keycloak USER_INFO_REQUEST_ERROR 如果从另一个 docker 容器请求

Question

所以我有一些可以一起工作的容器。此设置旨在作为我们的微服务的本地开发环境。我使用 keycloak 进行身份验证。这个获取 user_info 的简单请求

curl -H "Authorization: Bearer TOKEN" http://localhost:8080/auth/realms/main/protocol/openid-connect/userinfo

如果请求是从我的机器“主机”到 keycloak 容器完成的，则可以工作，但如果我从任何 API 容器到 keyclaok 执行该请求，则它不起作用，我必须将 URL 中的主机从 localhost 更改为容器名称。从日志来看，我认为这是 CORS 的事情。

这些是 ok 调用“host->keycloak 容器”的日志

09:30:27,702 TRACE [org.keycloak.services.resources.Cors] (default task-1) No origin header ignoring
09:30:27,702 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper  commit
09:30:27,703 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper end
09:30:27,703 TRACE [org.keycloak.connections.jpa.DefaultJpaConnectionProvider] (default task-1) DefaultJpaConnectionProvider close()
09:30:28,129 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) new JtaTransactionWrapper
09:30:28,129 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) was existing? false
09:30:28,129 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) realm by name cache hit: main
09:30:28,129 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) by id cache hit: main
09:30:28,131 TRACE [org.keycloak.keys.DefaultKeyManager] (default task-1) Found key: realm=main kid=0C42WRjTe1IwYWqZIS_ITxm3tKFrTAbztybd6C9b7M0 algorithm=RS256 use=SIG
09:30:28,131 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by name cache hit: dashboard
09:30:28,131 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: dashboard
09:30:28,132 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) by id cache hit: main
09:30:28,132 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: dashboard
09:30:28,132 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) by id cache hit: main
09:30:28,132 DEBUG [org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider] (default task-1) getUserSessionWithPredicate(540e8e5e-9385-4fd8-924d-f85c752770b4): found in local cache
09:30:28,132 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,132 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: dashboard
09:30:28,132 TRACE [org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory] (default task-1) Create JpaConnectionProvider
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: dashboard
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,134 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 1a14f370-5db2-4b28-b5e7-a4bd5eb68d73
09:30:28,135 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers
09:30:28,136 TRACE [org.keycloak.events] (default task-1) type=USER_INFO_REQUEST, realmId=main, clientId=dashboard, userId=1a14f370-5db2-4b28-b5e7-a4bd5eb68d73, ipAddress=172.18.0.1, auth_method=validate_access_token, signature_required=false, username=salmanadmin, requestUri=http://localhost:8080/auth/realms/main/protocol/openid-connect/userinfo, cookies=[]

这些是针对失败的调用“api 容器 -> keycloak 容器”

09:27:23,898 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper  commit
09:27:23,898 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper end
09:27:25,335 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) new JtaTransactionWrapper
09:27:25,335 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) was existing? false
09:27:25,336 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) realm by name cache hit: main
09:27:25,336 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) by id cache hit: main
09:27:25,337 TRACE [org.keycloak.keys.DefaultKeyManager] (default task-1) Found key: realm=main kid=0C42WRjTe1IwYWqZIS_ITxm3tKFrTAbztybd6C9b7M0 algorithm=RS256 use=SIG
09:27:25,337 TRACE [org.keycloak.events] (default task-1) type=USER_INFO_REQUEST_ERROR, realmId=main, clientId=null, userId=null, ipAddress=172.18.0.9, error=invalid_token, auth_method=validate_access_token, requestUri=http://keycloak:8080/auth/realms/main/protocol/openid-connect/userinfo, cookies=[]

我的 docker-compose.yml 看起来像这样

version: "3"

services:
  db:
    ports:
      - "5439:5432"
    image: postgres
    volumes:
      - ./postgres/:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ****
      POSTGRES_DB: keycloak

  keycloak:
    build:
      context: ../at_keycloak
      dockerfile: Dockerfile
    environment:
      DB_VENDOR: POSTGRES
      DB_ADDR: db
      DB_DATABASE: keycloak
      DB_USER: postgres
      DB_SCHEMA: public
      DB_PASSWORD: ****
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: admin
      KEYCLOAK_LOGLEVEL: ALL
      # ROOT_LOGLEVEL: ALL
    ports:
      - 8080:8080
    depends_on:
      - db

  at_core_backend:
    restart: unless-stopped
    depends_on:
      - keycloak
      - db
    ports:
      - "3000:3000"
    environment:
      KEYCLOAK_SERVER_URL: http://keycloak:8080/auth/