java - Spring security keycloak适配器承载配置

Question

我有一个java REST应用程序，我希望通过keycloak来保护它。我做了一些测试，应用程序与 keycloak servlet 过滤器配合得很好，但我在使用 spring 安全适配器时遇到了问题。

keycloak.json(已删除值)

{
  "realm": "",
  "realm-public-key": "",
  "bearer-only": true,
  "auth-server-url": "",
  "ssl-required": "external",
  "resource": ""
}

可见，我只需要承载授权，如果请求包含有效 token ，那么我期望 http 200(如果不是 http 401)。我使用了以下 xml 配置:

<security:global-method-security  jsr250-annotations="enabled"/>

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider ref="keycloakAuthenticationProvider"/>
    </security:authentication-manager>


    <bean id="keycloakAuthenticationEntryPoint"
                class="org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationEntryPoint">
            </bean>
    <bean id="keycloakAuthenticationProvider"
                class="org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider">
        <property name="grantedAuthoritiesMapper">
            <bean class="org.springframework.security.core.authority.mapping.SimpleAuthorityMapper">
                <property name="convertToUpperCase" value="true"/>
                <property name="prefix" value="ROLE_"/>
            </bean>

        </property>
    </bean>

    <bean id="keycloakPreAuthActionsFilter"
                class="org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter"/>
    <bean id="keycloakAuthenticationProcessingFilter"
                class="org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter">
        <constructor-arg name="authenticationManager" ref="authenticationManager"/>
    </bean>

    <bean id="adapterDeploymentContext" class="org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean">
        <constructor-arg value="/WEB-INF/keycloak.json" />
    </bean>


    <security:http auto-config="false" entry-point-ref="keycloakAuthenticationEntryPoint" create-session="stateless">
        <security:custom-filter ref="keycloakPreAuthActionsFilter" before="LOGOUT_FILTER" />
        <security:custom-filter ref="keycloakAuthenticationProcessingFilter" before="FORM_LOGIN_FILTER"/>


        <security:intercept-url pattern="*" access="permitAll()" />
        <security:intercept-url pattern="/services/protected/*" access="isFullyAuthenticated()" />
        <security:csrf disabled="true"/>
    </security:http>

到底发生了什么？请求经过身份验证，但成功后我被重定向到“/”。然后我一次又一次地被认证。日志:

11:18:36,492 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 2 of 9 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 3 of 9 in additional filter chain; firing Filter: 'HeaderWriterFilter'
11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 4 of 9 in additional filter chain; firing Filter: 'KeycloakPreAuthActionsFilter'
11:18:36,508 DEBUG [org.keycloak.adapters.PreAuthActionsHandler] (http-0.0.0.0:8080-4) adminRequest http://test.srv:8080/core2/services/protected/getAttributes
11:18:36,508 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) /services/protected/getAttributes at position 5 of 9 in additional filter chain; firing Filter: 'KeycloakAuthenticationProcessingFilter'
11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0.0:8080-4) Trying to match using Ant [pattern='/sso/login']
11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.AntPathRequestMatcher] (http-0.0.0.0:8080-4) Checking match of request : '/services/protected/getAttributes'; against '/sso/login'
11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0.0:8080-4) Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=Authorization, expectedHeaderValue=null]
11:18:36,508 DEBUG [org.springframework.security.web.util.matcher.OrRequestMatcher] (http-0.0.0`enter code here`.0:8080-4) matched
11:18:36,508 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Request is to process authentication
11:18:36,508 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Attempting Keycloak authentication
11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.authentication.SpringSecurityRequestAuthenticator] (http-0.0.0.0:8080-4) Completing bearer authentication. Bearer roles: [uma_authorization] 
11:18:36,555 DEBUG [org.keycloak.adapters.RequestAuthenticator] (http-0.0.0.0:8080-4) User 'e9ae6919-c0f3-4dcb-96f6-82e3373932e9' invoking 'http://test.srv:8080/core2/services/protected/getAttributes' on client 'mak_test'
11:18:36,555 DEBUG [org.keycloak.adapters.RequestAuthenticator] (http-0.0.0.0:8080-4) Bearer AUTHENTICATED
11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Auth outcome: AUTHENTICATED
11:18:36,555 DEBUG [org.springframework.security.authentication.ProviderManager] (http-0.0.0.0:8080-4) Authentication attempt using org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider
11:18:36,555 DEBUG [org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter] (http-0.0.0.0:8080-4) Authentication success. Updating SecurityContextHolder to contain: org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken@65776c48: Principal: e9ae6919-c0f3-4dcb-96f6-82e3373932e9; Credentials: [PROTECTED]; Authenticated: true; Details: org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount@44667d3a; Granted Authorities: ROLE_UMA_AUTHORIZATION
11:18:36,555 DEBUG [org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler] (http-0.0.0.0:8080-4) Using default Url: /
11:18:36,555 DEBUG [org.springframework.security.web.DefaultRedirectStrategy] (http-0.0.0.0:8080-4) Redirecting to '/core2/'
11:18:36,555 DEBUG [org.springframework.security.web.header.writers.HstsHeaderWriter] (http-0.0.0.0:8080-4) Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@159e9b90
11:18:36,555 DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter] (http-0.0.0.0:8080-4) SecurityContextHolder now cleared, as request processing completed
11:18:36,570 DEBUG [org.springframework.security.web.FilterChainProxy] (http-0.0.0.0:8080-4) / at position 1 of 9 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'

我正在通过 Junit 测试此端点

@Test
    public void protectedTest() throws IOException {
        String token = getToken();
        long time1 = System.currentTimeMillis();
        String url =  server + "/services/protected/getAttributes";
        URL obj = new URL(url);
        HttpURLConnection con = (HttpURLConnection) obj.openConnection();
        con.setRequestMethod("GET");
        con.setRequestProperty("Authorization", token);
        Assert.assertEquals(200, con.getResponseCode());
        System.out.print(String.format("Authorized time: %s ms ", (System.currentTimeMillis() - time1)));
    }

端点代码:

@RestController
public class ProtectedService {

    @RequestMapping(value = "/services/protected/getAttributes",
            method = RequestMethod.GET,
            produces = {MediaType.APPLICATION_XML_VALUE, MediaType.APPLICATION_JSON_VALUE})
    @ResponseBody
    @RolesAllowed("ROLE_UMA_AUTHORIZATION")
    public GetCustAttrsRes getAttributes() {
        return new GetCustAttrsRes();
    }
}

Keycloak服务器版本:2.1.0.Final

Keycloak相关pom部分:

<dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-spring-security-adapter</artifactId>
            <version>2.2.1.Final</version>
        </dependency>
  <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>4.1.3.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>4.1.3.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
            <version>4.1.3.RELEASE</version>
        </dependency>

欢迎任何建议。

Answer 1

问题已解决。我的测试代码中有一个错误。方法 getToken() 返回“bearer ”。这在 keycloak 过滤器适配器中是可以接受的，但在 spring 安全适配器中则不行。正确的方法是“Bearer”，它适用于两个适配器。