集成IDM(Docker)和pep-proxy时令牌验证报错问题咨询

Hey there, let's unpack what's going on here and walk through how to address this issue.

First, let's clarify the core context: your PEP proxy successfully authenticates with the IDM (Keystone) on startup (you got that valid Proxy Auth-token), so the basic service-to-service trust between PEP and IDM is working. The error you see when using an invalid user token is actually a bit misleading—let's break down the possibilities:

1. This might just be a misleading log message (normal behavior) #

The error Proxy not authorized in keystone makes it sound like the PEP itself lost its authorization, but that's not the case here. When you send an invalid user token, the PEP uses its own valid proxy token to call Keystone's token validation endpoint. Keystone responds with a 401 because the user's token is invalid, and the PEP's logging wraps this response in a confusing message.

Test this first: Send a request with a valid user token. If it works as expected, then this error is just a poorly worded log for invalid user tokens—you can either ignore it or customize the PEP's logging logic to make the message clearer.

2. If valid user tokens also fail: Check PEP's permissions in IDM #

If even valid user tokens trigger this error, the PEP's service account might lack the necessary permissions to validate user tokens in Keystone. Here's what to do:

• Log into your IDM's admin interface.
• Locate the service account your PEP uses (the one configured in config.js with idm.username/idm.password or idm.client_id/idm.client_secret).
• Ensure this account has a role with permissions to validate tokens—typically an admin role, or a custom role with token:validate/trust:manage permissions (depending on your IDM version).

3. Resolve API version compatibility issues #

Since you're using the latest Dockerized IDM, it's likely running Keystone v3 API, but your PEP proxy (from the Git sample) might be configured for the older v2 API. Check your PEP's config.js file:

• Verify idm.url points to the v3 endpoint, e.g., http://your-idm-container-ip:5000/v3
• Set idm.version: 'v3' explicitly
• If using v3, add the idm.domain parameter (usually default unless you've customized domains)

4. Enable debug logging to get precise details #

Turn on debug-level logging in your PEP to see exactly what's happening during token validation. In config.js, set:

logLevel: 'debug'

This will show you the full request the PEP sends to Keystone, the response status code, and the exact error message from Keystone. For example, you might see:

DEBUG: IDM-Client - Token validation request sent to: http://idm:5000/v3/auth/tokens
DEBUG: IDM-Client - Response status: 401
DEBUG: IDM-Client - Response body: {"error": {"message": "Invalid token", "code": 401}}

This will confirm whether the issue is with the user's token, the PEP's permissions, or API mismatches.

内容的提问来源于stack exchange，提问作者Igor