw5w%3D%3D
< Content-Length: 0
< Date: Thu, 18 Jun 2020 21:30:08 GMT
< 
  0     0    0     0    0     0      0      0 --:--:--  0:00:05 --:--:--     0
* Connection #0 to host dfz.local left intact
* Closing connection 0

1 Ответ

0 голосов
/ 25 июня 2020

Curl для типа предоставления учетных данных клиента 

curl -X POST -d “grant_type=client_credentials&client_id=clientid&client_secret= secret&scope= https%3A%2F%2Fgraph.microsoft.com%2F.default” https://login.microsoftonline.com/tenantid/oauth2/v2.0/token

После получения токена используйте запрос ниже для передачи токена в заголовке 

curl -H "Authorization: Basic <_your_token_>" http://www.example.com
...