将领域角色和资源角色与KeyClope/SpringSecurity一起使用

Question

我试图在一个带有spring security和KeyClope的java应用程序中同时使用领域和资源角色。不幸的是，KeyClope只会返回一个或另一个，具体取决于：

keycloak.use-resource-role-mappings=true

您仍然可以通过自定义代码获得这两种方法，但它会弄乱@PreAuthorize或spring boot方法等注释。isUserInRole，这会导致难看的代码。

有没有办法覆盖@PreAuthorize方法或JSON令牌Keycloak返回，以便同时使用领域和资源角色？目前，我的keyclok实现在每个方法的开头使用一个自定义方法来替换@PreAuthorize，这并不漂亮。

提前谢谢你。

Answer 1

当我在SecurityConfig中使用KeyClope AuthenticationProvider时，它成功地覆盖了KeyClope AuthenticationProvider。以下是自定义提供程序的代码

public class CustomKeycloakAuthenticationProvider extends KeycloakAuthenticationProvider {
    private GrantedAuthoritiesMapper grantedAuthoritiesMapper;

    public void setGrantedAuthoritiesMapper(GrantedAuthoritiesMapper grantedAuthoritiesMapper) {
        this.grantedAuthoritiesMapper = grantedAuthoritiesMapper;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        KeycloakAuthenticationToken token = (KeycloakAuthenticationToken) authentication;
        List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();

        for (String role : token.getAccount().getRoles()) {
            grantedAuthorities.add(new KeycloakRole(role));
        }

// ADDING THE MODIFICATION AND ENABLING ROLE FROM RESSOURCE

        for (String role : token.getAccount().getKeycloakSecurityContext().getToken().getResourceAccess("CustomApplication").getRoles()) {
            grantedAuthorities.add(new KeycloakRole(role));
        }
        return new KeycloakAuthenticationToken(token.getAccount(), token.isInteractive(), mapAuthorities(grantedAuthorities));
    }

    private Collection<? extends GrantedAuthority> mapAuthorities(
            Collection<? extends GrantedAuthority> authorities) {
        return grantedAuthoritiesMapper != null
            ? grantedAuthoritiesMapper.mapAuthorities(authorities)
            : authorities;
    }

    @Override
    public boolean supports(Class<?> aClass) {
        return KeycloakAuthenticationToken.class.isAssignableFrom(aClass);
    }


}

以及SecurityConfig中的修改

@Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) {
        CustomKeycloakAuthenticationProvider keycloakAuthenticationProvider = CustomKeycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    private CustomKeycloakAuthenticationProvider CustomKeycloakAuthenticationProvider() {
        return new CustomKeycloakAuthenticationProvider();
    }

谢谢你的帮助亚历山大！