Azure: 遵循官方文档设置 APIM 的入站策略时引发的错误

huangapple
go评论104阅读模式
英文:

Azure: Error thrown when following official doc to set up inbound policies for APIM

问题

我按照此 文档 上的步骤进行操作，但在保存策略编辑器下的 "入站处理" 和代码视图按钮 "</>" 时出现了以下错误：

  1. 一个或多个字段包含不正确的值：
  2. 元素 'cors' 中的错误，位于第2行，第5列：策略部分不允许在指定的范围内
  3. 元素 'validate-jwt' 中的错误，位于第16行，第5列：策略部分不允许在指定的范围内
  4. 元素 'rate-limit-by-key' 中的错误，位于第24行，第5列：策略部分不允许在指定的范围内

以下是代码：

  1. <inbound>
  2.    <cors allow-credentials="true">
  3.          <allowed-origins>
  4.              <origin>https://devjohn1.z11.web.core.windows.net/</origin>
  5.          </allowed-origins>
  6.          <allowed-methods preflight-result-max-age="120">
  7.              <method>GET</method>
  8.          </allowed-methods>
  9.          <allowed-headers>
  10.              <header>*</header>
  11.          </allowed-headers>
  12.          <expose-headers>
  13.              <header>*</header>
  14.          </expose-headers>
  15.    </cors>
  16.    <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid." require-expiration-time="true" require-signed-tokens="true" clock-skew="300">
  17.       <openid-config url="https://devjohn1.b2clogin.com/devjohn1.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_myapp_frontend_devjohn1_signupandsignin" />
  18.       <required-claims>
  19.          <claim name="aud">
  20.             <value>56f39849-19eb-49d6-qweqw-123123123</value>
  21.          </claim>
  22.       </required-claims>
  23.    </validate-jwt>
  24.    <rate-limit-by-key calls="300" renewal-period="120" counter-key="@(context.Request.IpAddress)" />
  25.    <rate-limit-by-key calls="15" renewal-period="60" counter-key="@(context.Request.Headers.GetValueOrDefault("Authorization","").AsJwt()?.Subject)" />
  26. </inbound>

可能出了什么问题？我只是按照步骤进行操作...

英文:

I followed steps on this doc precisely, but got this error when saving the policy editor Under "Inbound processing" and code view button "</>":

  1. One or more fields contain incorrect values:
  2. Error in element &#39;cors&#39; on line 2, column 5: Policy section is not allowed in the specified scope
  3. Error in element &#39;validate-jwt&#39; on line 16, column 5: Policy section is not allowed in the specified scope
  4. Error in element &#39;rate-limit-by-key&#39; on line 24, column 5: Policy section is not allowed in the specified scope

here is the code:

  1. &lt;inbound&gt;
  2.    &lt;cors allow-credentials=&quot;true&quot;&gt;
  3.          &lt;allowed-origins&gt;
  4.              &lt;origin&gt;https://devjohn1.z11.web.core.windows.net/&lt;/origin&gt;
  5.          &lt;/allowed-origins&gt;
  6.          &lt;allowed-methods preflight-result-max-age=&quot;120&quot;&gt;
  7.              &lt;method&gt;GET&lt;/method&gt;
  8.          &lt;/allowed-methods&gt;
  9.          &lt;allowed-headers&gt;
  10.              &lt;header&gt;*&lt;/header&gt;
  11.          &lt;/allowed-headers&gt;
  12.          &lt;expose-headers&gt;
  13.              &lt;header&gt;*&lt;/header&gt;
  14.          &lt;/expose-headers&gt;
  15.    &lt;/cors&gt;
  16.    &lt;validate-jwt header-name=&quot;Authorization&quot; failed-validation-httpcode=&quot;401&quot; failed-validation-error-message=&quot;Unauthorized. Access token is missing or invalid.&quot; require-expiration-time=&quot;true&quot; require-signed-tokens=&quot;true&quot; clock-skew=&quot;300&quot;&gt;
  17.       &lt;openid-config url=&quot;https://devjohn1.b2clogin.com/devjohn1.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_myapp_frontend_devjohn1_signupandsignin&quot; /&gt;
  18.       &lt;required-claims&gt;
  19.          &lt;claim name=&quot;aud&quot;&gt;
  20.             &lt;value&gt;56f39849-19eb-49d6-qweqw-123123123&lt;/value&gt;
  21.          &lt;/claim&gt;
  22.       &lt;/required-claims&gt;
  23.    &lt;/validate-jwt&gt;
  24.    &lt;rate-limit-by-key calls=&quot;300&quot; renewal-period=&quot;120&quot; counter-key=&quot;@(context.Request.IpAddress)&quot; /&gt;
  25.    &lt;rate-limit-by-key calls=&quot;15&quot; renewal-period=&quot;60&quot; counter-key=&quot;@(context.Request.Headers.GetValueOrDefault(&quot;Authorization&quot;,&quot;&quot;).AsJwt()?.Subject)&quot; /&gt;
  26. &lt;/inbound&gt;

What can be wrong? I was just following the steps....

答案1

得分: 1

我已经尝试在我的环境中重现了这个问题，并获得了与下面相同的错误-

> 一个或多个字段包含不正确的值：
> - 第2行，第10列的'cors'元素中存在错误：在指定的范围内不允许策略部分
> - 第16行，第10列的'validate-jwt'元素中存在错误：在指定的范围内不允许策略部分
> - 第24行，第10列的'rate-limit-by-key'元素中存在错误：在指定的范围内不允许策略部分

每当您尝试以以下方式保存策略时，都会收到错误消息

Azure: 遵循官方文档设置 APIM 的入站策略时引发的错误

在创建了新的API后，单击APIM中的入站策略代码编辑器

Azure: 遵循官方文档设置 APIM 的入站策略时引发的错误

单击后，您将获得默认的策略模板。将入站策略粘贴到<inbound></inbound>标记中，保持其他标记不变。

Azure: 遵循官方文档设置 APIM 的入站策略时引发的错误

在对现有策略进行了一些修改之后，我能够保存它。将<inbound></inbound>保留在<policies></policies>中。

  1. <policies>
  2.     <inbound>
  3.         <cors allow-credentials="true">
  4.             <allowed-origins>
  5.                 <origin>https://devjohn1.z11.web.core.windows.net/</origin>
  6.             </allowed-origins>
  7.             <allowed-methods preflight-result-max-age="120">
  8.                 <method>GET</method>
  9.             </allowed-methods>
  10.             <allowed-headers>
  11.                 <header>*</header>
  12.             </allowed-headers>
  13.             <expose-headers>
  14.                 <header>*</header>
  15.             </expose-headers>
  16.         </cors>
  17.         <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid." require-expiration-time="true" require-signed-tokens="true" clock-skew="300">
  18.             <openid-config url="https://devjohn1.b2clogin.com/devjohn1.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_myapp_frontend_devjohn1_signupandsignin" />
  19.             <required-claims>
  20.                 <claim name="aud">
  21.                     <value>56f39849-19eb-49d6-qweqw-123123123</value>
  22.                 </claim>
  23.             </required-claims>
  24.         </validate-jwt>
  25.         <rate-limit-by-key calls="300" renewal-period="120" counter-key="@(context.Request.IpAddress)" />
  26.         <rate-limit-by-key calls="15" renewal-period="60" counter-key="@(context.Request.Headers.GetValueOrDefault("Authorization","").AsJwt()?.Subject)" />
  27.     </inbound>
  28.     <backend>
  29.         <base />
  30.     </backend>
  31.     <outbound>
  32.         <base />
  33.     </outbound>
  34.     <on-error>
  35.         <base />
  36.     </on-error>
  37. </policies>
英文:

I have tried to reproduce the issue at my environment and got the same error as below-

> One or more fields contain incorrect values:
> - Error in element 'cors' on line 2, column 10: Policy section is not allowed in the specified scope
> - Error in element 'validate-jwt' on line 16, column 10: Policy section is not allowed in the specified scope
> - Error in element 'rate-limit-by-key' on line 24, column 10: Policy section is not allowed in the specified scope

Whenever you will try to save the policies in the following manner, you will be get the error

Azure: 遵循官方文档设置 APIM 的入站策略时引发的错误

After creating the new API in APIM click on the inbound policy code editor

Azure: 遵循官方文档设置 APIM 的入站策略时引发的错误

After clicking, you will get the default policy template. Paste your inbound policies within &lt;inbound&gt;&lt;/inbound&gt; keeping other tags as is.

Azure: 遵循官方文档设置 APIM 的入站策略时引发的错误

After few modification in your existing policy, I am able to save it. Keep &lt;inbound&gt;&lt;/inbound&gt; within &lt;policies&gt;&lt;/policies&gt;.

  1. &lt;policies&gt;
  2.     &lt;inbound&gt;
  3.         &lt;cors allow-credentials=&quot;true&quot;&gt;
  4.             &lt;allowed-origins&gt;
  5.                 &lt;origin&gt;https://devjohn1.z11.web.core.windows.net/&lt;/origin&gt;
  6.             &lt;/allowed-origins&gt;
  7.             &lt;allowed-methods preflight-result-max-age=&quot;120&quot;&gt;
  8.                 &lt;method&gt;GET&lt;/method&gt;
  9.             &lt;/allowed-methods&gt;
  10.             &lt;allowed-headers&gt;
  11.                 &lt;header&gt;*&lt;/header&gt;
  12.             &lt;/allowed-headers&gt;
  13.             &lt;expose-headers&gt;
  14.                 &lt;header&gt;*&lt;/header&gt;
  15.             &lt;/expose-headers&gt;
  16.         &lt;/cors&gt;
  17.         &lt;validate-jwt header-name=&quot;Authorization&quot; failed-validation-httpcode=&quot;401&quot; failed-validation-error-message=&quot;Unauthorized. Access token is missing or invalid.&quot; require-expiration-time=&quot;true&quot; require-signed-tokens=&quot;true&quot; clock-skew=&quot;300&quot;&gt;
  18.             &lt;openid-config url=&quot;https://devjohn1.b2clogin.com/devjohn1.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_myapp_frontend_devjohn1_signupandsignin&quot; /&gt;
  19.             &lt;required-claims&gt;
  20.                 &lt;claim name=&quot;aud&quot;&gt;
  21.                     &lt;value&gt;56f39849-19eb-49d6-qweqw-123123123&lt;/value&gt;
  22.                 &lt;/claim&gt;
  23.             &lt;/required-claims&gt;
  24.         &lt;/validate-jwt&gt;
  25.         &lt;rate-limit-by-key calls=&quot;300&quot; renewal-period=&quot;120&quot; counter-key=&quot;@(context.Request.IpAddress)&quot; /&gt;
  26.         &lt;rate-limit-by-key calls=&quot;15&quot; renewal-period=&quot;60&quot; counter-key=&quot;@(context.Request.Headers.GetValueOrDefault(&quot;Authorization&quot;,&quot;&quot;).AsJwt()?.Subject)&quot; /&gt;
  27.     &lt;/inbound&gt;
  28.     &lt;backend&gt;
  29.         &lt;base /&gt;
  30.     &lt;/backend&gt;
  31.     &lt;outbound&gt;
  32.         &lt;base /&gt;
  33.     &lt;/outbound&gt;
  34.     &lt;on-error&gt;
  35.         &lt;base /&gt;
  36.     &lt;/on-error&gt;
  37. &lt;/policies&gt;

huangapple
  • 本文由 发表于 2023年6月19日 16:30:06
  • 转载请务必保留本文链接：https://go.coder-hub.com/76504917.html
  • azure
  • azure-api-management
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定