在KeyCloak中进行身份验证之前在服务器中设置请求标头

Question

我正在使用基于键斗篷头的身份验证来保护REST API。在那里，我想设置一个请求头字段（基本上是密钥斗篷授权头）之前，编写发生。

另一种解释是：如何获取javax。servlet。在密钥斗篷身份验证之前调用筛选器

在这次尝试中，我尝试调用被覆盖的headerbasedkeydeposeconfigresolver的resolve方法，并对web进行了调整。xml。我可以注意到，它可以在身份验证发生之前调用。我还读取了一些请求头值，但没有setter将请求头设置到那里（toorg.keydepot.adapters.spi.HttpFacade.request）。

在以这种或那种方式进行KeyClope身份验证之前，寻找设置请求头的提示吗？

• 关键的克劳克版本：3.1.0。最终

HeaderBaseKeyClope配置解析程序。JAVA

public class HeaderBasedKeycloakConfigResolver implements KeycloakConfigResolver {

    @Override
    public KeycloakDeployment resolve(Request request) {

        String uri = request.getURI();
        logger.info("resolve().uri : " + uri);

        String auth_key = request.getHeader("auth_key");
        logger.info("resolve().auth_key : " + auth_key);

        request.setHeader("Autherization","<auth value>"); // there's no this like setter

        KeycloakDeployment deployment = cache.get(applicationId);
        --build deployment using the keycloak.json"

        return deployment;
    }

}

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    version="3.0">

    <!-- more security-constraint -->

    <!-- keycloak -->

    <context-param>
        <param-name>keycloak.config.resolver</param-name>
        <param-value>package.to.class.HeaderBasedKeycloakConfigResolver</param-value>
    </context-param>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>REST endpoints</web-resource-name>
            <url-pattern>/ep-name/resource-name</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>resource-name</role-name>
        </auth-constraint>
    </security-constraint>

    <!-- more security-constraint -->
    <!-- more security-constraint -->
    <!-- more security-constraint -->

     <login-config>
        <auth-method>KEYCLOAK</auth-method>
        <realm-name>realm-name</realm-name>
    </login-config>

    <security-role>
        <role-name>role-name-for-resource-1</role-name>
        <role-name>role-name-for-resource-2</role-name>
        <!-- more security-role -->
        <!-- more security-role -->
        <!-- more security-role -->
    </security-role>

    <listener>
        <listener-class>
            org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap</listener-class>
    </listener>

    <servlet>
        <servlet-name>resteasy-servlet</servlet-name>
        <servlet-class>
            org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>resteasy-servlet</servlet-name>
        <url-pattern>/resource-path/*</url-pattern>
    </servlet-mapping>

</web-app>

Answer 1

当您在配置中使用安全约束时，您可以这样做：

public class CustomConstraintSecurityHandler extends ConstraintSecurityHandler{

    @Override
    public void handle(String pathInContext, Request baseRequest, HttpServletRequest request, HttpServletResponse response)
            throws IOException, ServletException{

        try {
            // change the request
            super.handle(pathInContext, baseRequest, request, response);            
        }catch(Exception e) {

        }

    }
}

我以前没有使用过基于xml的配置，但在Java配置中，我使用了ConstraintSecurityHandler类似这样的配置：

    ContextHandlerCollection contexts = new ContextHandlerCollection();
    ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS | ServletContextHandler.SECURITY );
KeycloakJettyAuthenticator kcAuthenticator = // set keycloak through JSON
    CustomConstraintSecurityHandler securityHandler = new CustomConstraintSecurityHandler();
    ConstraintMapping constraintMapping = new ConstraintMapping();
    constraintMapping.setPathSpec("/*");                
    Constraint constraint = new Constraint();           
    constraint.setAuthenticate(true);
    constraint.setRoles(new String[]{"**"});
    constraintMapping.setConstraint(constraint);                
    securityHandler.addConstraintMapping(constraintMapping);                            
    securityHandler.setAuthenticator(kcAuthenticator);
    context.setSecurityHandler(securityHandler);

编辑：

我的答案基于这样一个事实：在调试堆栈跟踪中，ConstraintSecurityHandler位于keydepore身份验证处理程序之前。