search

alibaba / higress

🤖 AI Gateway | AI Native API Gateway
https://higress.io
Apache License 2.0
3.57k stars 529 forks source link

外部认证插件失败 #1505

Open bianshuangwei opened 2 weeks ago

bianshuangwei commented 2 weeks ago

你好，我部署了Higress单机版，配置了Nacos2的服务，服务列表中配置的nacos的命名空间ID是默认的public，外部认证服务检测到的服务的名称是：ext-auth.DEFAULT-GROUP.public.nacos，服务列表中显示的命名空间是mcp，根据外部认证官方配置文档，我做了如下配置： http_service: endpoint_mode: envoy endpoint: service_name: ext-auth.public.svc.cluster.local service_port: 7689 path_prefix: /ext-auth/auth timeout: 1000 配置envoy模式，service name的尝试了ext-auth.DEFAULT-GROUP.public.nacos、ext-auth.public.svc.cluster.local 和ext-auth.mcp.svc.cluster.local，调用接口返回403forbidden 修改为forward_auth模式，service name做了同样的配置： http_service: endpoint: path: "/ext-auth/auth" request_method: "GET" service_name: "ext-auth.public.svc.cluster.local" service_port: 7689 endpoint_mode: "forward_auth" timeout: 1000 调用后端接口返回的也是403 forbidden，错误日志内容如下： gateway-1 | 2024-11-12T06:07:19.797821Z error envoy wasm external/envoy/source/extensions/common/wasm/context.cc:1393 wasm log higress-system.ext-auth-1.0.0: [ext-auth] failed to call ext auth server: error status returned by host: bad argument thread=29 gateway-1 | {"authority":"192.168.2.102:90","bytes_received":"0","bytes_sent":"0","downstream_local_address":"172.24.0.6:80","downstream_remote_address":"192.168.2.102:37558","duration":"1","istio_policy_status":"-","method":"GET","path":"/basic/higress","protocol":"HTTP/1.1","request_id":"0c71d6a3-98ce-4522-9a0a-dcecb927b6b7","requested_server_name":"-","response_code":"403","response_flags":"-","route_name":"-","start_time":"2024-11-12T06:07:19.796Z","trace_id":"-","upstream_cluster":"outbound|7788||higress-basic.DEFAULT-GROUP.public.nacos","upstream_host":"-","upstream_local_address":"-","upstream_service_time":"-","upstream_transport_failure_reason":"-","user_agent":"curl/7.29.0","x_forwarded_for":"192.168.2.102"} 请问这个是什么原因呢？

johnlanni commented 2 weeks ago

to call ext auth server: error status returned by host: bad argument thread=29

这个是服务发现不了，你的 service name 配置有错，控制台上看到的服务名称是什么？

bianshuangwei commented 2 weeks ago

to call ext auth server: error status returned by host: bad argument thread=29

这个是服务发现不了，你的 service name 配置有错，控制台上看到的服务名称是什么？

控制台上看到的服务名称是ext-auth.DEFAULT-GROUP.public.nacos，命名空间mcp

johnlanni commented 2 weeks ago

ext-auth.DEFAULT-GROUP.public.nacos 那service name 应该填这个，你改成这个报什么错呢？