【发布时间】：2022-12-14 22:50:47
【问题描述】：
我有以下情况。一些用户通过直接访问授权获得了我的后端服务的授权，但那些管理员与另一个客户端和领域在第二个 Keycloak 上，我也需要能够为他们的第一个 Keycloak 获取有效令牌.我在第一个 Keycloak 的身份提供者中向管理员注册了第二个 Keycloak，如果我使用第一个的正常 Web 工作流程，我可以使用管理员用户登录，但我留在第一个 Keycloak 的页面上，我可以在我的后端获取该用户的令牌。如果我尝试更改 redirect_uri，我会收到不允许这样做的错误，即使我将 * 放在第二个客户端中也是如此。这些是我对两个 Keycloaks 的设置。
如何从第二个 Keycloak 中为用户获取在第一个 Keycloak 中也有效的令牌？
第一个 Keycloak Identity Provider 设置：
"identityProviders": [
{
"alias": "keycloak-oidc",
"internalId": "c3a3b1db-65ee-49df-b517-bfba6c355696",
"providerId": "keycloak-oidc",
"enabled": true,
"updateProfileFirstLoginMode": "on",
"trustEmail": false,
"storeToken": true,
"addReadTokenRoleOnCreate": true,
"authenticateByDefault": false,
"linkOnly": false,
"firstBrokerLoginFlowAlias": "first broker login",
"config": {
"userInfoUrl": "http://host.docker.internal:909/auth/realms/vrp-realm-adm/protocol/openid-connect/userinfo",
"hideOnLoginPage": "false",
"clientId": "vrp-client-adm",
"tokenUrl": "http://host.docker.internal:909/auth/realms/vrp-realm-adm/protocol/openid-connect/token",
"acceptsPromptNoneForwardFromClient": "false",
"backchannelSupported": "false",
"useJwksUrl": "true",
"loginHint": "false",
"authorizationUrl": "http://host.docker.internal:909/auth/realms/vrp-realm-adm/protocol/openid-connect/auth",
"clientAuthMethod": "client_secret_post",
"logoutUrl": "http://host.docker.internal:909/auth/realms/vrp-realm-adm/protocol/openid-connect/logout",
"syncMode": "IMPORT",
"clientSecret": "**********"
}
}
第二个Keycloak客户端设置：
{
"id": "f873a96c-6468-4737-b576-bdf610fb9597",
"clientId": "vrp-client-adm",
"rootUrl": "http://localhost:808",
"adminUrl": "http://localhost:808",
"surrogateAuthRequired": false,
"enabled": true,
"alwaysDisplayInConsole": false,
"clientAuthenticatorType": "client-secret",
"secret": "**********",
"redirectUris": [
"*"
],
"webOrigins": [
"*"
],
"notBefore": 0,
"bearerOnly": false,
"consentRequired": false,
"standardFlowEnabled": false,
"implicitFlowEnabled": true,
"directAccessGrantsEnabled": true,
"serviceAccountsEnabled": true,
"publicClient": false,
"frontchannelLogout": false,
"protocol": "openid-connect",
"attributes": {
"saml.multivalued.roles": "false",
"saml.force.post.binding": "false",
"frontchannel.logout.session.required": "false",
"oauth2.device.authorization.grant.enabled": "false",
"backchannel.logout.revoke.offline.tokens": "false",
"saml.server.signature.keyinfo.ext": "false",
"use.refresh.tokens": "true",
"oidc.ciba.grant.enabled": "true",
"backchannel.logout.session.required": "true",
"client_credentials.use_refresh_token": "false",
"saml.client.signature": "false",
"require.pushed.authorization.requests": "false",
"saml.allow.ecp.flow": "false",
"saml.assertion.signature": "false",
"id.token.as.detached.signature": "false",
"client.secret.creation.time": "1668867137",
"saml.encrypt": "false",
"saml.server.signature": "false",
"exclude.session.state.from.auth.response": "false",
"saml.artifact.binding": "false",
"saml_force_name_id_format": "false",
"tls.client.certificate.bound.access.tokens": "false",
"acr.loa.map": "{}",
"saml.authnstatement": "false",
"display.on.consent.screen": "false",
"token.response.type.bearer.lower-case": "false",
"saml.onetimeuse.condition": "false"
},
"authenticationFlowBindingOverrides": {},
"fullScopeAllowed": true,
"nodeReRegistrationTimeout": -1,
"protocolMappers": [
{
"id": "6e02e265-af71-4af2-9253-ac26051053a4",
"name": "Client IP Address",
"protocol": "openid-connect",
"protocolMapper": "oidc-usersessionmodel-note-mapper",
"consentRequired": false,
"config": {
"user.session.note": "clientAddress",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "clientAddress",
"jsonType.label": "String"
}
},
{
"id": "2173ad2e-953d-401a-816b-19d920f7fa16",
"name": "Client ID",
"protocol": "openid-connect",
"protocolMapper": "oidc-usersessionmodel-note-mapper",
"consentRequired": false,
"config": {
"user.session.note": "clientId",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "clientId",
"jsonType.label": "String"
}
},
{
"id": "2aad6645-174c-4dcd-b711-4eb388dbac3e",
"name": "Client Host",
"protocol": "openid-connect",
"protocolMapper": "oidc-usersessionmodel-note-mapper",
"consentRequired": false,
"config": {
"user.session.note": "clientHost",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "clientHost",
"jsonType.label": "String"
}
}
],
"defaultClientScopes": [
"web-origins",
"acr",
"profile",
"roles",
"email"
],
"optionalClientScopes": [
"address",
"phone",
"offline_access",
"microprofile-jwt"
]
}
【问题讨论】：
标签： java api authentication keycloak access-token