Question

我在密钥斗篷中创建了两个角色，农民和 FIELD_STAFF

并创建了一个用户Rahul并将其映射为FARMER角色。

我已经在keycloak中的客户端下面创建了。

我有一个Web服务，我只想通过FARMER角色访问它。我已经创建了令牌并在调用其余服务时传递了它。但是作为响应，我收到了未经授权的访问错误。

下面，我要添加令牌生成屏幕和Keycloak配置。

SecurityConfig.java

    package com.cropin.farmerservice.config;

import com.cropin.farmerservice.controller.FarmerController;
import org.keycloak.adapters.KeycloakConfigResolver;
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springsecurity.KeycloakSecurityComponents;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.client.KeycloakClientRequestFactory;
import org.keycloak.adapters.springsecurity.client.KeycloakRestTemplate;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.config.ConfigurableBeanFactory;
import org.springframework.context.annotation.*;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;

@Configuration
@ComponentScan(
        basePackageClasses = KeycloakSecurityComponents.class,
        excludeFilters = @ComponentScan.Filter(type = FilterType.REGEX, pattern = "org.keycloak.adapters.springsecurity.management.HttpSessionManager"))
@EnableWebSecurity
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws  Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = new KeycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new NullAuthenticatedSessionStrategy();
    }

    @Bean
    public KeycloakConfigResolver keycloakConfigResolver(){
        return new KeycloakSpringBootConfigResolver();
    }

    @Autowired
    public KeycloakClientRequestFactory keycloakClientRequestFactory;

    @Bean
    @Scope(ConfigurableBeanFactory.SCOPE_PROTOTYPE)
    public KeycloakRestTemplate keycloakRestTemplate(){
        return new KeycloakRestTemplate(keycloakClientRequestFactory);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception{
        super.configure(http);
        http.authorizeRequests()
                .antMatchers("/farmer/*").hasRole("FARMER")
                .anyRequest().permitAll();
    }
}

application.properties

server.port = 8085


keycloak.enabled=true
keycloak.auth-server-url=http://localhost:8080/auth
keycloak.realm=farmer_demo
keycloak.resource=farmer-service
keycloak.bearer-only=true
keycloak.use-resource-role-mappings = true

下面是我得到的答复。

Answer 1

您将需要RPT令牌才能访问您的API，而不仅仅是访问令牌，请使用生成的access_token生成rpt一个，PRT令牌是实际持有的权限。

keycloak authorization services

这是我从事后端开发时如何生成RPT令牌的方法：

从终端，您可以从密钥斗篷中获取令牌（与邮递员或其他测试工具一起使用）：

获取访问令牌：

 curl -v -d 'client_secret={keycloak client secret}' -d 'username={user name}' -d 'password={password}' -d 'client_id={keycloak client id}' -d 'grant_type=password' 'http://{keycloak url or host:port}/auth/realms/development/protocol/openid-connect/token'

获取将在测试期间使用的rpt令牌

 curl -v -X POST \
 http://{keycloak url or host:port}/auth/realms/development/protocol/openid- 
 connect/token \
 -H "Authorization: Bearer { token string from previous command result }" \
 --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
 --data "audience={keycloak client id}"

请参阅this部分以了解更多详细信息...

使用Keycloak进行Spring Boot以保护其余服务

1 个答案: