使用keycloak-jwt令牌保护Spring Boot服务

Question

所以，我用keycloak来保护我的服务。客户端应用程序从keycloak服务器获取访问令牌，并使用它来保护对Spring boot应用程序的访问。我已经用keycloak属性配置了Spring Boot应用程序，使用的是只承载访问类型：

keycloak.realm = master
keycloak.realmKey = ...
keycloak.auth-server-url = http://localhost:8080/auth
keycloak.ssl-required = external
keycloak.resource = boot-app
keycloak.bearer-only = true
keycloak.cors = true

Spring靴键斗篷启动器：

<dependency>
    <groupId>org.keycloak</groupId>
    <artifactId>keycloak-spring-boot-starter</artifactId>
</dependency>

@Configuration
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
public class KeycloakSecurityConfig extends KeycloakWebSecurityConfigurerAdapter
{
  /**
   * Registers the KeycloakAuthenticationProvider with the authentication manager.
   */
  @Autowired
  public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception
  {
    final KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
    keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
    auth.authenticationProvider(keycloakAuthenticationProvider);
  }

  @Bean
  public KeycloakConfigResolver keycloakConfigResolver()
  {
    return new KeycloakSpringBootConfigResolver();
  }

  /**
   * Defines the session authentication strategy.
   */
  @Bean
  @Override
  protected SessionAuthenticationStrategy sessionAuthenticationStrategy()
  {
    return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
  }

  @Override
  protected void configure(final HttpSecurity http) throws Exception
  {
    super.configure(http);
    http
        .authorizeRequests()
        .antMatchers(
            "/v2/api-docs",
            "/configuration/ui",
            "/swagger-resources",
            "/configuration/security",
            "/swagger-ui.html",
            "/webjars/**",
            "/swagger-resources/configuration/ui",
            "/swagge‌​r-ui.html",
            "/swagger-resources/configuration/security").permitAll()
        .antMatchers("/*").hasRole("user")
        .anyRequest().authenticated();
  }
}

keycloak.realmKey

keycloak.auth-server-url

公钥不就是你所需要的一切吗？

提前致谢

Answer 1

实际上，对于只承载，您可能会想知道为什么需要KC URL，但是由于一些KC版本，realmkey不再是强制性的，因为我们使用密钥循环。这意味着应用程序将使用auth-server-url属性从KC服务器动态检索公钥。