那些遇到过的问题

Keycloak：无法在 Spring Boot 应用程序中加载 URL

Joh*_*nes 12 spring-boot keycloak

我目前正在尝试开发一个使用 keycloak 保护的 Spring Boot Rest Api。

当我尝试调用必须识别用户的 api 时，出现错误。

错误信息如下：

2020-04-10 16:09:00.324  WARN 44525 --- [nio-8080-exec-7] 
o.keycloak.adapters.KeycloakDeployment   : Failed to load URLs from 
https://{{keycloakserver}}.de/auth/realms/{{realm}}/.well-known/openid-configuration

java.lang.RuntimeException: java.lang.RuntimeException: Stub!
at org.keycloak.adapters.KeycloakDeployment.getClient(KeycloakDeployment.java:327) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.KeycloakDeployment.getOidcConfiguration(KeycloakDeployment.java:219) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.KeycloakDeployment.resolveUrls(KeycloakDeployment.java:178) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.KeycloakDeployment.getRealmInfoUrl(KeycloakDeployment.java:232) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.rotation.AdapterTokenVerifier.createVerifier(AdapterTokenVerifier.java:107) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.rotation.AdapterTokenVerifier.verifyToken(AdapterTokenVerifier.java:47) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.BearerTokenRequestAuthenticator.authenticateToken(BearerTokenRequestAuthenticator.java:103) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.BearerTokenRequestAuthenticator.authenticate(BearerTokenRequestAuthenticator.java:88) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:67) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter.attemptAuthentication(KeycloakAuthenticationProcessingFilter.java:154) [keycloak-spring-security-adapter-9.0.2.jar:9.0.2]
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.doFilter(KeycloakPreAuthActionsFilter.java:96) [keycloak-spring-security-adapter-9.0.2.jar:9.0.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:97) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
Run Code Online (Sandbox Code Playgroud)

我不知道什么Failed to load URLs from意思。当我单击链接并显示配置文件时，我可以访问这一侧。

设置

钥匙斗篷：

Keycloak 服务器位于网络中，因此没有本地主机。

我创建了一个领域 (test-realm)
我创建了一个客户端 (test-client)
我创建了一个用户 (test-user)
我在创建的客户端 (ADMIN) 中有一个角色
我已将角色 (ADMIN) 分配给用户（测试用户）

客户端的客户端协议为openid-connect，访问类型为confidental。

春季启动：

Spring Boot Rest 应用程序在 localhost:8080 上运行。

我添加了applications.properties以下 keycloak 配置。

keycloak.realm={{test-realm}}
keycloak.auth-server-url = https://{{keycloakserver}}.de/auth
keycloak.resource = {{test-client}}
keycloak.ssl-required=external
keycloak.bearer-only=true
keycloak.principal-attribute=preferred_username
keycloak.use-resource-role-mappings = true
Run Code Online (Sandbox Code Playgroud)

为了确保测试用户只能访问一个 api 调用，我使用了以下配置。

 @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests()
                .antMatchers("/getTest")
                .hasRole("ADMIN")
                .anyRequest()
                .authenticated();
    }
Run Code Online (Sandbox Code Playgroud)

测试

当我打电话http://localhost:8080/getTest给邮递员时，我得到了正确的401 Unauthorized.

Authorization然后我使用登录的访问令牌调用相同的 URL test-user。

通过第二次调用，我收到上面的错误消息。

有人知道这件事吗？如果我遗漏了您需要知道的配置值，请询问。

感谢您的帮助。

编辑：

安全配置.java

import org.keycloak.adapters.KeycloakConfigResolver;
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springboot.KeycloakSpringBootProperties;
import org.keycloak.adapters.springsecurity.KeycloakConfiguration;
import org.keycloak.adapters.springsecurity.KeycloakSecurityComponents;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;

/**
 * Created by johannes on 07.04.20 for test App.
 */
@EnableWebSecurity
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
@Configuration
@KeycloakConfiguration
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(
                new SessionRegistryImpl());
    }

    @Bean
    @Primary
    public KeycloakConfigResolver keycloakConfigResolver(KeycloakSpringBootProperties properties) {
        return new CustomKeycloakSpringBootConfigResolver(properties);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests()
                .antMatchers("/getTest")
                .hasRole("ADMIN")
                .anyRequest()
                .authenticated();
    }
}
Run Code Online (Sandbox Code Playgroud)

CustomKeycloakSpringBootConfigResolver：

import org.keycloak.adapters.KeycloakDeployment;
import org.keycloak.adapters.KeycloakDeploymentBuilder;
import org.keycloak.adapters.spi.HttpFacade;
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springboot.KeycloakSpringBootProperties;
import org.springframework.context.annotation.Configuration;

/**
 * Created by johannes on 10.04.20 for test App.*/
@Configuration
public class CustomKeycloakSpringBootConfigResolver extends KeycloakSpringBootConfigResolver {
        private final KeycloakDeployment keycloakDeployment;
    public CustomKeycloakSpringBootConfigResolver(KeycloakSpringBootProperties properties) {

        keycloakDeployment = KeycloakDeploymentBuilder.build(properties);
    }

    @Override
    public KeycloakDeployment resolve(HttpFacade.Request facade) {
        return keycloakDeployment;
    }
}
Run Code Online (Sandbox Code Playgroud)

TestController.java（这只是测试 getter）：

  @GetMapping("/getTest")
    public @ResponseBody ResponseEntity getTest() {

        return ResponseEntity.status(ResponseValues.ITEMDELETEFAILED.getResponseCode()).body(ResponseValues.ITEMDELETEFAILED.getResponseMessage());

    }
Run Code Online (Sandbox Code Playgroud)

请求是通过邮递员发出的，这是代码：

curl --location --request GET 'http://localhost:8080/getTest' \
--header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUI...' \
--header 'Cookie: JSESSIONID=41E8E82178FA181817...'
Run Code Online (Sandbox Code Playgroud)

ROY*_*ROY 9

我也有同样的问题，我尝试在google、stackoverflow等上寻找答案......

最后，我抓住了线索，要使其工作，只需删除pathaskeycloak.auth-server-url而http://192.168.0.119:8080不是http://192.168.0.119:8080/auth或其他东西。

...   : Loaded URLs from http://192.168.0.119:8080/realms/spmia-realm/.well-known/openid-configuration
Run Code Online (Sandbox Code Playgroud) 
keycloak.realm=spmia-realm
keycloak.auth-server-url=http://192.168.0.119:8080
keycloak.ssl-required=external
keycloak.resource=ostock
keycloak.credentials.secret=FnUBprsgArHa7PkmR9HPWeXY0nJ22Ks1
keycloak.use-resource-role-mappings=true
keycloak.bearer-only=true
Run Code Online (Sandbox Code Playgroud) 
...   : Loaded URLs from http://192.168.0.119:8080/realms/spmia-realm/.well-known/openid-configuration
Run Code Online (Sandbox Code Playgroud) 
...
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-spring-boot-starter</artifactId>
        </dependency>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.keycloak.bom</groupId>
                <artifactId>keycloak-adapter-bom</artifactId>
                <version>18.0.0</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
...
Run Code Online (Sandbox Code Playgroud)

Nin*_*ale 7

就我而言：领域名称不正确。它区分大小写。当我将其更改为：

keycloak.realm = demo
Run Code Online (Sandbox Code Playgroud)

我曾写过

keycloak.realm = Demo
Run Code Online (Sandbox Code Playgroud)

Joh*_*nes 0

我自己解决了这个问题。

我注意到我的 Spring Boot sdk 是 android sdk。我不知道这怎么会发生。我把它改成了java sdk，效果非常好。

归档时间：

查看次数：

22476 次

最近记录：

2 年，3 月 前
相关归档
将Spring Boot与gRPC和Protobuf一起使用 35
找不到ID为'org.sonarqube'的插件 10
如何从@ComponentScan包获取接口列表 7
Spring Boot - 从 application.yml 注入 map&lt;Enum,Class&gt; 6
在 Gradle 构建中，启动 Spring boot 应用程序，运行测试，然后停止 Spring boot 应用程序 6
将 CSS 文件添加到 Spring Boot + Spring Security Thymeleaf 文件中 6
使用mapstruct映射Hibernate实体 6
多个DefaultMessageListenerContainer提供单个TaskExecutor/ThreadPool(公平) 5
不可解析的导入POM未找到 5
Spring Webjars定位器和上下文路径 4
难疑归档
如何检查字符串是否包含JavaScript中的子字符串？ 7430
Python有三元条件运算符吗？ 5591
如何从SQL Server中的SELECT更新？ 3546
在CSS中设置cellpadding和cellspacing？ 3210
如何确定数组是否包含Java中的特定值？ 2194
如何在Java中拆分字符串 1564
在jQuery中创建div元素 1500
在C#中调用基础构造函数 1398
检查是否使用jQuery选中了复选框 1122
按ID删除元素 1085