如何配置只承载=true时使用spring-boot-starter-oauth2-Client

Question

我正在尝试使用keycloak为我的rest apis在Spring云网关中设置o auth2身份验证。keyclcoak将我的请求重定向到登录页面，同时将访问令牌作为承载令牌传递。在许多地方，我发现解决方案是在keycloak适配器中设置bearer-only=true。在使用spring-boot-starter-oauth2-Client时在哪里设置此项。我无法使用keycloak-spring-boot-starter在application.yml中设置此项

谢谢

Answer 1

我和你有同样的问题。由于没有找到答案，我开发了一个带有light Keyclope客户端的过滤器，该客户端调用Keyclope的Endpoint instrospect来验证令牌

客户：

public class KeycloakClient {

private final KeycloakConfigurationProperties kcProperties;
private final WebClient client;

public KeycloakClient(final KeycloakConfigurationProperties keycloakConfigurationProperties) {
    this.kcProperties = keycloakConfigurationProperties;
    this.client = WebClient.builder()
                           .baseUrl(keycloakConfigurationProperties.getAuth_server_url())
                           .filter(logRequest())
                           .build();
}

public Mono<Boolean> validateBearerToken(String bearerToken) {
    //todo: improve error management
    return prepareAndRunRequest(bearerToken).retrieve()
                                            .bodyToMono(KeycloakValidationResponse.class)
                                            .flatMap(response -> Mono.just(response.getActive()))
                                            .onErrorResume(WebClientResponseException.class,
                                                           ex -> Mono.just(false));
}

private WebClient.RequestHeadersSpec<?> prepareAndRunRequest(String bearerToken) {

    return client.post()
                 .uri(uriBuilder -> uriBuilder.path("/auth/realms/")
                                              .path(kcProperties.getRealm())
                                              .path("/protocol/openid-connect/token/introspect")
                                              .build())
                 .contentType(MediaType.APPLICATION_JSON)
                 .body(BodyInserters.fromFormData("client_id", kcProperties.getResource())
                                    .with("client_secret", kcProperties.getCredentials_secret())
   

过滤器：

public class ValidationTokenGatewayFilterFactory extends AbstractGatewayFilterFactory<ValidationTokenGatewayFilterFactory.Config> {

private final KeycloakClient client;

public ValidationTokenGatewayFilterFactory(KeycloakClient client) {
    super(Config.class);
    this.client = client;
}

@Override
public GatewayFilter apply(Config config) {
    return (exchange, chain) -> {

        String token = exchange.getRequest()
                               .getHeaders()
                               .get(AUTHORIZATION)
                               .get(0);

        token = token.substring(7);

        log.trace("-- ValidationToken(): token={}", token);

        return client.validateBearerToken(token)
                     .flatMap(validated -> {
                         if (validated) {
                             log.debug("-- ValidationToken(): Token valid");
                             return chain.filter(exchange);
                         } else {
                             log.debug("-- ValidationToken(): Token invalid");
                             exchange.getResponse()
                                     .setStatusCode(HttpStatus.UNAUTHORIZED);

                             return exchange.getResponse()
                                            .setComplete();
                         }
                     });
    };
}

public static class Config {
}

}

你可以在这里找到完整的样本：https://gitlab.com/-/snippets/2105967