![](/img/trans.png)
[英]Authentication strategy simple uses unknown scheme: bearer-access-token
[英]Invalid Bearer Access Token
我們使用hapi-auth-jwt2
和jwks-rsa
來解碼和驗證 azureAD 訪問令牌。
這是我們的 jwt 策略,它在每條路線上都有效。
'use strict'
const jwt = require('hapi-auth-jwt2')
const jwksRsa = require('jwks-rsa')
const userCtrl = require('./../controllers/UserController')
const authHandler = require('./auth.factory').GetAuthHandler()
// TODO: Replace with current JSON web token formatting and active directory
module.exports = {
name: 'JWT Authentication',
register: async (server, options) => {
await server.register(jwt)
// Confirm that we are getting the correct PK
// const pk = await authHandler.GetPK()
const key = jwksRsa.hapiJwt2KeyAsync({
cache: true,
rateLimit: true,
jwksRequestsPerMinute: 5,
// jwksUri: 'https://YOUR_DOMAIN/.well-known/jwks.json'
jwksUri: 'https://login.microsoftonline.com/common/discovery/keys'
// https://login.microsoftonline.com/common/discovery/keys
// https://login.microsoftonline.com/common/.well-known/openid-configuration
})
server.auth.strategy('jwt', 'jwt', {
// Get the complete decoded token, because we need info from the header (the kid)
complete: true,
// Dynamically provide a signing key based on the kid in the header and the singing keys provided by the JWKS endpoint.
key: key,
// key: pk,
headerKey: 'authorization',
tokenType: 'Bearer',
validate: userCtrl.validate,
verifyOptions: {
algorithms: ['RS256'] // or HS256 RS256
}
})
server.auth.default('jwt')
console.log(key)
}
}
然后,我們將Authorization
header(即'Bearer ' + accessToken
)附加到http
並從locahost
即當前客戶端/前端向/sso
路由發出請求,服務器返回以下請求/響應
[1569928136140] INFO (11252 on PORT230): request completed
req: {
"id": "1569928136137:PORT230:11264:k17qg99b:10001",
"method": "get",
"url": "https://port230.5874.com/api/v2/user/sso",
"headers": {
"host": "port230.5874.com",
"connection": "keep-alive",
"accept": "application/json, text/plain, */*",
"origin": "http://localhost:8080",
"authorization": "Bearer ...",
"user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36",
"sec-fetch-mode": "cors",
"sec-fetch-site": "cross-site",
"referer": "http://localhost:8080/",
"accept-encoding": "gzip, deflate, br",
"accept-language": "en-US,en;q=0.9"
}
}
res: {
"statusCode": 401,
"headers": {
"www-authenticate": "Bearer error=\"Invalid token\"",
"content-type": "application/json; charset=utf-8",
"vary": "origin",
"access-control-allow-origin": "http://localhost:8080",
"access-control-expose-headers": "WWW-Authenticate,Server-Authorization",
"strict-transport-security": "max-age=15768000",
"x-frame-options": "DENY",
"x-xss-protection": "1; mode=block",
"x-download-options": "noopen",
"x-content-type-options": "nosniff",
"cache-control": "no-cache",
"content-length": 106
}
}
responseTime: 3
響應包括"www-authenticate": "Bearer error=\"Invalid token\""
。 我們一直在嘗試理解為什么會出現Invalid Token
錯誤但沒有取得多大成功。
有人會知道何時以及為什么會拋出此錯誤以及如何克服它嗎?
問題是我們沒有正確定義https://portal.azure.20B4C5036ADCC4B6A7110B50D807BADE5Z上的 API 的范圍。 在我們修復后,我們使用新創建的 scope 創建了 API 權限,因此訪問令牌被成功解碼
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.