Keycloak客户端没有访问类型Public的secret可用

Question

我正在使用KeyCloak3.4.3和保护基于Spring的Rest服务。

Client Protocol: openid-connect<br>
Access Type: public<br>
Standard Flow Enabled: ON<br>
Implicit Flow<br>
Direct Access Grants Enabled: ON<br>
Authorization Enabled: OFF<br>

2018-02-28 15:19:10.216警告7813---[nio-8080-exec-2]A.A.ClientIdandSecretCredentialsProvider：客户端“DemoclientId”没有可用的机密2018-02-28 15:19:10.375错误7813---[nio-8080-exec-2]O.K.Adapters.OAuthRequestAuthenticator：未能将代码转换为令牌

java.net.ConnectException：在java.base/java.net.plainsockeTimpl.socketConnect（本机方法）上拒绝连接（拒绝连接）~[na:na]在java.base/java.net.abstractplainsockeTimpl.doConnect（abstractplainsockeTimpl.java:400)~[na:na]在java.base/java.net.abstractplainsockeTimpl.connecttoAddress（cketimpl.java:402)~[na:na]在java.base/java.net.socket.connect(Socket.java:591)~[na:na]在org.apache.http.conn.scheme.plainsocketfactory.connectsocket(plainsocketfactory.java:121)~[httpclient-4.5.5.jar！/:4.5.5]在org.apache.http.impl.conn.defaultclientconnectionoperator.openconnection.java:144)~[httpclient-4.5.5.jar！/:4.5.5]位于org.apache.http.impl。conn.abstractPooledConnAdapter.open(abstractPooledConnAdapter.java:134)~[httpclient-4.5.5.jar！/:4.5.5]在org.apache.http.impl.client.defaultRequestDirector.tryConnect(DefaultRequestDirector.java:610)~[httpclient-4.5.5.jar！/:4.5.5]在org.apache.http.impl.client.defaultRequestDirector.java:610)~[httpclient-4.5.5.jar！/:4.5.5]在.java:835)~[httpclient-4.5.5.jar！/:4.5.5]在org.apache.http.impl.client.closeablehttpclient.java:83)~[httpclient-4.5.5.jar！/:4.5.5]在org.apache.http.impl.client.closeablehttpclient.execute(closeablehttpclient.java:108)~[httpclient-4.5.5.jar！/:4.5.5]在org.apache.http.impl.client.closeablehttpclient.java:56)~[httpclient-4.5.5.jar！/:4.5.5]在org.keycloak.adapters.serverrequest.invokeAccessCodeToken(serverrequest.java:111)~[keycloak-adapter-core-3.4.3.final.jar！/:3.4.3.final]在org.keycloak.adapters.oauthRequestAuthenticator.resolvecode(OAuthRequestAuthenticator.java:336)~[keycloak-adapter-core-3.4.3.final.jar！/:3.4.3.final.jar！/:3.4.3.final]在AbstractKeycloakAuthenticatorValve.authenticateInternal(AbstractKeycloakAuthenticatorValve.java:203)~[spring-boot-container-bundle-3.4.3.final.jar！/:3.4.3.final.jar！/:3.4.3.final]在！/:3.4.3.final]位于org.apache.catalina.authenticator.authenticatorbase.invoke(authenticatorbase.java:586)[tomcat-embed-core-8.5.27.jar！/:8.5.27]在org.keycloak.adapters.tomcat.abstractkeycloakauthenticatorvalve.invoke(abstractkeycloakauthenticatorvalve.java:181)~[spring-boot-container-bundle-3.4.3.final.jar！/:3.4.3.final]在

Answer 1

如果其他人发现了这个问题，答案似乎是公共访问类型只用于使用KeyCloak的UI的浏览器登录。例如，您不能使用带有Keycloak插件的Spring UI--它们必须使用机密访问类型（在这种情况下，您可以在管理UI的Clients部分中获得一个“Credentials”选项卡来提供机密）。

请参见https://www.keycloak.org/docs/4.8/server_admin/#oidc-clients并向下滚动到“访问类型”