Я пытаюсь настроить интеграцию между App ID и tWAS. Я проследил «Обзор» службы App ID и успешно настроил ее с помощью Liberty, используя предоставленный пример, но такая же конфигурация не удалась для tWAS. Что я уже сделал:
Когда я пытаюсь войти в систему, меня правильно перенаправляют на страницу входа в систему с идентификатором приложения, но после ввода учетных данных он перенаправляет и отображает 403 Запрещено.
Вот трассировка стека, любые подсказки, что может быть не так или что я пропускаю ??
[4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU < getSecuredConnection returns [not null] Exit
[4/17/19 16:51:28:016 UTC] 000000bf SessionCache 3 getOpServerConnTimeout returns [20000])
[4/17/19 16:51:28:016 UTC] 000000bf RelyingParty 3 getRevokeEndpoint returns [null]
[4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU 3 isRevokeEndpoint[false]
[4/17/19 16:51:28:016 UTC] 000000bf RelyingParty 3 getTokenEndpointAuthMethod returns [basic]
[4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU 3 Setting [Authorization] property on request with basicauth info
[4/17/19 16:51:28:016 UTC] 000000bf RelyingParty 3 getClientBasicAuth returns [Basic OGExZmM2NjQtYTY3Zi00YTk4LWJmM2YtN2E0N2FmYjE4NTdlOk5XTmhaVGN5TVRFdFlUbGhaaTAwTlRkbUxXRTNOemd0TVdSa1lXVTVNelkxTXpWaw==]
[4/17/19 16:51:28:105 UTC] 000000bf RelyingPartyU 3 Response code: 403
[4/17/19 16:51:28:105 UTC] 000000bf RelyingPartyU > getData(inStream[not null]) Entry
[4/17/19 16:51:28:108 UTC] 000000bf RelyingPartyU < getData returns [<!DOCTYPE html>
....
[4/17/19 16:51:28:110 UTC] 000000bf RelyingParty E CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
[4/17/19 16:51:28:111 UTC] 000000bf WebAuthentica E SECJ0126E: Trust Association failed during validation. The exception is com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:526)
at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:301)
at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
at com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(WebAuthenticator.java:438)
at com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthenticator.java:3103)
at com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectIfNeeded(WebCollaborator.java:3522)
at com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborator.java:851)
at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebCollaborator.java:447)
at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preInvokeCollaborators(CollaboratorHelper.java:436)
at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1091)
at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4217)
at com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppImpl.java:2208)
at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:304)
at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1030)
at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1187)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:694)
at com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1833)
at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
. Make sure that the setup is correct and that the user credentials are valid.
[4/17/19 16:51:28:116 UTC] 000000bf WebCollaborat A SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
Также пытался изменить метод аутентификации на
provider_1.tokenEndpointAuthMethod=post
но тот же результат, присоединяя полную трассировку от вызова trace1.txt
UPDATE
После ваших изменений и некоторых изменений, которые я сделал в настройках, я перешел дальше. Я сбросил эту настройку на Basic
provider_1.tokenEndpointAuthMethod=Basic
Теперь ошибка:
[4/18/19 12:07:58:638 UTC] 000000a6 WebCollaborat A SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]]. Check the logs for details that lead to this exception.
И трассировка показывает:
[4/18/19 12:07:58:614 UTC] 000000a6 JWT E CWWKS1756E: Validation failed for the ID token requested by [....] using the [RS256] algorithm due to a signature verification failure: [JsonObject].
[4/18/19 12:07:58:617 UTC] 000000a6 SessionData 3 Failed to validate id token, exception thrown during verify [JsonObject]
[4/18/19 12:07:58:629 UTC] 000000a6 WebAuthentica E SECJ0126E: Trust Association failed during validation. The exception is com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]]. Check the logs for details that lead to this exception.
at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:532)
at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:301)
at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
at com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(WebAuthenticator.java:438)
at com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthenticator.java:3171)
at com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectIfNeeded(WebCollaborator.java:3522)
at com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborator.java:851)
at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebCollaborator.java:447)
at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preInvokeCollaborators(CollaboratorHelper.java:436)
at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1091)
at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4217)
at com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppImpl.java:2208)
at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:304)
at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1030)
at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1187)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:694)
at com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1833)
at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
Caused by: com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]
at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:483)
at com.ibm.ws.security.oidc.client.SessionData.processJSON(SessionData.java:236)
at com.ibm.ws.security.oidc.client.SessionData.createData(SessionData.java:166)
at com.ibm.ws.security.oidc.client.SessionData.<init>(SessionData.java:137)
at com.ibm.ws.security.oidc.client.SessionCache.createEntry(SessionCache.java:184)
at com.ibm.ws.security.oidc.client.RelyingPartyUtils.createSessionDataObject(RelyingPartyUtils.java:1299)
at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:529)
... 31 more
Caused by: java.lang.UnsupportedOperationException: JsonObject
at com.google.gson.JsonElement.getAsString(JsonElement.java:191)
at com.ibm.ws.security.openidconnect.token.JsonTokenUtil.fromJsonToken(JsonTokenUtil.java:154)
at com.ibm.ws.security.openidconnect.token.JWT.fromJsonToken(JWT.java:553)
at com.ibm.ws.security.openidconnect.token.JWT.verify(JWT.java:886)
at com.ibm.ws.security.openidconnect.token.IDToken.verify(IDToken.java:578)
at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:471)
... 37 more