无法访问受KeyCloak-Quarkus保护的资源

Question

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-resteasy</artifactId>
    <version>1.13.6.Final</version>
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-resteasy-jackson</artifactId>
    <version>1.13.6.Final</version>
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-oidc</artifactId>
    <version>1.13.6.Final</version>
</dependency>

# CORS configuration
quarkus.http.cors=true
quarkus.http.cors.access-control-allow-credentials=true
quarkus.http.cors.headers=accept, origin, authorization, content-type, x-requested-with

# OpenId Connect configuration
quarkus.oidc.auth-server-url=http://keycloak-myproject.192.168.1.110.nip.io/auth/realms/secured-realm
quarkus.oidc.tls.verification=none
quarkus.oidc.tenant-enabled=false

# Logging configuration
quarkus.log.level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".min-level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".level=TRACE

# resteasy security configuration
resteasy.role.based.security=true

import io.quarkus.security.identity.SecurityIdentity;
import javax.annotation.security.RolesAllowed;
import javax.inject.Inject;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;
import org.eclipse.microprofile.jwt.JsonWebToken;
import org.jboss.resteasy.annotations.cache.NoCache;

@Path("/api")
public class SecuredResource {

  @Inject
  SecurityIdentity identity;

  @Inject
  JsonWebToken jwt;

  @GET
  @RolesAllowed("USERS")
  @NoCache
  @Path("/secured")
  @Produces(MediaType.TEXT_PLAIN)
  public String secured() {
    String userName = identity.getPrincipal().getName();
    return userName;
  }

}

从quarkus集装箱码头，我可以使用以下命令访问keycloak服务器

curl -v -X GET $keycloak_url -H "Authorization: Bearer "$access_token

返回200状态；但无法访问受保护的资源。

我在这里做错了什么？

Answer 1

http://keycloak-myproject.192.168.1.110.nip.io/auth/realms/secured-realm

您确定该url存在吗？

你试着进入它了吗？成功了吗？

因为，当我尝试访问服务器上类似的url时：

https://users.skycomposer.net/auth/realms/secured-realm

#Keycloak Configuration
keycloak.auth-server-url=https://users.skycomposer.net/auth
keycloak.realm=SpringBootKeycloak
keycloak.resource=login-app
keycloak.public-client=true

附言。如果此配置没有帮助，那么，请为您的Quarkus应用程序提供安全配置。

我对Spring Boot应用程序的安全配置如下所示：

@Configuration
@EnableWebSecurity
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
    // Submits the KeycloakAuthenticationProvider to the AuthenticationManager
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Bean
    public KeycloakSpringBootConfigResolver KeycloakConfigResolver() {
        return new KeycloakSpringBootConfigResolver();
    }

    // Specifies the session authentication strategy
    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests()
            .antMatchers("/customers*", "/users*")
            .hasRole("user")
            .anyRequest()
            .permitAll();
    }
}

但对Quarkus来说，当然应该有所不同。在任何情况下，您的Quarkus安全配置都可能有助于找到问题的原因。