我在使用 Keycloak Spring 适配器的项目中升级到了 Spring Boot 3。不幸的是，由于 KeycloakWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter 已经被 Spring Security 废弃并移除，导致项目无法启动。目前是否有其他的方法来实现与 Keycloak 的安全集成呢？换句话说，我该如何在 Spring Boot 3 中使用 Keycloak 适配器呢？
我在网上搜索了一下，但没有找到任何其他版本的适配器。
你不能在spring-boot 3中使用Keycloak适配器，原因你已经找到了，还有一些与传递依赖关系相关的其他原因。由于大多数Keycloak适配器在2022年初已被弃用，很可能不会发布更新来修复这个问题。
相反，使用spring-security 6库进行OAuth2。 不要慌张，使用spring-boot很容易实现。
接下来，我假设你对OAuth2的概念有很好的理解，并且清楚为什么需要配置OAuth2客户端或OAuth2资源服务器。 如果有疑问，请参考我的教程中的OAuth2基础知识部分。
我只会在这里详细介绍将servlet应用程序配置为资源服务器的方法，然后再介绍将其配置为客户端的方法，针对一个单独的Keycloak领域，以及使用和不使用我的Spring Boot starter
spring-addons-starter-oidc。如果您不想使用"我的" starter，可以直接浏览您感兴趣的部分（但请准备编写更多的代码）。spring-cloud-gateway应用程序通过访问令牌保护了一个REST API，它被OAuth2 REST客户端所使用。以下是一些此类客户端的示例：
WebClient，@FeignClient，RestTemplate或类似工具的Spring应用程序spring-addons-starter-oidc<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
<dependency>
<groupId>com.c4-soft.springaddons</groupId>
<artifactId>spring-addons-starter-oidc</artifactId>
<version>7.1.3</version>
</dependency>
origins: http://localhost:4200
issuer: http://localhost:8442/realms/master
com:
c4-soft:
springaddons:
oidc:
ops:
- iss: ${issuer}
username-claim: preferred_username
authorities:
- path: $.realm_access.roles
prefix: ROLE_
- path: $.resource_access.*.roles
resourceserver:
cors:
- path: /**
allowed-origin-patterns: ${origins}
permit-all:
- "/actuator/health/readiness"
- "/actuator/health/liveness"
- "/v3/api-docs/**"
上面的配置文件中的领域角色前缀仅用于说明目的，您可以将其删除。CORS配置也需要进行一些改进。
@Configuration
@EnableMethodSecurity
public static class WebSecurityConfig { }
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
<dependency>
<!-- used when converting Keycloak roles to Spring authorities -->
<groupId>com.jayway.jsonpath</groupId>
<artifactId>json-path</artifactId>
</dependency>
spring:
security:
oauth2:
resourceserver:
jwt:
issuer-uri: http://localhost:8442/realms/master
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public static class WebSecurityConfig {
@Bean
SecurityFilterChain filterChain(HttpSecurity http, Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter) throws Exception {
http.oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter)));
// Enable and configure CORS
http.cors(cors -> cors.configurationSource(corsConfigurationSource("http://localhost:4200")));
// State-less session (state in access-token only)
http.sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
// Disable CSRF because of state-less session-management
http.csrf(csrf -> csrf.disable());
// Return 401 (unauthorized) instead of 302 (redirect to login) when
// authorization is missing or invalid
http.exceptionHandling(eh -> eh.authenticationEntryPoint((request, response, authException) -> {
response.addHeader(HttpHeaders.WWW_AUTHENTICATE, "Bearer realm=\"Restricted Content\"");
response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
}));
// @formatter:off
http.authorizeHttpRequests(accessManagement -> accessManagement
.requestMatchers("/actuator/health/readiness", "/actuator/health/liveness", "/v3/api-docs/**").permitAll()
.anyRequest().authenticated()
);
// @formatter:on
return http.build();
}
private UrlBasedCorsConfigurationSource corsConfigurationSource(String... origins) {
final var configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList(origins));
configuration.setAllowedMethods(List.of("*"));
configuration.setAllowedHeaders(List.of("*"));
configuration.setExposedHeaders(List.of("*"));
final var source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
@RequiredArgsConstructor
static class JwtGrantedAuthoritiesConverter implements Converter<Jwt, Collection<? extends GrantedAuthority>> {
@Override
@SuppressWarnings({ "rawtypes", "unchecked" })
public Collection<? extends GrantedAuthority> convert(Jwt jwt) {
return Stream.of("$.realm_access.roles", "$.resource_access.*.roles").flatMap(claimPaths -> {
Object claim;
try {
claim = JsonPath.read(jwt.getClaims(), claimPaths);
} catch (PathNotFoundException e) {
claim = null;
}
if (claim == null) {
return Stream.empty();
}
if (claim instanceof String claimStr) {
return Stream.of(claimStr.split(","));
}
if (claim instanceof String[] claimArr) {
return Stream.of(claimArr);
}
if (Collection.class.isAssignableFrom(claim.getClass())) {
final var iter = ((Collection) claim).iterator();
if (!iter.hasNext()) {
return Stream.empty();
}
final var firstItem = iter.next();
if (firstItem instanceof String) {
return (Stream<String>) ((Collection) claim).stream();
}
if (Collection.class.isAssignableFrom(firstItem.getClass())) {
return (Stream<String>) ((Collection) claim).stream().flatMap(colItem -> ((Collection) colItem).stream()).map(String.class::cast);
}
}
return Stream.empty();
})
/* Insert some transformation here if you want to add a prefix like "ROLE_" or force upper-case authorities */
.map(SimpleGrantedAuthority::new)
.map(GrantedAuthority.class::cast).toList();
}
}
@Component
@RequiredArgsConstructor
static class SpringAddonsJwtAuthenticationConverter implements Converter<Jwt, JwtAuthenticationToken> {
@Override
public JwtAuthenticationToken convert(Jwt jwt) {
final var authorities = new JwtGrantedAuthoritiesConverter().convert(jwt);
final String username = JsonPath.read(jwt.getClaims(), "preferred_username");
return new JwtAuthenticationToken(jwt, authorities, username);
}
}
}
Back-Channel Logout目前尚未由Spring实现。如果您需要它，请使用“my”启动器（或从中复制）。
spring-addons-starter-oidc<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-client</artifactId>
</dependency>
<dependency>
<groupId>com.c4-soft.springaddons</groupId>
<artifactId>spring-addons-starter-oidc</artifactId>
<version>7.1.3</version>
</dependency>
issuer: http://localhost:8442/realms/master
client-id: spring-addons-confidential
client-secret: change-me
client-uri: http://localhost:8080
spring:
security:
oauth2:
client:
provider:
keycloak:
issuer-uri: ${issuer}
registration:
keycloak-login:
authorization-grant-type: authorization_code
client-name: My Keycloak instance
client-id: ${client-id}
client-secret: ${client-secret}
provider: keycloak
scope: openid,profile,email,offline_access
com:
c4-soft:
springaddons:
oidc:
ops:
- iss: ${issuer}
username-claim: preferred_username
authorities:
- path: $.realm_access.roles
- path: $.resource_access.*.roles
client:
client-uri: ${client-uri}
security-matchers: /**
permit-all:
- /
- /login/**
- /oauth2/**
csrf: cookie-accessible-from-js
post-login-redirect-path: /home
post-logout-redirect-path: /
back-channel-logout-enabled: true
@Configuration
@EnableMethodSecurity
public class WebSecurityConfig {
}
subject，在Keycloak中是一个UUID，并且每个领域都会发生变化）。spring-boot-starter-oauth2-client。<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>
<dependency>
<!-- used when converting Keycloak roles to Spring authorities -->
<groupId>com.jayway.jsonpath</groupId>
<artifactId>json-path</artifactId>
</dependency>
issuer: http://localhost:8442/realms/master
client-id: spring-addons-confidential
client-secret: change-me
spring:
security:
oauth2:
client:
provider:
keycloak:
issuer-uri: ${issuer}
registration:
keycloak-login:
authorization-grant-type: authorization_code
client-name: My Keycloak instance
client-id: ${client-id}
client-secret: ${client-secret}
provider: keycloak
scope: openid,profile,email,offline_access
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class WebSecurityConfig {
@Bean
SecurityFilterChain
clientSecurityFilterChain(HttpSecurity http, InMemoryClientRegistrationRepository clientRegistrationRepository)
throws Exception {
http.oauth2Login(withDefaults());
http.logout(logout -> {
logout.logoutSuccessHandler(new OidcClientInitiatedLogoutSuccessHandler(clientRegistrationRepository));
});
// @formatter:off
http.authorizeHttpRequests(ex -> ex
.requestMatchers("/", "/login/**", "/oauth2/**").permitAll()
.requestMatchers("/nice.html").hasAuthority("NICE")
.anyRequest().authenticated());
// @formatter:on
return http.build();
}
@Component
@RequiredArgsConstructor
static class GrantedAuthoritiesMapperImpl implements GrantedAuthoritiesMapper {
@Override
public Collection<? extends GrantedAuthority> mapAuthorities(Collection<? extends GrantedAuthority> authorities) {
Set<GrantedAuthority> mappedAuthorities = new HashSet<>();
authorities.forEach(authority -> {
if (OidcUserAuthority.class.isInstance(authority)) {
final var oidcUserAuthority = (OidcUserAuthority) authority;
final var issuer = oidcUserAuthority.getIdToken().getClaimAsURL(JwtClaimNames.ISS);
mappedAuthorities.addAll(extractAuthorities(oidcUserAuthority.getIdToken().getClaims()));
} else if (OAuth2UserAuthority.class.isInstance(authority)) {
try {
final var oauth2UserAuthority = (OAuth2UserAuthority) authority;
final var userAttributes = oauth2UserAuthority.getAttributes();
final var issuer = new URL(userAttributes.get(JwtClaimNames.ISS).toString());
mappedAuthorities.addAll(extractAuthorities(userAttributes));
} catch (MalformedURLException e) {
throw new RuntimeException(e);
}
}
});
return mappedAuthorities;
};
@SuppressWarnings({ "rawtypes", "unchecked" })
private static Collection<GrantedAuthority> extractAuthorities(Map<String, Object> claims) {
/* See resource server solution above for authorities mapping */
}
}
}
这个starter是一个标准的Spring Boot starter，它附带了额外的应用程序属性，用于自动配置默认的beans并提供给Spring Security。 需要注意的是，自动配置的@Beans几乎都是@ConditionalOnMissingBean，这使得您可以在您的配置中覆盖它。
它是开源的，您可以更改它为您预配置的所有内容（请参阅Javadoc、starter的README或者众多示例）。 在决定不信任它之前，您应该阅读starter的源代码，它并不是很大。从imports资源开始，它定义了Spring Boot用于自动配置的加载内容。
pom.xml的示例和教程项目。在这个回答中，与2.2最接近的教程是名为servlet-client的教程。你可以在这里找到这些项目和教程。 - undefined使用标准的Spring Security OAuth2客户端代替特定的Keycloak适配器，使用SecurityFilterChain代替WebSecurityAdapter。
像这样：
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(jsr250Enabled = true, prePostEnabled = true)
class OAuth2SecurityConfig {
@Bean
fun customOauth2FilterChain(http: HttpSecurity): SecurityFilterChain {
log.info("Configure HttpSecurity with OAuth2")
http {
oauth2ResourceServer {
jwt { jwtAuthenticationConverter = CustomBearerJwtAuthenticationConverter() }
}
oauth2Login {}
csrf { disable() }
authorizeRequests {
// Kubernetes
authorize("/readiness", permitAll)
authorize("/liveness", permitAll)
authorize("/actuator/health/**", permitAll)
// ...
// everything else needs at least a valid login, roles are checked at method level
authorize(anyRequest, authenticated)
}
}
return http.build()
}
然后在application.yml文件中：
spring:
security:
oauth2:
client:
provider:
abc:
issuer-uri: https://keycloak.../auth/realms/foo
registration:
abc:
client-secret: ...
provider: abc
client-id: foo
scope: [ openid, profile, email ]
resourceserver:
jwt:
issuer-uri: https://keycloak.../auth/realms/foo
@PreAuthorise表达式或安全配置中的authoriseRequests)。此外，这仅涵盖部分情况：资源服务器(REST API)未被覆盖。 - ch4mpKeycloakWebSecurityConfigurerAdapter继承自WebSecurityConfigurerAdapter类，在Spring Security中被弃用并随后在新版本中被删除。
希望这有所帮助！如果您有任何问题、进一步澄清或建议，请随时留下评论。Keycloak 适配器已被弃用，并且不会有任何未来的更新或修复，正如 Keycloak 团队 所宣布的。
建议使用 Spring Security 提供的 OAuth2 和 OpenID Connect 支持。
根据不同的资源和整个周末用于解决这个新问题，我成功找到了完美运行的解决方案。
我在客户端级别（而非领域）定义了两个角色：用户和管理员，并分配给不同的用户。
以下是可工作的解决方案：
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class OAuth2ResourceServerSecurityConfiguration {
@Value("${keycloak.resource}")
private String keycloakClientName;
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
httpSecurity
.authorizeHttpRequests((authorize) -> {
authorize
.anyRequest().authenticated();
})
.oauth2ResourceServer(httpSecurityOAuth2ResourceServerConfigurer -> httpSecurityOAuth2ResourceServerConfigurer
.jwt(jwtConfigurer -> {
jwtConfigurer.jwtAuthenticationConverter(jwtAuthenticationConverter());
})
);
return httpSecurity.build();
}
private Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter() {
JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(new KeycloakRealmRoleConverter());
return jwtAuthenticationConverter;
}
private class KeycloakRealmRoleConverter implements Converter<Jwt, Collection<GrantedAuthority>> {
private Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();
@Override
public Collection<GrantedAuthority> convert(Jwt jwt) {
final Map<String, Object> resourceAccess = (Map<String, Object>) jwt.getClaims().get("resource_access");
if (resourceAccess != null) {
final Map<String, Object> clientAccess = (Map<String, Object>) resourceAccess.get(OAuth2ResourceServerSecurityConfiguration.this.keycloakClientName);
if (clientAccess != null) {
grantedAuthorities = ((List<String>) clientAccess.get("roles")).stream()
.map(roleName -> "ROLE_" + roleName) // Prefix to map to a Spring Security "role"
.map(SimpleGrantedAuthority::new)
.collect(Collectors.toList());
}
}
return grantedAuthorities;
}
}
}
在属性中的Keycloak配置：
keycloak:
authServerUrl: http://<your_keycloak_host>:8989
realm: <your_realm>
resource: <your_client>
useResourceRoleMappings: true
cors: true
corsMaxAge: 1000
corsAllowedMethods: POST, PUT, DELETE, GET
sslRequired: none
bearerOnly: true
publicClient: true
principalAttribute: preferred_username
credentials:
secret: '{cipher}<your_encrypted_secret>'
测试控制器：
@RestController
@RequestMapping("/api/v1/test")
public class TestController {
@GetMapping("/")
public String allAccess() {
return "Public content";
}
@GetMapping("/endpoint1")
@PreAuthorize("hasRole('user')")
public String endpoint1() {
return "User board";
}
@GetMapping("/endpoint2")
@PreAuthorize("hasRole('administrator')")
public String endpoint2() {
return "Administrator board";
}
}
keycloak属性都没有被使用（只有keycloak.resource被使用），而且你的代码似乎需要spring.security.oauth2.resourceserver，但在你的代码片段中缺失了。此外，在资源服务器的过滤器链中，你应该禁用会话（和CSRF保护），并确保未经授权的请求返回401状态码。简而言之，如果你读了答案（也许还跟着链接走了一遭），你就能节省一个周末。 - ch4mp