如何配置 Keycloak 以与 Guacamole 的 OpenID 插件一起使用？

Question

我正在尝试使用 KeyCloak 将 Apache Guacamole 设置为 OpenID Connect 授权服务器。

Guacamole 将我重定向到 KeyCloak，我可以使用我在 KeyCloak 上创建的用户登录，然后我被重定向回 Guacamole，但它说我的令牌无效

08:08:11.477 [http-nio-4432-exec-7] INFO  o.a.g.a.o.t.TokenValidationService - Rejected invalid OpenID token: Unable to process JOSE object (cause: org.jose4j.lang.UnresolvableKeyException: Unable to find a suitable verification key for JWS w/ header {"alg":"RS256","typ" : "JWT","kid" : "8ZNpgh_vnmG0HMMNYdOz1lw4ECoWxmsiUGte1mJfvyI"} due to an unexpected exception (javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty) while obtaining or using keys from JWKS endpoint at https://172.16.47.229:12345/auth/realms/Guacamole-test/protocol/openid-connect/certs): JsonWebSignature{"alg":"RS256","typ" : "JWT","kid" : "8ZNpgh_vnmG0HMMNYdOz1lw4ECoWxmsiUGte1mJfvyI"}->eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI4Wk5wZ2hfdm5tRzBITU1OWWRPejFsdzRFQ29XeG1zaVVHdGUxbUpmdnlJIn0.eyJleHAiOjE2MDIzOTczODgsImlhdCI6MTYwMjM5NjQ4OCwiYXV0aF90aW1lIjoxNjAyMzk2NDcwLCJqdGkiOiI5Y2RiZDVjZC01MDJhLTRjNmItYTM3Mi1jZDIxMTNjNTE1NTMiLCJpc3MiOiJodHRwczovLzE3Mi4xNi40Ny4yMjk6MTIzNDUvYXV0aC9yZWFsbXMvR3VhY2Ftb2xlLXRlc3QiLCJhdWQiOiJHdWFjYW1vbGUiLCJzdWIiOiI1YzQ3N2NiZC04ZjIzLTRlMjEtYmNhMi1kMzNlMTRhZGY0ZDYiLCJ0eXAiOiJJRCIsImF6cCI6Ikd1YWNhbW9sZSIsIm5vbmNlIjoiaTQyZDBpZTc4c2s0MjRjMHJzMmJvdTM4YnUiLCJzZXNzaW9uX3N0YXRlIjoiMjNlZjdhMTYtMDhhNS00YTNkLTgxYTItYTQ2ZmE1NmM1NjE3IiwiYWNyIjoiMCIsImlzX3N1cGVydXNlciI6IlRydWUiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsIm5hbWUiOiJ0ZXN0IHRlc3QiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0dXNlciIsImdpdmVuX25hbWUiOiJ0ZXN0IiwiZmFtaWx5X25hbWUiOiJ0ZXN0IiwiZW1haWwiOiJ0ZXN0QHRlc3QuY29tIn0.eOhkDqcgfdJnO12PRDqLIHACRNVdVHoSDFjThHWc6Ug1gdoz9t_T2K7F_B6dJSbNygAJrGvc5BVRx9XCJH1fVFSYhpXVqCO0jrHm0XJKhw_kBce4x3ZluGAtktx614j9qFzUwZHXOkFAUGPtyPQKuRTfdzHqQUILLJhVdSRPmou40rX31-l7VwqWZk_Yp1JCdQsA61XvJcQrU_aiKivZFaDGiY5GrnpL8zcEwJcFemptVoGKrG63O_LjxDCxhLpO1C1fi8GjngMSfco9aAp4AaGpHWy8ofJAu-TWbLGf-UPLUhC3lf903-Q_BU3eehYxtMyN1eet0HeGm0x_gV_wvA

在KeyCloak中我创建了一个客户端如下：

（一旦我开始工作，将更改有效的重定向 URI）

我的 guacamole.properites 看起来像这样：

guacd-port: 4822
guacd-hostname: localhost

# OpenID Connect Properties
openid-authorization-endpoint: https://172.16.47.229:12345/auth/realms/Guacamole-test/protocol/openid-connect/auth
openid-jwks-endpoint: https://172.16.47.229:12345/auth/realms/Guacamole-test/protocol/openid-connect/certs
openid-issuer: https://172.16.47.229:12345/auth/realms/Guacamole-test
openid-client-id: Guacamole
openid-redirect-uri: http://172.16.47.229:4432/guacamole/

# Postgresql Properties
postgresql-hostname: 172.16.47.229
postgresql-port: 4444
postgresql-database: guacamoledb
postgresql-username: guacamoleuser
postgresql-password: test

我需要更改什么才能使鳄梨酱接受令牌？

更新：如果我将 KeyCloak 与 HTTP 而不是 HTTPS 一起使用，我发现配置可以正常工作，但这是不可取的。我现在还配置了 Guacamole，或者更准确地说是托管鳄梨酱的 tomcat，使用 https，但我仍然无法让它工作（无需为 KeyCloak 使用 HTTP）。

Answer 1

我遇到了同样的问题。很可能您只需要为您的 IdP (Keycloak) 提供有效的 SSL 证书。

在此处找到了可能的解决方法：。

我已经 re-compiled guacamole-auth-openid 扩展了这个变化：

diff --git a/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java b/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
index 5efb09dab..27d818ee5 100644
--- a/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
+++ b/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
@@ -79,6 +79,7 @@ public class TokenValidationService {
 
         // Create JWT consumer for validating received token
         JwtConsumer jwtConsumer = new JwtConsumerBuilder()
+               .setSkipSignatureVerification()
                 .setRequireExpirationTime()
                 .setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
                 .setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())

这解决了问题。不要认为它适用于生产需求，但在生产中不应使用 self-signed 证书。

Answer 2

使用 Guacamole 1.4.0 和 Keycloak 15.0.2，我通过在 Guacamole 容器中安装自定义 cacerts 密钥库来解决 HTTPS 问题。这个自定义密钥库只是导入了 Let's Encrypt CA 包 https://letsencrypt.org/certs/isrgrootx1.pem 的 OpenJDK 8 cacerts。因为我的 Keycloak 和 Guacamole 实例使用 Let's Encrypt 证书。

我在主机上安装了 OpenJDK 8。所以 Docker 挂载是

/etc/ssl/certs/java/cacerts:/usr/local/openjdk-8/jre/lib/security/cacerts

如何配置 Keycloak 以与 Guacamole 的 OpenID 插件一起使用？

How to configure Keycloak to work with Guacamole's OpenID plugin?

keycloak

openid-connect

guacamole