eShopOnContainer 中 unauthorized_client error 登录错误处理

在准备好 eShopOnContainer 环境，运行起来之后，不幸的是，我遇到了不能登录的错误。

从错误信息中，可以看到 unauthorized_client 的内容。这是为什么呢？

从 eShopOnContainers 的 Wiki 上，可以看到找到这篇文章：unauthorized_client error on Login

这里面介绍了导致该问题的几个原因。

其中的一个是不能使用 localhost 作为主机名来访问 eShop 站点，因为 eShop 在 Identity 服务器上注册的客户端使用了 docker 中的名称 host.docker.internal 。

那么，注册和访问的信息来自哪里呢？

在访问的时候，使用了来自 src/.env 文件中配置的环境变量信息， docker-compose 将会自动使用该文件来获得环境变量的配置信息。见 Environment variables in Compose

You can set default values for environment variables using a .env file,

which Compose automatically looks for in project directory (parent folder of your Compose file).

Values set in the shell environment override those set in the .env file.

该文件开始部分内容如下：

# Compose supports declaring default environment variables in an environment file named .env placed in the folder docker-compose command is executed from (current working directory).
# Compose expects each line in an env file to be in VAR=VAL format. Lines beginning with # (i.e. comments) are ignored, as are blank lines.
# Note: Values present in the environment at runtime will always override those defined inside the .env file. Similarly, values passed via command-line arguments take precedence as well.

# The IP below should be swapped to your real IP or DNS name, like 192.168.88.248, etc. if testing from remote browsers or mobile devices

# Use this values to run the app locally in Windows
ESHOP_EXTERNAL_DNS_NAME_OR_IP=host.docker.internal
ESHOP_STORAGE_CATALOG_URL=http://host.docker.internal:5202/c/api/v1/catalog/items/[0]/pic/

# Use this values to run the app locally in Mac
# ESHOP_EXTERNAL_DNS_NAME_OR_IP=docker.for.mac.localhost
# ESHOP_STORAGE_CATALOG_URL=http://docker.for.mac.localhost:5202/c/api/v1/catalog/items/[0]/pic/

# Use this values to run the app locally in Linux
# ESHOP_EXTERNAL_DNS_NAME_OR_IP=docker.for.linux.localhost
# ESHOP_STORAGE_CATALOG_URL=http://docker.for.linux.localhost:5202/c/api/v1/catalog/items/[0]/pic/

可以看到在 Windows 环境下，访问地址将会使用 host.docker.internal，而在 mac OS 下，则应该使用 docker.for.mac.localhost

在 eShop MVC 项目的配置文件 eShopOnContainers/src/Web/WebMVC/appsettings.json 中，可以看到使用的默认地址

{
  "CatalogUrl": "http://localhost:5101",
  "OrderingUrl": "http://localhost:5102",
  "BasketUrl": "http://localhost:5103",
  "IdentityUrl": "http://localhost:5105",
  "CallBackUrl": "http://localhost:5100/",

在 .NET 中，它们可以被环境变量所覆盖。在 docker-compose 所使用的 docker-compose.override.yml 文件，它们被容器定义的环境变量所覆盖。

  webmvc:
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ASPNETCORE_URLS=http://0.0.0.0:80
      - PurchaseUrl=http://webshoppingapigw
      - IdentityUrl=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5105
      - SignalrHubUrl=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5202
      - IdentityUrlHC=http://identity-api/hc
      - UseCustomizationData=True
      - ApplicationInsights__InstrumentationKey=${INSTRUMENTATION_KEY}
      - OrchestratorType=${ORCHESTRATOR_TYPE}
      - UseLoadTest=${USE_LOADTEST:-False}
    ports:
      - "5100:80"

在 Identity 中定义的时候，

在 eShopOnContainers/src/Services/Identity/Identity.API/Configuration/Config.cs 中，预先定义来客户端的配置信息。以 MVC 项目为例：

new Client
{
    ClientId = "mvc",
    ClientName = "MVC Client",
    ClientSecrets = new List<Secret>
    {

        new Secret("secret".Sha256())
    },
    ClientUri = $"{clientsUrl["Mvc"]}",                             // public uri of the client
    AllowedGrantTypes = GrantTypes.Hybrid,
    AllowAccessTokensViaBrowser = false,
    RequireConsent = false,
    AllowOfflineAccess = true,
    AlwaysIncludeUserClaimsInIdToken = true,
    RedirectUris = new List<string>
    {
        $"{clientsUrl["Mvc"]}/signin-oidc"
    },
    PostLogoutRedirectUris = new List<string>
    {
        $"{clientsUrl["Mvc"]}/signout-callback-oidc"
    },
    AllowedScopes = new List<string>
    {
        IdentityServerConstants.StandardScopes.OpenId,
        IdentityServerConstants.StandardScopes.Profile,
        IdentityServerConstants.StandardScopes.OfflineAccess,
        "orders",
        "basket",
        "webshoppingagg",
        "orders.signalrhub",
        "webhooks"
    },
    AccessTokenLifetime = 60*60*2, // 2 hours
    IdentityTokenLifetime= 60*60*2 // 2 hours
},

这个 clientsUrl 来自 src/Services/Identity/Identity.API/Data/ConfigurationDbContextSeed.cs 中，这些信息来自配置文件。

public async Task SeedAsync(ConfigurationDbContext context, IConfiguration configuration)
{

    //callbacks urls from config:
    var clientUrls = new Dictionary<string, string>();

    clientUrls.Add("Mvc", configuration.GetValue<string>("MvcClient"));
    clientUrls.Add("Spa", configuration.GetValue<string>("SpaClient"));
    clientUrls.Add("Xamarin", configuration.GetValue<string>("XamarinCallback"));
    clientUrls.Add("BasketApi", configuration.GetValue<string>("BasketApiClient"));
    clientUrls.Add("OrderingApi", configuration.GetValue<string>("OrderingApiClient"));
    clientUrls.Add("MobileShoppingAgg", configuration.GetValue<string>("MobileShoppingAggClient"));
    clientUrls.Add("WebShoppingAgg", configuration.GetValue<string>("WebShoppingAggClient"));
    clientUrls.Add("WebhooksApi", configuration.GetValue<string>("WebhooksApiClient"));
    clientUrls.Add("WebhooksWeb", configuration.GetValue<string>("WebhooksWebClient"));

而它们又会被 docker-compose 所配置的环境变量所覆盖掉。见 docker-compose.override.yml 文件中，针对 Identity-API 的配置：

  identity-api:
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ASPNETCORE_URLS=http://0.0.0.0:80
      - SpaClient=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5104
      - XamarinCallback=http://${ESHOP_PROD_EXTERNAL_DNS_NAME_OR_IP}:5105/xamarincallback
      - ConnectionString=${ESHOP_AZURE_IDENTITY_DB:-Server=sqldata;Database=Microsoft.eShopOnContainers.Service.IdentityDb;User Id=sa;Password=Pass@word}
      - MvcClient=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5100
      - BasketApiClient=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5103
      - OrderingApiClient=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5102
      - MobileShoppingAggClient=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5120
      - WebShoppingAggClient=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5121
      - WebhooksApiClient=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5113
      - WebhooksWebClient=http://${ESHOP_EXTERNAL_DNS_NAME_OR_IP}:5114
      - UseCustomizationData=True
      - ApplicationInsights__InstrumentationKey=${INSTRUMENTATION_KEY}
      - OrchestratorType=${ORCHESTRATOR_TYPE}
    ports:
      - "5105:80"

所以，一定要使用正确的地址访问网站，才能成功登录，直接使用 localhost 虽然可以看到首页，在登录的时候，却会因为地址的问题而出现错误。

如果注册的地址出现问题，能不能修改一下呢？这些注册信息最终会保存到数据库中，在需要的情况下，直接修改数据库中的信息也是可以的。

甚至并不需要你安装特别的工具，在 SQLServer 的镜像中，已经提供了 sqlcmd 这个命令行工具。可以使用它来完成修改工作。

首先，我们可以连接到运行的容器中，然后使用 sqlcmd 登录到运行在此容器中的数据库，最后，就可以执行 SQL 命令了。

• 连接到容器的时候，指定运行的 bash
• 示例中 SQLServer 数据库的默认登录帐号是 sa/Pass@word，它可以在 docker-compose 定义中找到。
• 在 sqlcmd 中，输入一条 sql 命令之后，需要使用 go 来执行。

docker exec -it src_sqldata_1 "bash"

/opt/mssql-tools/bin/sqlcmd -S localhost -U SA -P Pass@word 

use [Microsoft.eShopOnContainers.Service.IdentityDb]
go

1> select id, left(redirectUri, 100), Clientid from dbo.ClientRedirectUris
2> go
id                                                                                                                   Clientid
----------- ---------------------------------------------------------------------------------------------------- -----------
          1 http://host.docker.internal:5104/                                                            1
          2 http://10.121.122.162:5105/xamarincallback                                             2
          3 http://host.docker.internal:5100/signin-oidc                                           3
          4 http://host.docker.internal:5114/signin-oidc                                            4
          5 http://host.docker.internal:5100/signin-oidc                                           5
          6 http://host.docker.internal:5103/swagger/oauth2-redirect.html                 6
          7 http://host.docker.internal:5102/swagger/oauth2-redirect.html                 7
          8 http://host.docker.internal:5120/swagger/oauth2-redirect.html                 8
          9 http://host.docker.internal:5121/swagger/oauth2-redirect.html                  9
         10 http://host.docker.internal:5113/swagger/oauth2-redirect.html                  10
(10 rows affected)

insert dbo.ClientRedirectUris ( redirectUri, ClientId) values ( 'http://docker.for.mac.localhost:5104/', 1)
(1 rows affected)

1> select id, left(redirectUri, 100), Clientid from dbo.ClientRedirectUris
2> go
id                                                                                                               Clientid
----------- ---------------------------------------------------------------------------------------------------- -----------
          1 http://host.docker.internal:5104/                                                                              1
          2 http://10.121.122.162:5105/xamarincallback                                                               2
          3 http://host.docker.internal:5100/signin-oidc                                                             3
          4 http://host.docker.internal:5114/signin-oidc                                                              4
          5 http://host.docker.internal:5100/signin-oidc                                                             5
          6 http://host.docker.internal:5103/swagger/oauth2-redirect.html                                   6
          7 http://host.docker.internal:5102/swagger/oauth2-redirect.html                                   7
          8 http://host.docker.internal:5120/swagger/oauth2-redirect.html                                   8
          9 http://host.docker.internal:5121/swagger/oauth2-redirect.html                                    9
         10 http://host.docker.internal:5113/swagger/oauth2-redirect.html                                  10
       1002 http://docker.for.mac.localhost:5104/                                                                    1

(11 rows affected)

> insert dbo.ClientRedirectUris ( redirectUri, ClientId) values ( 'http://docker.for.mac.localhost:5100/signin-oidc', 3)
> go
(1 rows affected)

1> select id, left(redirectUri, 100), Clientid from dbo.ClientRedirectUris
2> go
id                                                                                                               Clientid
----------- ---------------------------------------------------------------------------------------------------- -----------
          1 http://host.docker.internal:5104/                                                                              1
          2 http://10.121.122.162:5105/xamarincallback                                                                     2
          3 http://host.docker.internal:5100/signin-oidc                                                                   3
          4 http://host.docker.internal:5114/signin-oidc                                                                   4
          5 http://host.docker.internal:5100/signin-oidc                                                                   5
          6 http://host.docker.internal:5103/swagger/oauth2-redirect.html                                                  6
          7 http://host.docker.internal:5102/swagger/oauth2-redirect.html                                                  7
          8 http://host.docker.internal:5120/swagger/oauth2-redirect.html                                                  8
          9 http://host.docker.internal:5121/swagger/oauth2-redirect.html                                                  9
         10 http://host.docker.internal:5113/swagger/oauth2-redirect.html                                                 10
       1002 http://docker.for.mac.localhost:5104/                                                                          1
       1003 http://docker.for.mac.localhost:5100/signin-oidc                                                               3

(12 rows affected)

https://github.com/dotnet-architecture/eShopOnContainers/wiki/unauthorized_client-error-on-login