cdbattags / lua-resty-jwt

JWT For The Great Openresty
Apache License 2.0
146 stars 44 forks source link

NGINX errors since loading 0.2.1 and 0.2.2 running Luarocks 3.3.1 #29

Closed ncpe20012003 closed 3 years ago

ncpe20012003 commented 4 years ago

Still running Lua 5.1, following error with calling "access by lua"

root@nginx-0:/luarocks-3.3.1# tail -f /var/log/nginx/error.log no file '/usr/lib/x86_64-linux-gnu/lua/5.1/resty/openidc.so' no file '/usr/local/lib/lua/5.1/loadall.so' no file './resty.so' no file '/usr/local/lib/lua/5.1/resty.so' no file '/usr/lib/x86_64-linux-gnu/lua/5.1/resty.so' no file '/usr/local/lib/lua/5.1/loadall.so' stack traceback: coroutine 0: [C]: in function 'require' access_by_lua(nginx.conf:291):2: in function <access_by_lua(nginx.conf:291):1>, client: 172.31.2.196, server: localhost, request: "GET /app-mqtt HTTP/1.1", host: "app-sdbx.de-iot.io" Was working fine on 0.2.0.

cdbattags commented 4 years ago

Can you please copypasta everything in the access_by_lua block?

cdbattags commented 4 years ago

This gives me zero context because I have no idea what line, function, etc you were invoking

ncpe20012003 commented 4 years ago

In the nginx.conf files:

    #lua settings
    lua_package_path '~/lua/?.lua;;';
    resolver 8.8.8.8;
    lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
    lua_ssl_verify_depth 5;
    # cache for JWT verification results
    lua_shared_dict introspection 10m;
    # cache for discovery metadata documents
    lua_shared_dict discovery 10m;
    # cache for JWKs
    lua_shared_dict jwks 10m;

Path for APP-MQTT

    location /app-mqtt {
            access_by_lua '
                    local openidc = require("resty.openidc")
                    openidc.set_logging(nil, { DEBUG = ngx.INFO })
                    local opts = {public_key = [[

USERS_PUBLIC_KEY_PRIMARY]], public_key = [[ USERS_PUBLIC_KEY_SECONDARY ]]} local res, err = require("resty.openidc").bearer_jwt_verify(opts) if err or not res then ngx.status = 403 ngx.say(err and err or "no access_token provided") ngx.exit(ngx.HTTP_FORBIDDEN) end'; rewrite ^/app-mqtt/?(.*) /mqtt break;
proxy_pass https://vernemq.default.svc.cluster.local:8080; proxy_ssl_trusted_certificate /data/ssl/vernemqca.pem; proxy_ssl_verify on; proxy_ssl_verify_depth 2; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; }

cdbattags commented 4 years ago

Looks like this is the perfect chance for some test-driven development. Feel free to add a test with your specific use-case. Otherwise, it might take me a couple weeks to make time to dig in for a fix that would otherwise take a few minutes with the right context. Always open to a PR though! Feel free to look at the diff between 0.2.1 and 0.2.0 and notice the new init flow for the different algos.

cdbattags commented 3 years ago

Were you able to get this figured out?