3.2.8.4. 获取 OpenID Connect 供应商的 thumbprint

流程

1. 从 IDP 的 URL 获取配置文档：

   语法

   curl -k -v \
        -X GET \
        -H "Content-Type: application/x-www-form-urlencoded" \
        "IDP_URL:8000/CONTEXT/realms/REALM/.well-known/openid-configuration" \
      | jq .

   示例

   [user@client ~]$ curl -k -v \
        -X GET \
        -H "Content-Type: application/x-www-form-urlencoded" \
        "http://www.example.com:8000/auth/realms/quickstart/.well-known/openid-configuration" \
      | jq .

2. 获取 IDP 证书：

   语法

   curl -k -v \
        -X GET \
        -H "Content-Type: application/x-www-form-urlencoded" \
        "IDP_URL/CONTEXT/realms/REALM/protocol/openid-connect/certs" \
        | jq .

   Example

   [user@client ~]$ curl -k -v \
        -X GET \
        -H "Content-Type: application/x-www-form-urlencoded" \
        "http://www.example.com/auth/realms/quickstart/protocol/openid-connect/certs" \
        | jq .

   注意

   x5c 证书可以在 /certs 路径或 /jwks 路径中找到，具体取决于 SSO 提供程序。

3. 复制上一命令中的"x5c"响应的结果，并将它粘贴到 certificate.crt 文件中。include-- BEGIN CERTIFICATE-- at the beginning and- END CERTIFICATE-- at the end.

   Example

   -----BEGIN CERTIFICATE-----
   
   MIIDYjCCAkqgAwIBAgIEEEd2CDANBgkqhkiG9w0BAQsFADBzMQkwBwYDVQQGEwAxCTAHBgNVBAgTADEJMAcGA1UEBxMAMQkwBwYDVQQKEwAxCTAHBgNVBAsTADE6MDgGA1UEAxMxYXV0aHN2Yy1pbmxpbmVtZmEuZGV2LnZlcmlmeS5pYm1jbG91ZHNlY3VyaXR5LmNvbTAeFw0yMTA3MDUxMzU2MzZaFw0zMTA3MDMxMzU2MzZaMHMxCTAHBgNVBAYTADEJMAcGA1UECBMAMQkwBwYDVQQHEwAxCTAHBgNVBAoTADEJMAcGA1UECxMAMTowOAYDVQQDEzFhdXRoc3ZjLWlubGluZW1mYS5kZXYudmVyaWZ5LmlibWNsb3Vkc2VjdXJpdHkuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAphyu3HaAZ14JH/EXetZxtNnerNuqcnfxcmLhBz9SsTlFD59ta+BOVlRnK5SdYEqO3ws2iGEzTvC55rczF+hDVHFZEBJLVLQe8ABmi22RAtG1P0dA/Bq8ReFxpOFVWJUBc31QM+ummW0T4yw44wQJI51LZTMz7PznB0ScpObxKe+frFKd1TCMXPlWOSzmTeFYKzR83Fg9hsnz7Y8SKGxi+RoBbTLT+ektfWpR7O+oWZIf4INe1VYJRxZvn+qWcwI5uMRCtQkiMknc3Rj6Eupiqq6FlAjDs0p//EzsHAlW244jMYnHCGq0UP3oE7vViLJyiOmZw7J3rvs3m9mOQiPLoQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCeVqAzSh7Tp8LgaTIFUuRbdjBAKXC9Nw3+pRBHoiUTdhqO3ualyGih9m/js/clb8Vq/39zl0VPeaslWl2NNX9zaK7xo+ckVIOY3ucCaTC04ZUn1KzZu/7azlN0C5XSWg/CfXgU2P3BeMNzc1UNY1BASGyWn2lEplIVWKLaDZpNdSyyGyaoQAIBdzxeNCyzDfPCa2oSO8WH1czmFiNPqR5kdknHI96CmsQdi+DT4jwzVsYgrLfcHXmiWyIAb883hR3Pobp+Bsw7LUnxebQ5ewccjYmrJzOk5Wb5FpXBhaJH1B3AEd6RGalRUyc/zUKdvEy0nIRMDS9x2BP3NVvZSADD
   
   -----END CERTIFICATE-----

4. 获取证书指纹：

   语法

   openssl x509 -in CERT_FILE -fingerprint -noout

   示例

   [user@client ~]$ openssl x509 -in certificate.crt -fingerprint -noout
   SHA1 Fingerprint=F7:D7:B3:51:5D:D0:D3:19:DD:21:9A:43:A9:EA:72:7A:D6:06:52:87

5. 从 SHA1 指纹中删除所有冒号，并将其用作在 IAM 请求中创建 IDP 实体的输入。