为什么Spring Security在“未找到AuthenticationProvider”的情况下拒绝了我的KeyClope身份验证令牌？

Question

我试图找出为什么我的Spring Boot应用程序拒绝使用带有“No AuthenticationProvider found”错误消息的Keyclope JWT承载令牌。

我在docker compose环境中运行了一些服务：

ui (angular) -> proxy (nginx) -> rest api (spring boot) -> auth service (keycloak)

棱角分明的用户界面从rest服务中提取正确的密钥斗篷客户端，然后毫无问题地进行身份验证。我取回一个JWT令牌，然后转过身来，将它交给标头Authorize： be的其余api。

在rest API中，我可以看到正确的承载令牌作为标头出现：

2022-02-11 01:01:31.411 DEBUG 13 --- [nio-8080-exec-4] o.a.coyote.http11.Http11InputBuffer      : Received [GET /api/v3/accounts HTTP/1.0
X-Real-IP: 192.168.80.1
X-Forwarded-For: 192.168.80.1
Host: rest-api.mylocal.com
Connection: close
Accept: application/json, text/plain, */*
Authorization: Bearer eyJhbGciO...
...
2022-02-11 01:01:31.421 DEBUG 13 --- [nio-8080-exec-4] o.k.adapters.PreAuthActionsHandler       : adminRequest http://rest-api.mylocal.com/api/v3/accounts
...

所以无记名代币就在那里https://jwt.io/我可以验证这是我所期望的：

{
  "exp": 1644515847,
  ...
  "iss": "http://auth-service.mylocal.com/auth/realms/LocalTestRealm",
  ...
  "typ": "Bearer",
  "azp": "LocalTestClient",
  ...
  "allowed-origins": [
    "http://web-ui.mylocal.com"
  ],
  "realm_access": {
    "roles": [
      "offline_access",
      "default-roles-localtestrealm",
      "uma_authorization"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "openid email profile",
  ...
}

其余api继续处理-它联系keycloak服务并提取众所周知的配置：

...
2022-02-11 01:01:33.321  INFO 13 --- [nio-8080-exec-4] o.keycloak.adapters.KeycloakDeployment   : Loaded URLs from http://auth-service.mylocal.com/auth/realms/LocalTestRealm/.well-known/openid-configuration
...

最后，它似乎成功地解析了承载令牌，抓取用户并对其进行身份验证：

2022-02-11 01:01:33.521 DEBUG 13 --- [nio-8080-exec-4] o.a.h.impl.conn.tsccm.ConnPoolByRoute    : Releasing connection [{}->http://auth-service.mylocal.com:80][null]
2022-02-11 01:01:33.521 DEBUG 13 --- [nio-8080-exec-4] o.a.h.impl.conn.tsccm.ConnPoolByRoute    : Pooling connection [{}->http://auth-service.mylocal.com:80][null]; keep alive indefinitely
2022-02-11 01:01:33.521 DEBUG 13 --- [nio-8080-exec-4] o.a.h.impl.conn.tsccm.ConnPoolByRoute    : Notifying no-one, there are no waiting threads
2022-02-11 01:01:33.530 DEBUG 13 --- [nio-8080-exec-4] o.k.a.rotation.JWKPublicKeyLocator       : Realm public keys successfully retrieved for client LocalTestClient. New kids: [8a7dIQFASdC8BHa0mUWwZX7RBBJSeJItdmzah0Ybpcw]
2022-02-11 01:01:33.546 DEBUG 13 --- [nio-8080-exec-4] o.k.a.BearerTokenRequestAuthenticator    : successful authorized
2022-02-11 01:01:33.550 TRACE 13 --- [nio-8080-exec-4] o.k.a.RefreshableKeycloakSecurityContext : checking whether to refresh.
2022-02-11 01:01:33.550 TRACE 13 --- [nio-8080-exec-4] org.keycloak.adapters.AdapterUtils       : useResourceRoleMappings
2022-02-11 01:01:33.550 TRACE 13 --- [nio-8080-exec-4] org.keycloak.adapters.AdapterUtils       : Setting roles:
2022-02-11 01:01:33.555 DEBUG 13 --- [nio-8080-exec-4] a.s.a.SpringSecurityRequestAuthenticator : Completing bearer authentication. Bearer roles: []
2022-02-11 01:01:33.556 DEBUG 13 --- [nio-8080-exec-4] o.k.adapters.RequestAuthenticator        : User 'bf7307ca-9352-4a02-b288-0565e2b57292' invoking 'http://rest-api.mylocal.com/api/v3/accounts' on client 'LocalTestClient'
2022-02-11 01:01:33.556 DEBUG 13 --- [nio-8080-exec-4] o.k.adapters.RequestAuthenticator        : Bearer AUTHENTICATED
2022-02-11 01:01:33.556 DEBUG 13 --- [nio-8080-exec-4] f.KeycloakAuthenticationProcessingFilter : Auth outcome: AUTHENTICATED

然后紧接着失败，出现“找不到AuthenticationProvider”错误：

2022-02-11 01:01:33.559 TRACE 13 --- [nio-8080-exec-4] f.KeycloakAuthenticationProcessingFilter : Failed to process authentication request

org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken
        at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:234) ~[spring-security-core-5.5.1.jar!/:5.5.1]

我不知道它怎么能说承载认证，然后是认证结果：认证，然后是未找到身份验证提供程序...我假设它以某种方式无法将此承载令牌转换为密钥斗篷令牌，即使它肯定来自我的密钥斗篷服务器。

我的应用配置：

@ComponentScan({"com.mycompany"})
@Configuration
@EnableJpaRepositories(basePackages = "com.mycompany")
@EntityScan("com.mycompany")
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
public class ApplicationConfiguration
        extends KeycloakWebSecurityConfigurerAdapter {

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        super.configure(http);

        http
                .authorizeRequests()
                // These paths (comma separated) are allowed to all
                .antMatchers("/api/v3/auth/config").permitAll()
                .and()
                .authorizeRequests()
                // Everything else should be authenticated
                .anyRequest().authenticated()
                .and()
                .csrf().disable();
    }

    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new NullAuthenticatedSessionStrategy();
    }

    @Bean
    public KeycloakConfigResolver keycloakConfigResolver() {
        // This just pulls the Keycloak config from a DB instead of the config file
        return new CustomKeycloakConfigResolver();

        // return new KeycloakSpringBootConfigResolver();
    }
}




Answer 1

缺少KeyClope auth提供程序中自动连线的全局配置：

    @Autowired
    public void configureGlobal(final AuthenticationManagerBuilder auth)
            throws Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider =
                keycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(
                new SimpleAuthorityMapper()
        );
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }