java - 访问资源时 keycloak 中出现 !role 错误

Question

我已经使用 Keycloak 保护了我的其余 api。身份验证后，当我尝试访问 REST API 时，我得到:

403 error. Unable to access rest api. Reason !role.

在配置中我已将角色指定为*:

    ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
    context.setSecurityHandler(securityHandler);
    securityHandler.addRole("*");
    ConstraintMapping constraintMapping = new ConstraintMapping();
    constraintMapping.setPathSpec("/*");
    Constraint constraint = new Constraint();

    constraint.setAuthenticate(true);
    constraint.setRoles(new String[]{"*"});

我使用 '*' 指定任何角色的假设是否错误，或者该错误是否意味着不同的内容？

我在 JettyKeycloakAuthentciator 日志中看到以下日志:

2018-05-24 12:55:52,253 [DEBUG] [ers.PreAuthActionsHandler(handleRequest )] - adminRequest http://localhost:7100/api/v1/design/test 2018-05-24 12:55:52,254 [DEBUG] [TokenRequestAuthenticator(thenticateToken)] - Verifying access_token 2018-05-24 12:55:52,255 [DEBUG] [TokenRequestAuthenticator(thenticateToken)] - successful authorized 2018-05-24 12:55:52,255 [DEBUG] [JettyRequestAuthenticator(rAuthentication)] - Completing bearer authentication. Bearer roles: [uma_authorization] 2018-05-24 12:55:52,255 [DEBUG] [ters.RequestAuthenticator(eAuthentication)] - User '8f9381df-2f7e-4ff8-9ef5-2123b03db3c9' invoking 'http://localhost:7100/api/v1/design/test' on client 'my_server' 2018-05-24 12:55:52,255 [DEBUG] [ters.RequestAuthenticator(authenticate )] - Bearer AUTHENTICATED 2018-05-24 12:55:52,255 [DEBUG] [thenticatedActionsHandler(handledRequest )] - AuthenticatedActionsValve.invoke http://localhost:7100/api/v1/design/test

Answer 1

事实证明设置任何角色的正确方法是:

constraint.setRoles(new String[]{"**"});

即双*而不是单*

另外，我删除了这一行:

securityHandler.addRole("*");