您好我正在尝试将 Azure 用作 HDP 集群中 Apache Knox 的 OIDC。
我的环境：
- Hortonworks Cloudbreak 2.9.1
- HDP 3.1.4.0-315
- 安巴里 2.7.4.0
- 阿帕奇诺克斯 1.0.0
- 天蓝色
这是我的knoxsso.xml拓扑：
<topology>
<gateway>
<provider>
<role>federation</role>
<name>pac4j</name>
<enabled>true</enabled>
<param>
<name>pac4j.callbackUrl</name>
<value>https://<master_node_external_ip>:8443/clustername/knoxsso/api/v1/websso</value>
</param>
<param>
<name>clientName</name>
<value>OidcClient</value>
</param>
<param>
<name>oidc.id</name>
<value><application_id from Azure AD></value>
</param>
<param>
<name>oidc.secret</name>
<value><secret from Azure AD></value>
</param>
<param>
<name>oidc.discoveryUri</name>
<value>https://login.microsoftonline.com/<tenant_id from Azure>/.well-known/openid-configuration</value>
</param>
</provider>
</gateway>
<service>
<role>KNOXSSO</role>
<param>
<name>knoxsso.cookie.secure.only</name>
<value>false</value>
</param>
<param>
<name>knoxsso.token.ttl</name>
<value>100000</value>
</param>
<param>
<name>knoxsso.redirect.whitelist.regex</name>
<value>^https?:\/\/(<master_external_ip>|127\.0\.0\.1|0:0:0:0:0:0:0:1|::1):[0-9].*$</value>
</param>
</service>
</topology>
这是我的集群拓扑（default.xml）：
<?xml version="1.0" encoding="UTF-8"?>
<topology>
<gateway>
<provider>
<role>webappsec</role>
<name>WebAppSec</name>
<enabled>true</enabled>
<param>
<name>cors.enabled</name>
<value>true</value>
</param>
</provider>
<provider>
<role>federation</role>
<name>SSOCookieProvider</name>
<enabled>true</enabled>
<param>
<name>sso.authentication.provider.url</name>
<value>https://<master_node_external_ip>:8443/clustername/knoxsso/api/v1/websso</value>
</param>
</provider>
<provider>
<role>identity-assertion</role>
<name>Default</name>
<enabled>true</enabled>
</provider>
</gateway>
<service>
<role>WEBHDFS</role>
<url>http://<webhdfs_private_fqdn>:50070/webhdfs</url>
</service>
...
</topology>
添加到 Azure -> AAD -> 应用程序 -> 身份验证 -> 重定向 URI：
https://<master_node_external_ip>:8443/clustername/knoxsso/api/v1/websso
所以我试图在浏览器中打开
https://<master_node_external_ip>:8443/clustername/default/webhdfs/v1/?op=LISTSTATUS
它将我重定向到https://login.microsoftonline.com/ ...并要求输入用户名和密码，这是我所期望的。但是登录成功后，我得到一个错误：
AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application: '<app_id>'.
部分登录 url 包含重定向 url：
redirect_uri=https://<master_node_extenal_ip>:8443/clustername/knoxsso/api/v1/websso?pac4jCallback=true&client_name=OidcClient&scope=openid+profile+email&state=<some_random_string>
我究竟做错了什么？