Spring Boot 3.1集成AWS Cognito遇证书路径错误求助

问题背景 #

使用Spring Boot 3.1与AWS Cognito搭建POC，目标是访问http://localhost:8080时自动跳转至Cognito登录页面，但应用启动时出现证书路径验证失败异常。

application.yml 配置 #

spring:
  security:
    oauth2:
      client:
        registration:
          cognito:
            client-id: kjdsaksdkjahdjkahdkjdaskke
            client-secret: b8ilfhsfdklsdfsflshflkdshflsdhfsldfhsldfhflkhsdbfeu
        provider:
          cognito:
            issuer-uri: https://cognito-idp.ap-south-1.amazonaws.com/ap-south-1_abcdefgh

应用启动类 #

@SpringBootApplication
@EnableWebSecurity
public class CongnitoDemoApplication {

    public static void main(String[] args) {
        SpringApplication.run(CongnitoDemoApplication.class, args);
    }

}

pom.xml 配置 #

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.1.3</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.congnito.demo</groupId>
    <artifactId>com-congnito-demo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>congnito demo</name>
    <description>Demo project for Spring Boot and cognito</description>
    <properties>
        <java.version>17</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-client</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-oauth2-jose</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <image>
                        <builder>paketobuildpacks/builder-jammy-base:latest</builder>
                    </image>
                    <excludes>
                        <exclude>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                        </exclude>
                    </excludes>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

运行异常 #

"C:\Program Files\Java\jdk-17.0.9+8\bin\java.exe" -javaagent:C:\ideaIC-

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::                (v3.1.3)

2024-01-14T14:23:39.711+05:30  INFO 15032 --- [           main] 
..
..
Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://cognito-idp.ap-south-1.amazonaws.com/ap-south-1_abcdefgh/.well-known/openid-configuration": PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
....
....
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148) ~[na:na]
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129) ~[na:na]
    at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297) ~[na:na]
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434) ~[na:na]
    ... 164 common frames omitted


Process finished with exit code 1

已尝试的解决方法（未成功） #

• 导出第三方网站（如example.com、whitesourcesoftware.com）证书并导入，步骤：
  1. F12打开开发者工具
  2. 切换到「Security」标签页
  3. 点击「View certificate」
  4. 证书详情窗口切换到「Details」标签页
  5. 点击「Export」
  6. 选择格式为「Base64-encoded ASCII, single certificate (*.pem, *.crt)」
  7. 保存为Windows系统格式的.crt文件
• 将issuer-uri替换为https://cognito-idp.ap-south-1.amazonaws.com，问题依旧

解决建议 #

1. 正确导入AWS Cognito根证书

之前导入的是第三方网站证书，需导入Cognito域名对应的根证书：

• 访问https://cognito-idp.ap-south-1.amazonaws.com/ap-south-1_abcdefgh/.well-known/openid-configuration，用浏览器导出其根证书（非服务器证书）
• 使用keytool命令将证书导入JDK信任库：

  keytool -importcert -file cognito-root.crt -alias cognito-root -keystore <你的JDK路径>/jre/lib/security/cacerts
  

默认信任库密码为changeit，执行后确认导入。

2. 检查网络代理配置

若网络通过代理访问外部服务，需为Spring Boot应用配置代理：

• 在启动参数中添加代理参数：

  -Dhttp.proxyHost=你的代理地址 -Dhttp.proxyPort=代理端口 -Dhttps.proxyHost=你的代理地址 -Dhttps.proxyPort=代理端口
  

3. 完善Security认证规则

当前启动类仅添加@EnableWebSecurity，需显式配置OAuth2客户端规则，确保所有请求需认证：

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .loginPage("/oauth2/authorization/cognito")
            );
        return http.build();
    }
}

替换原启动类中的@EnableWebSecurity，或单独创建该配置类。

4. 验证Issuer URI有效性

AWS Cognito的Issuer URI格式为https://cognito-idp.<region>.amazonaws.com/<user-pool-id>，你的配置格式正确，可直接访问该URI拼接/.well-known/openid-configuration确认是否能正常返回JSON内容。

内容的提问来源于stack exchange，提问作者madhepurian