4

我有一个错误，我似乎无法理解为什么会这样。

我有一个在 docker 网络中运行的微服务架构。我正在尝试使用框架 Identityserver4 设置身份服务器。

有一个代理转发到 Ocelot 网关。客户端是一个角度应用程序。

登录和注销并检索访问令牌和身份令牌是成功的，但是当我尝试在 Ocelot 中设置身份验证时，我收到以下错误。

DX20803: Unable to obtain configuration from: 'http://identityservice:5010/.well- 
known/openid-configuration'.
gateway_1               | System.InvalidOperationException: IDX20803: Unable to obtain 
configuration from: 'http://identityservice:5010/.well-known/openid-configuration'.
gateway_1               |  ---> System.IO.IOException: IDX20804: Unable to retrieve document 
from: 'http://localhost/auth/.well-known/openid-configuration/jwks'.
gateway_1               |  ---> System.Net.Http.HttpRequestException: Cannot assign 
requested address

docker-compose就是这样设置的

version: '3.0'

services: 
pricecalendarservice:
    build: 
        context: ./PriceCalendarService
    environment: 
        - ASPNETCORE_URLS=http://+:5002
        - RedisConnection=redis
gateway:
    build: 
        context: ./Gateway/
    environment: 
        - ASPNETCORE_URLS=http://+:5000
        - ID_URL=http://identityservice
frontend:
    build:
        context: ./SPA
        dockerfile: staging.dockerfile
itemmanagerservice: 
    build:
        ./ItemManagerService
    environment: 
        - ASPNETCORE_URLS=http://+:5003
        - IdentityUrl=http://identityservice
identityservice:
    build:
        context: ./IdentityServer/IdentityServer
    environment: 
        - DEV_URL=http://localhost
        - ASPNETCORE_ENVIRONMENT=Developmnet
        - ASPNETCORE_URLS=http://+:5010
        - IDENTITY_ISSUER=http://localhost/auth
        - RedisConnection=redis
    ports: 
        - 5010:5010
proxy:
    build:
        context: ./proxy
    ports: 
        - 80:80
redis:
    image: redis
    ports: 
        - 6379:6379

Identityserver的配置方式如下

   string redisConnectionString = Environment.GetEnvironmentVariable("RedisConnection", 
      EnvironmentVariableTarget.Process);
        string prodEnv = Environment.GetEnvironmentVariable("PROD_URL");
        string devEnv = Environment.GetEnvironmentVariable("DEV_URL");
        string env = Environment.GetEnvironmentVariable("ASPNETCORE_URLS");
        string issuer = Environment.GetEnvironmentVariable("IDENTITY_ISSUER");

        var redis = ConnectionMultiplexer.Connect( redisConnectionString + ":6379");
        services.AddDataProtection()
            .PersistKeysToStackExchangeRedis( redis , "DataProtection-Keys")
            .SetApplicationName("product");
        services.AddCors(o => o.AddPolicy("MyPolicy", builder =>
        {
            builder
                .WithOrigins("https:localhost:4200")
                .AllowAnyMethod()
                .AllowAnyHeader();
        }));


        services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is 
      needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });

        var config = new Config();

        config.setEnvironemnt(devEnv);


        services.AddIdentityServer(options => {
                options.PublicOrigin = issuer;
            })

            .AddDeveloperSigningCredential()
            .AddInMemoryIdentityResources(config.GetIdentityResources())
            .AddInMemoryApiResources(config.GetApis())
            .AddInMemoryClients(config.GetClients())
            .AddTestUsers(config.GetUsers());

注意。发行者设置为“ http://localhost/auth ”

Nginx 代理服务器使用以下设置进行设置

server {
    listen 80;


    location / {
        proxy_pass       http://frontend;
        proxy_redirect   off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;
    }
        location /api/hub {
        proxy_pass       http://gateway:5000;
        proxy_redirect   off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /api {
        proxy_pass       http://gateway:5000;
        proxy_redirect   off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;
        proxy_set_header Upgrade $http_upgrade;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header Connection "upgrade";
    }


    location /auth {
        proxy_pass       http://gateway:5000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection keep-alive;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }

   }

网关配置如Ocelot Documentation中的文档所述

var authenticationProviderKey = "TestKey";

                s.AddAuthentication()
                .AddIdentityServerAuthentication(authenticationProviderKey, x =>
                    {
                        x.Authority = "http://identityservice:5010";
                        x.RequireHttpsMetadata=false;

                    });
                /*
                options.TokenValidationParameters = new 
   Microsoft.IdentityModel.Tokens.TokenValidationParameters()
                {
                    ValidAudiences = new[] {"item"}
                };
                */

               s.AddOcelot();
               s.AddSwaggerGen(swagger =>
        {
            swagger.SwaggerDoc("v1", new OpenApiInfo { Title = "PriceCalendarService" });
        });

似乎在 docker 网络中运行的网关无法访问身份服务器。但是我已经尝试了角度调用的 URL，即

"http://localhost/auth"

还有以多种方式在 docker 中运行的服务的名称。

"http://identityservice:5010" 
"http://identityservice"

但不知何故，网关无法访问身份服务器以加载发现文档。

任何人都可以指出我如何做到这一点的任何方向。

4

0 回答 0