如何使用KeyCloak实现具有基于令牌访问的简单web服务？

Question

我想创建一个以以下方式工作的web服务：

>

客户端控制KeyCloak并提供用户名和密码。

KeyCloak将访问令牌返回给客户端。

private String getAccessToken() throws IOException {
    final CloseableHttpClient client = HttpClients.createDefault();

    final List<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>(4);
    nameValuePairs.add(new BasicNameValuePair("client_id", "test-app"));
    nameValuePairs.add(new BasicNameValuePair("username", "user1"));
    nameValuePairs.add(new BasicNameValuePair("password", "user1"));
    nameValuePairs.add(new BasicNameValuePair("grant_type", "password"));


    try {
        final HttpPost post = new HttpPost("http://localhost:8080/auth/realms/myrealm/protocol/openid-connect/token");
        post.setEntity(new UrlEncodedFormEntity(nameValuePairs));
        post.setHeader("Accept", "application/json");
        post.setHeader("Content-type", "application/x-www-form-urlencoded");

        final CloseableHttpResponse response = client.execute(post);

        final int statusCode = response.getStatusLine().getStatusCode();

        System.out.println(String.format("Result: %d", statusCode));

        if (statusCode != 200) {
            System.out.println("Something went wrong");
            return null;
        }

        final String responseTxt = EntityUtils.toString(response.getEntity());
        final JSONObject json = new JSONObject(responseTxt);

        final String accessToken = json.getString("access_token");
        return accessToken;
    } finally {
        try {
            client.close();
        } catch (final IOException exception) {
            exception.printStackTrace();
        }
    }
}

我使用以下代码来访问它(accesstoken是上一步中的访问令牌）：

    final String targetUrl = "http://127.0.0.1/test";
    final CloseableHttpClient client = HttpClients.createDefault();
    final HttpGet get = new HttpGet(targetUrl);
    get.setHeader("Authorization", String.format("Bearer%s", accessToken));
    final CloseableHttpResponse response = client.execute(get);
    final int statusCode = response.getStatusLine().getStatusCode();
    System.out.println(String.format("Result: %d", statusCode));
    client.close();

当我这样做时，我得到KeyCloak的登录页面作为响应，而不是web服务的响应。

如何配置web服务？

@RestController
public class SampleRestController {
    @RequestMapping("/test")
    public String test() {
        return "Hello, world!";
    }
}

@Configuration
@EnableWebSecurity
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
    @Autowired
    public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {

        KeycloakAuthenticationProvider keycloakAuthenticationProvider
                = keycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(
                new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }
    @Bean
    public KeycloakSpringBootConfigResolver KeycloakConfigResolver() {
        return new KeycloakSpringBootConfigResolver();
    }


    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(
                new SessionRegistryImpl());
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests()
                .antMatchers("/test*")
                .hasRole("user")
                .anyRequest()
                .permitAll();
    }
}

server.port = 8090

spring.main.allow-bean-definition-overriding=true


keycloak.realm = myrealm 
keycloak.auth-server-url = http://127.0.0.1:8080/auth
keycloak.ssl-required = external
keycloak.resource = test-app
keycloak.public-client=true
keycloak.security-constraints[0].authRoles[0]=user
keycloak.security-constraints[0].securityCollections[0].patterns[0]=/test/*

server.port = 8090
spring.main.allow-bean-definition-overriding=true
keycloak.realm = myrealm
keycloak.resource = test-app
keycloak.auth-server-url = http://127.0.0.1:8080/auth
keycloak.bearer-only = true
keycloak.ssl-required = external
keycloak.principal-attribute = preferred_username

Answer 1

您使用了错误的流或目标。如果您想使用登录/密码，您可以选择其中的两个：

>

电流。您尝试访问，您的服务器检查您的登录，如果您没有-重定向到KeyCloak。登录后，keycloak使用access_code（不是token）将您重定向到您的页面（或登录页面--我不记得了）。在此之后，您的服务将此代码发送到keycloak并执行其他操作

将流更改为密码流。在这种情况下，您将向服务发送用户名/密码（而不是Keycloak)，服务将此凭据发送到Keycloak，然后执行其他操作