OIDC의 지문을 얻으려는 동안 getservbyname 오류가 발생했습니다.

Question

내 OIDC IdP (내 경우 Google)에 대한 인증서를 얻으려는 중이므로 인증서 체인을 다운로드하고 싶습니다. I 설치 및 OpenSSL을 구성하고 다음 사용하여 IdP가의 구성 문서를 검색 한 :

{ 
"issuer": "https://accounts.google.com", 
"authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth", 
"token_endpoint": "https://www.googleapis.com/oauth2/v4/token", 
"userinfo_endpoint": "https://www.googleapis.com/oauth2/v3/userinfo", 
"revocation_endpoint": "https://accounts.google.com/o/oauth2/revoke", 
"jwks_uri": "https://www.googleapis.com/oauth2/v3/certs", 
"response_types_supported": [ 
    "code", 
    "token", 
    "id_token", 
    "code token", 
    "code id_token", 
    "token id_token", 
    "code token id_token", 
    "none" 
], 
"subject_types_supported": [ 
    "public" 
], 
"id_token_signing_alg_values_supported": [ 
    "RS256" 
], 
"scopes_supported": [ 
    "openid", 
    "email", 
    "profile" 
], 
"token_endpoint_auth_methods_supported": [ 
    "client_secret_post", 
    "client_secret_basic" 
], 
"claims_supported": [ 
    "aud", 
    "email", 
    "email_verified", 
    "exp", 
    "family_name", 
    "given_name", 
    "iat", 
    "iss", 
    "locale", 
    "name", 
    "picture", 
    "sub" 
], 
"code_challenge_methods_supported": [ 
    "plain", 
    "S256" 
] 
} 

I : 다음을 반환하는

https://server.example.com/.well-known/openid-configuration

분명히 accounts.google.com

와 server.example.com 교체인 jwks_uri 키의 값에만 관심이 있습니다. 지금 열린 우리당을 사용하여 561,453,210

내가 인증서 체인 검색 할 희망과 터미널에서 다음 명령을 입력 위부터 :

이 무시 무시한, 무서운, 혼란, 모욕 응답을 반환

openssl s_client -showcerts -connect https://www.googleapis.com/oauth2/v3/certs:443

을

getservbyname failure for //www.googleapis.com/oauth2/v3/certs:443 
usage: s_client args 

-host host  - use -connect instead 
-port port  - use -connect instead 
-connect host:port - who to connect to (default is localhost:4433) 
-verify_hostname host - check peer certificate matches "host" 
-verify_email email - check peer certificate matches "email" 
-verify_ip ipaddr - check peer certificate matches "ipaddr" 
-verify arg - turn on peer certificate verification 
-verify_return_error - return verification errors 
-cert arg  - certificate file to use, PEM format assumed 
-certform arg - certificate format (PEM or DER) PEM default 
-key arg  - Private key file to use, in cert file if 
       not specified but cert file is. 
-keyform arg - key format (PEM or DER) PEM default 
-pass arg  - private key file pass phrase source 
-CApath arg - PEM format directory of CA's 
-CAfile arg - PEM format file of CA's 
-no_alt_chains - only ever use the first certificate chain found 
-reconnect - Drop and re-make the connection with the same Session-ID 
-pause  - sleep(1) after each read(2) and write(2) system call 
-prexit  - print session information even on connection failure 
-showcerts - show all certificates in the chain 
-debug  - extra output 
-msg   - Show protocol messages 
-nbio_test - more ssl protocol testing 
-state  - print the 'ssl' states 
-nbio   - Run with non-blocking IO 
-crlf   - convert LF from terminal into CRLF 
-quiet  - no s_client output 
-ign_eof  - ignore input eof (default when -quiet) 
-no_ign_eof - don't ignore input eof 
-psk_identity arg - PSK identity 
-psk arg  - PSK in hex (without 0x) 
-srpuser user  - SRP authentification for 'user' 
-srppass arg  - password for 'user' 
-srp_lateuser  - SRP username into second ClientHello message 
-srp_moregroups - Tolerate other than the known g N values. 
-srp_strength int - minimal length in bits for N (default 1024). 
-ssl2   - just use SSLv2 
-ssl3   - just use SSLv3 
-tls1_2  - just use TLSv1.2 
-tls1_1  - just use TLSv1.1 
-tls1   - just use TLSv1 
-dtls1  - just use DTLSv1 
-fallback_scsv - send TLS_FALLBACK_SCSV 
-mtu   - set the link layer MTU 
-no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol 
-bugs   - Switch on all SSL implementation bug workarounds 
-cipher  - preferred cipher to use, use the 'openssl ciphers' 
       command to see what is available 
-starttls prot - use the STARTTLS command before starting TLS 
       for those protocols that support it, where 
       'prot' defines which one to assume. Currently, 
       only "smtp", "pop3", "imap", "ftp" and "xmpp" 
       are supported. 
-engine id - Initialise and use the specified engine 
-rand file:file:... 
-sess_out arg - file to write SSL session to 
-sess_in arg - file to read SSL session from 
-servername host - Set TLS extension servername in ClientHello 
-tlsextdebug  - hex dump of all TLS extensions received 
-status   - request certificate status from server 
-no_ticket  - disable use of RFC4507bis session tickets 
-serverinfo types - send empty ClientHello extensions (comma-separated numbers) 
-curves arg  - Elliptic curves to advertise (colon-separated list) 
-sigalgs arg  - Signature algorithms to support (colon-separated list) 
-client_sigalgs arg - Signature algorithms to support for client 
         certificate authentication (colon-separated list) 
-nextprotoneg arg - enable NPN extension, considering named protocols supported (comma-separated list) 
-alpn arg   - enable ALPN extension, considering named protocols supported (comma-separated list) 
-legacy_renegotiation - enable use of legacy renegotiation (dangerous) 
-use_srtp profiles - Offer SRTP key management with a colon-separated profile list 
-keymatexport label - Export keying material using label 
-keymatexportlen len - Export len bytes of keying material (default 20) 

위의 코드가 내 Yigrette이고 여전히 순진한 Jon Snow 인 것처럼 느껴진다. 아직 아무것도 모른다. 내가 명백한 것을 볼 수 없다면 저를 도와 주시고 용서해주십시오. 나는 아무것도 모른다. 그러나

openssl s_client -showcerts -connect www.googleapis.com:443 

당신이 가능하게 한 후입니다 무엇 : SSL 오히려 HTTP보다 TCP 레벨의 프로토콜이 해당 명령 작업을 만들기 위해 -connect에서 프로토콜과 경로를 제거,이므로 감사합니다 모두가

Answer 1

을 :) JWK OpenID Connect 서버가 검색 문서에 게시되도록 설정합니다. 이 그냥 검색하고 analyse 수 : 각 JWT는 확인을 위해

curl https://www.googleapis.com/oauth2/v3/certs 

그런 다음, 헤더에서 kid를 추출하고 게시 된 세트에서 올바른 공개 키를 검색하는 데 사용합니다.