如何从端点排除 keycloak 安全性？答案

【问题标题】：How can I exclude keycloak security from an endpoint?如何从端点排除 keycloak 安全性？
【发布时间】：2020-03-04 19:44:04
【问题描述】：

我正在尝试将 keycloak 与 spring boot 应用程序集成，但我遇到了一些问题。我正在尝试定义一些应从 keycloak 验证中排除的端点，并让每个人都向这些端点发出请求，但事实并非如此工作。

这是我的配置：

keycloak.realm=spring-security-quickstart
keycloak.auth-server-url=######
keycloak.ssl-required=external
keycloak.resource=app-authz-spring-security
keycloak.bearer-only=true
keycloak.credentials.secret=secret

keycloak.securityConstraints[0].authRoles[0]=user
keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/testUser

keycloak.securityConstraints[1].authRoles[0]=offline_access
keycloak.securityConstraints[1].securityCollections[0].patterns[0]=/testAdmin

keycloak.securityConstraints[2].authRoles[0]=offline_access
keycloak.securityConstraints[2].securityCollections[0].patterns[0]=/testResource

keycloak.securityConstraints[3].authRoles[0]=*
keycloak.securityConstraints[3].securityCollections[0].patterns[0]=/test


keycloak.policy-enforcer-config.lazy-load-paths=true

logging.level.root=DEBUG
logging.level.org.springframework.boot=DEBUG
spring.main.banner-mode=CONSOLE

我尝试使用通配符，但每当我调用 /test 端点时，它都会给我 403 禁止:(

在我的控制台中我看到了这个：

2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] o.a.tomcat.util.net.SocketWrapperBase    : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read from buffer: [0]
2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read direct from socket: [230]
2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] o.a.coyote.http11.Http11InputBuffer      : Received [GET /test HTTP/1.1
User-Agent: PostmanRuntime/7.22.0
Accept: */*
Cache-Control: no-cache
Postman-Token: c9cb4fdc-af21-40a3-bff0-8463c81e01d6
Host: localhost:8762
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

]
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.adapters.PreAuthActionsHandler       : adminRequest http://localhost:8762/test
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase    : Security checking request GET /test
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase      :   Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase      :   Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase      :   Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase      :   Checking constraint 'SecurityConstraint[null]' against GET /test --> true
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase    : Calling hasUserDataPermission()
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase      :   User data constraint has no restrictions
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase    : Calling authenticate()
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.adapters.RequestAuthenticator        : NOT_ATTEMPTED: bearer only
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer       : Policy enforcement is enabled. Enforcing policy decisions for path [http://localhost:8762/test].
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.a.KeycloakAdapterPolicyEnforcer    : Sending challenge
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer       : Policy enforcement result for path [http://localhost:8762/test] is : DENIED
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer       : Returning authorization context with permissions:
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase    : Failed authenticate() test
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] o.a.tomcat.util.net.SocketWrapperBase    : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read from buffer: [0]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read direct from socket: [0]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] o.apache.coyote.http11.Http11Processor   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Status in: [OPEN_READ], State out: [OPEN]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint   : Registered read interest for [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]]

问题出在哪里？是因为我在没有令牌的情况下提出了请求？还是因为政策执行者？另外，我是否需要对 keyloak 仪表板进行任何更改？

【问题讨论】：

标签： spring-boot spring-security keycloak

【解决方案1】：

看起来您只需删除“/test”端点即可：

keycloak.securityConstraints[3].authRoles[0]=*
keycloak.securityConstraints[3].securityCollections[0].patterns[0]=/test

这是一个很好的公共和安全端点示例： service-springboot-rest

【讨论】：

我有类似的问题，但是当启用策略执行器时它返回 403，否则可以正常工作。 keycloak.policy-enforcer-config.lazy-load-paths=true

【解决方案2】：

要使/test 不安全，您可以执行以下操作：

keycloak.securityConstraints[3].securityCollections[0].name=insecure
keycloak.securityConstraints[3].securityCollections[0].patterns[0]=/test

keycloak.policy-enforcer-config.enforcement-mode=PERMISSIVE
keycloak.policy-enforcer-config.paths[0].name=Insecure Resource
keycloak.policy-enforcer-config.paths[0].path=/test
keycloak.policy-enforcer-config.paths[0].enforcement-mode=DISABLED

【讨论】：