higress icon indicating copy to clipboard operation
higress copied to clipboard

OIDC 插件的黑名单匹配规则支持 domain 非必填

Open Japson0 opened this issue 1 month ago • 15 comments

If you are reporting any crash or any potential security issue, do not open an issue in this repo. Please report the issue via ASRC(Alibaba Security Response Center) where the issue will be triaged appropriately.

  • [ ] I have searched the issues of this repository and believe that this is not a duplicate.

Ⅰ. Issue Description

我启用OIDC后,发现不起作用,打开插件日志后出现以下日志

2025-01-10T07:35:15.950839Z	warning	envoy wasm external/envoy/source/extensions/common/wasm/context.cc:1390	wasm log: [oidc] parse rule config failed: invalid configuration:
  missing setting: cookie-secret
  provider missing setting: client-id
  missing setting: client-secret or client-secret-file	thread=47
2025-01-10T07:35:15.950876Z	error	envoy wasm external/envoy/source/extensions/common/wasm/wasm.cc:151	Wasm VM failed Failed to configure base Wasm plugin	thread=47

这是我的OIDC插件配置

client_id: "aaa"
client_secret: "lxxabzH5qroDMVI5G0enMiGtaPw8oWRg"
match_list:
- match_rule_path: "/test"
  match_rule_type: "prefix"
match_type: "blacklist"
oidc_issuer_url: "http://127.0.0.1:8084/realms/master"
redirect_url: "http://foo.bar.com/oauth2/callback"
scope: "openid email offline_access"
service_name: "keycloak.static"
service_port: 80
service_host: http://127.0.0.1:8084/
  • Higress version: 2.0.5
  • OS : K8S
  • Others:

Japson0 avatar Jan 10 '25 08:01 Japson0