Keycloak - 通过 /realms/{realm}/protocol/openid-connect/userinfo 获取用户信息时出现 401 响应 (USER_INFO_REQUEST_ERROR)

我使用以下 Docker 命令在本地部署了 Keycloak：

docker run -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=管理员 quay.io/keycloak/keycloak:20.0.1 启动开发

我从 Keycloak 那里得到了一个令牌。例子：

eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJMZjRfWHJjWkpTaVJYWlFLS254VS1NdU9FTHA4d3NaaHlLMDQ0UjRIRjdnIn0.eyJleHAiOjE2NZAwODc1MDgsSimlhdCI6MTY3MDA4Nz IwOCwiYXV0aF90aW1lIjoxNjcwMDg2NDcwLCJqdGkiOiIyYWQxODQ5ZC0xMjI0LTQ4YjYtYWZjYy01ZmFjMWZjODY3ZjQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvcmVhbG1z L2RpYWxvZy1mZWF0IiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjRkYjdiNjg1LTRkyTAtNGZjMy1iNjiI1LTgyZmM1MTdjNjA3NiIsInR5cCI6IkJlYXJlciIsImF6cCI6InNvbWV4NSISIm5vbmN lIjoiR0tNb1JWRTVDajZSVjJMcFQ1Mjg5eVQ3RUdWeFMzZk4iLCJzZXNzaW9uX3N0YXRlIjoiMTY4Y2JmZGQtMmFmYS00Mjk5LWI4YmUTMmExM2FjMjI2NzJiIiwiYWNyIjoiMCIsInJly WxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIiwiZGVmYXVsdC1yb2xlcy1kaWFsb2ctZmVhdCJdfSwicmVzb3VyY2VfYWNjZXNzI jp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctchHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJza WQiOiIxNjhjYmZkZC0yYWZhLTQyOTktYjhiZS0yYTEzYWMyMjY3MmIiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwibmFtZSI6IkpvaG4gU25vdyIsInByZWZlcnJlZF91c2VybmFtZSI6Impva G4uc25vdyIsImdpdmVuX25hbWUiOiJKb2huIiwiZmFtaWx5X25hbWUiOiJTbm93IiwiZW1haWwiOiJqb2huLnNub3dAeDUucnUifQ.j_rFqVxICtj7NR-myEsWhSkwBeCABplFrmlBuRMAhF4N8Hz doOtExdmw_mXdx60snKTaE5GJHPofjllpM353lY8H9NGxaczUgL20GjVmMhwtihGGBLpiw7TXyGQGkfdBXdweCuS0W1avegXrhRYvCYlFGJMoxsdmskYkDt4DjuESlTkMEOndVjv5LBp3rLB6lRopq0Q g3Abp_rv57KvlVeeul24OKoisFohnZ4VfsiDPAuVW1u1xaYmjCRDlBwIcGosdwasL_WNAgvJkaKdVtvu7NU-ghPa1vQkWJkMZrVIZDsCc5LKZqwspw3U2iOcUc5EDC6FumBWdfvWCx8cszw

其有效负载：

{
  "exp": 1670087508,
  "iat": 1670087208,
  "auth_time": 1670086470,
  "jti": "2ad1849d-1224-48b6-afcc-5fac1fc867f4",
  "iss": "http://localhost:8080/realms/dialog-feat",
  "aud": "account",
  "sub": "4db7b685-4da0-4fc3-b625-82fc517c6076",
  "typ": "Bearer",
  "azp": "somex5",
  "nonce": "GKMoRVE5Cj6RV2LpT5289yT7EGVxS3fN",
  "session_state": "168cbfdd-2afa-4299-b8be-2a13ac22672b",
  "acr": "0",
  "realm_access": {
    "roles": [
      "offline_access",
      "uma_authorization",
      "default-roles-dialog-feat"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "openid profile email",
  "sid": "168cbfdd-2afa-4299-b8be-2a13ac22672b",
  "email_verified": true,
  "name": "John Snow",
  "preferred_username": "john.snow",
  "given_name": "John",
  "family_name": "Snow",
  "email": "[email protected] /cdn-cgi/l/email-protection"
}

这似乎是有效的。然后我请求http://127.0.0.1:8080/realms/dialog-feat/protocol/openid-connect/userinfo使用令牌：

卷曲--位置--请求 GET 'http://127.0.0.1:8080/realms/dialog-feat/protocol/openid-connect/userinfo'
--header '授权：承载 eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJMZjRfWHJjWkpTaVJYWlFLS254VS1NdU9FTHA4d3NaaHlLMDQ0UjRIRjdnIn0.eyJleHAiOjE2NzAwODc1MDgsImlh dCI6MTY3MDA4NzIwOCwiYXV0aF90aW1lIjoxNjcwMDg2NDcwLCJqdGkiOiIyYWQxODQ5ZC0xMjI0LTQ4YjYtYWZjYy01ZmFjMWZjODY3ZjQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0Ojg WODAvcmVhbG1zL2RpYWxvZy1mZWF0IiwiYXVkIjoiYWNjb3VudCISInN1YiI6IjRkYjdiNjg1LTRkyTAtNGZjMy1iNjiI1LTgyZmM1MTdjNjA3NiIsInR5cCI6IkJlyXJlciIsImF6cCI6InNvbW V4NSIsIm5vbmNlIjoiR0tNb1JWRTVDajZSVjJMcFQ1Mjg5eVQ3RUdWeFMzZk4iLCJzZXNzaW9uX3N0YXRlIjoiMTY4Y2JmZGQtMmFmYS00Mjk5LWI4YmUTMmExM2FjMjI2NzJiIiwiYW NyIjoiMCIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIiwiZGVmYXVsdC1yb2xlcy1kaWFsb2ctZmVhdCJdfSwicmVzb3VyY2 VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2Zpb GUgZW1haWwiLCJzaWQiOiIxNjhjYmZkZC0yYWZhLTQyOTktYjhiZS0yYTEzYWMyMjY3MmIiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwibmFtZSI6IkpvaG4gU25vdyIsInByZWZlcnJlZF91c2V ybmFtZSI6ImpvaG4uc25vdyIsImdpdmVuX25hbWUiOiJKb2huIiwiZmFtaWx5X25hbWUiOiJTbm93IiwiZW1haWwiOiJqb2huLnNub3dAeDUucnUifQ.j_rFqVxICtj7NR-myEsWhSkwBeCABpl FrmlBuRMAhF4N8HzdOOtExdmw_mXdx60snKTaE5GJHPofjllpM353lY8H9NGxaczUgL20GjVmMhwtihGGBLpiw7TXyGQGkfdBXdweCuS0W1avegXrhRYvCYlFGJMoxsdmskYkDt4DjuESlTkMEOndVjv5LB p3rLB6lRopq0Qg3Abp_rv57KvlVeeul24OKoisFohnZ4VfsiDPAuVW1u1xaYmjCRDlBwIcGosdwasL_WNAgvJkaKdVtvu7NU-ghPa1vQkWJkMZrVIZDsCc5LKZqwspw3U2iOcUc5EDC6FumBWdf vWCx8cszw'

但我收到返回的 401 状态代码。例如：

type=USER_INFO_REQUEST_ERROR, realmId=(...), clientId=null, userId=null, ipAddress=(...), error=access_denied, auth_method=validate_access_token

如何解决这个问题？

我的钥匙斗篷设置：

问题似乎是发送到 userinfo 端点的访问令牌的颁发者之间不匹配（i.e.,"iss": "http://localhost:8080/realms/dialog-feat") 以及 userinfo 端点触发的访问令牌验证器所期望的颁发者。

代替：

然后我请求http://127.0.0.1:8080/realms/dialog-feat/protocol/openid-connect/userinfo http://127.0.0.1:8080/realms/dialog-feat/protocol/openid-connect/userinfo使用令牌 (...)：

在 userinfo 端点中使用与您用于获取访问令牌的主机名相同的主机名，例如：

curl http://localhost:8080/realms/dialog-feat/protocol/openid-connect/userinfo -H "Authorization: Bearer (..<your access token..)"

如果问题仍然存在，那么您还面临与中描述的 Keycloak 端点实现相关的问题UserInfo 端点不完全符合标准 https://github.com/keycloak/keycloak/pull/14237.

简而言之，在您对访问令牌的请求中显式添加参数scope=openid。一个例子：

curl --request POST \
        --url "http://localhost:8080/realms/dialog-feat/protocol/openid-connect/token" \
        --data client_id=somex5 \
        --data username=john.snow \
        --data password=...<the password..> \
        --data grant_type=password \
        --data scope=openid