如何在Dataverse中启用OpenID Connect？配置异常排查

问题背景 #

开发了一个OpenID Connect Provider，计划配置Dataverse通过该Provider完成身份认证。已在Dataverse的/usr/local/payara6/glassfish/domains/domain1/config/domain.xml中添加以下JVM参数：

<jvm-options>-Ddataverse.auth.oidc.enabled=true</jvm-options>
<jvm-options>-Ddataverse.auth.oidc.client-id=some_id</jvm-options>
<jvm-options>-Ddataverse.auth.oidc.client-secret=some_secret</jvm-options>
<jvm-options>-Ddataverse.auth.oidc.auth-server-url=https://my.oidc.com/api/auth/.well-known/openid-configuration</jvm-options>
<jvm-options>-Ddataverse.auth.oidc.title=OpenID Title</jvm-options>
<jvm-options>-Ddataverse.auth.oidc.subtitle=OpenID SubTitle</jvm-options>

执行重启命令：

/usr/local/payara6/bin/asadmin restart-domain domain1

重启后登录页未显示OpenID Connect按钮，仅显示常规登录按钮。查看/usr/local/payara6/glassfish/domains/domain1/logs/server.log日志，发现核心错误：

[2024-03-07T10:59:39.449+0000] [Payara 6.2023.8] [SEVERE] [] [edu.harvard.iq.dataverse.authorization.AuthenticationProvidersRegistrationServiceBean] [...]
Exception setting up an OIDC auth provider via MicroProfile Config
edu.harvard.iq.dataverse.authorization.exceptions.AuthorizationSetupException: OIDC provider metadata at https://my.oidc.com/api/auth/.well-known/openid-configuration/ not parsable.
at edu.harvard.iq.dataverse.authorization.providers.oauth2.oidc.OIDCAuthProvider.getMetadata(OIDCAuthProvider.java:129)
...

自定义OIDC Provider的元数据输出如下：

{
  "issuer": "https://my.oidc.com/api/auth",
  "authorization_endpoint": "https://my.oidc.com/api/auth/authorize",
  "token_endpoint": "https://my.oidc.com/api/auth/oauth-access-token",
  "userinfo_endpoint": "https://my.oidc.com/api/auth/oauth-user-profile",
  "jwks_uri": "https://my.oidc.com/api/auth/.well-known/jwks.json",
  "response_types_supported": ["code", "token", "id_token", "code id_token"],
  "subject_types_supported": ["public", "pairwise"],
  "id_token_signing_alg_values_supported": ["RS256", "ES256", "HS256"]
}

排查结论 #

1. 元数据URL处理异常 #

日志显示Dataverse尝试访问的URL末尾带有斜杠（https://my.oidc.com/api/auth/.well-known/openid-configuration/），但配置的URL无末尾斜杠。部分OIDC Provider对URL末尾斜杠敏感，会返回301重定向而非直接返回元数据，导致Dataverse无法正确解析响应内容。

2. 缺少必填元数据字段 #

Dataverse的OIDC集成逻辑要求元数据必须包含end_session_endpoint（登出端点）字段，当前自定义Provider的元数据未提供该字段，这是解析失败的关键原因。

修复步骤 #

• 修正JVM参数中的auth-server-url，确保末尾无斜杠：

  <jvm-options>-Ddataverse.auth.oidc.auth-server-url=https://my.oidc.com/api/auth/.well-known/openid-configuration</jvm-options>
  

• 在自定义OIDC Provider的元数据中添加end_session_endpoint字段，示例：

  "end_session_endpoint": "https://my.oidc.com/api/auth/logout"
  

• 重启Payara服务：

  /usr/local/payara6/bin/asadmin restart-domain domain1
  

内容的提问来源于stack exchange，提问作者Mohsen