用Java而不是用属性表示安全约束

Question

尝试跳过application.properties文件中安全约束的使用：

# keycloak.securityConstraints[1].authRoles[0] = admin
# keycloak.securityConstraints[1].securityCollections[0].patterns[0] = /admin

在Java安全和Spring配置中：

super.configure(http);
http.authorizeRequests().antMatchers("/admin*").hasRole("admin").anyRequest().permitAll();

但它们随后被忽视了。

我的应用程序。属性文件：

server.compression.enabled = true
server.compression.min-response-size = 2048
server.compression.mime-types = application/json,application/xml,text/html,text/xml,text/plain
server.connection-timeout = 5000
server.port = 8082

keycloak.enabled = true
keycloak.auth-server-url = http://localhost:8180/auth
keycloak.ssl-required = external
keycloak.realm = learnintouch
keycloak.resource = learnintouch-web
keycloak.public-client = true
# keycloak.bearer-only = true
# keycloak.credentials.secret = c123028f-2654-403b-a9d0-????????
# keycloak.cors = true
# https://stackoverflow.com/questions/41137766/keycloak-cors-filter-spring-boot

# This is an extra property that allows retrieving the username of the currently
# logged user from the Principal object
keycloak.principal-attribute = preferred_username

# keycloak.securityConstraints[0].authRoles[0] = user
# keycloak.securityConstraints[0].authRoles[1] = admin
# keycloak.securityConstraints[0].securityCollections[0].patterns[0] = /user

# keycloak.securityConstraints[1].authRoles[0] = admin
# keycloak.securityConstraints[1].securityCollections[0].patterns[0] = /admin

# keycloak.securityConstraints[2].authRoles[0] = user
# keycloak.securityConstraints[2].authRoles[1] = admin
# keycloak.securityConstraints[2].securityCollections[0].patterns[0] = /products

我的Spring Security配置：

@Configuration
@EnableWebSecurity
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

// Avoid prefixing the roles with ROLE_
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
    keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
    auth.authenticationProvider(keycloakAuthenticationProvider);
}

// Use the Spring Boot properties file instead of the default Keycloak Spring Security Adapter keycloak.json file
@Bean
public KeycloakSpringBootConfigResolver KeycloakConfigResolver() {
    return new KeycloakSpringBootConfigResolver();
}

@Bean
@Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
    return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
}

我使用的是Spring Boot2.0。3.释放和Keyclope适配器4.0。0.最终版本

更新：根据下面提供的答案，我用唯一的依赖项配置了KeyClope安全性：

<dependency>
  <groupId>org.keycloak</groupId>
  <artifactId>keycloak-spring-security-adapter</artifactId>
  <version>4.0.0.Final</version>
</dependency>

src/main/webapp/WEB-INF/keydape。json文件包含：

{
    "auth-server-url": "http://localhost:8180/auth",
    "ssl-required": "external",
    "realm": "learnintouch",
    "resource": "learnintouch-web",
    "public-client": "false",
    "credentials": {
        "secret": "??????..."
    },
    "principal-attribute": "preferred_username"
}

路由由一些Spring Security声明保护：

super.configure(http);
http.csrf().disable();
http.authorizeRequests()
.antMatchers("/user*").hasRole("user")
.antMatchers("/admin*").hasRole("admin")
.antMatchers("/products*").hasRole("user")
.anyRequest().permitAll();




Answer 1

要获得更灵活的配置，最好使用Spring Security适配器。它提供了用Java指定配置的能力，而不仅仅是应用程序属性。Spring Boot适配器旨在用作基本配置工具，以便将URI限制为特定角色。

为了使用Spring Security适配器，我首先要删除Spring Boot适配器，因为它们可能会导致冲突。如果您仍然希望使用应用程序属性使您的配置更灵活，那么您可以始终使用Spring Boot标准方式，因为最终，您只是在Spring Boot项目中使用了@configuration类。