如何在 Spring Boot 应用程序中使用 Keycloak Policy Enforcer

Question

Keycloak 策略执行器无法与示例 Sprint 启动应用程序一起使用。

我正在使用 Keycloak 版本 6.0.1 并尝试集成示例 Sprint 启动应用程序（Sprint 启动版本 2.1.3）。我的目标是在 Keycloak 中设置策略和权限，并在我的示例 Spring 引导应用程序中使用 Keycloak 策略执行器，以便使用 Keycloak 中定义的适当权限自动执行所有授权决策，并且示例应用程序中不需要代码。

我的 Spring Boot 示例应用程序只是从内存列表中打印用户列表：

public class JPAUserResource {

    @Autowired
    private UserRepository userRepo;

    @GetMapping(path = "/jpausers")
    public List<JPAUser> retrieveAllUsers() {
        return userRepo.findAll();
    }
}

我的 application.properties 文件有以下内容：

server.port=38080
spring.jpa.show-sql=true
spring.h2.console.enabled=true
logging.level.org.springframework.security=DEBUG
logging.level.org.keycloak.adapters.authorization=DEBUG
#Keycloak Configuration
keycloak.auth-server-url=http://192.168.154.190:18180/auth
keycloak.realm=master
keycloak.resource=login-app
keycloak.principal-attribute=preferred_username
keycloak.credentials.secret=195925d6-b258-407d-a65d-f1fd12d7a876
keycloak.policy-enforcer-config.enforcement-mode=enforcing
keycloak.realm-key=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjyYRe6LxBxO9hVtr4ScsMCBp3aPE9qbJLptPIMQCZR6JhVhOxA1kxhRmVYHXR5pdwiQWU8MriRhAY1JGniG6GNS1+BL+JaUiaGxov4rpD2SIMdrs8YjjSoD3Z8wvsMAopzWG48i9T/ppNaqKTkDZHbHAXOYJn+lymQ4EqpQrJ1Uh+SUA8XcLvWUQ12ty9BieujudWhnAgQ4zxyJY3I8sZwjaRIxndzSlyPJo45lWzXkpqcl92eU/Max7LRM4WKqsUvu86DgqlXbJcz8T+GUeF30ONQDSLX9rwNIT4ZiCVMT7x6YfKXZW6jxC0UiXxZuT23xk8A9iCP4rC9xo1NfGTwIDAQAB
keycloak.policy-enforcer-config.paths[0].path=/jpausers
keycloak.policy-enforcer-config.paths[0].methods[0].method=GET

我的 Keycloak 授权设置如下：

{
  "allowRemoteResourceManagement": true,
  "policyEnforcementMode": "ENFORCING",
  "resources": [
    {
      "name": "Default Resource",
      "type": "urn:login-app:resources:default",
      "ownerManagedAccess": false,
      "attributes": {},
      "_id": "501febc8-f3e1-411f-aecf-376b4786c24e",
      "uris": [
        "/*"
      ]
    },
    {
      "name": "jpausers",
      "ownerManagedAccess": false,
      "displayName": "jpausers",
      "attributes": {},
      "_id": "a8f691db-39ef-4b2c-80fb-37224e270f1e",
      "uris": [
        "/jpausers"
      ],
      "scopes": [
        {
          "name": "GET"
        },
        {
          "name": "POST"
        }
      ]
    }
  ],
  "policies": [
    {
      "id": "94518189-3794-451c-9996-eec22543d802",
      "name": "Default Policy",
      "description": "A policy that grants access only for users within this realm",
      "type": "js",
      "logic": "POSITIVE",
      "decisionStrategy": "AFFIRMATIVE",
      "config": {
        "code": "// by default, grants any permission associated with this policy\n$evaluation.grant();\n"
      }
    },
    {
      "id": "0242cf72-365d-49ae-8d5b-4ced24736f24",
      "name": "test_jpa",
      "type": "role",
      "logic": "POSITIVE",
      "decisionStrategy": "UNANIMOUS",
      "config": {
        "roles": "[{\"id\":\"jpa\",\"required\":false}]"
      }
    },
    {
      "id": "5c34e2b4-a56a-45f9-a1cc-94788bcb41b0",
      "name": "test_perm1",
      "type": "resource",
      "logic": "POSITIVE",
      "decisionStrategy": "UNANIMOUS",
      "config": {
        "resources": "[\"jpausers\"]",
        "applyPolicies": "[\"test_jpa\"]"
      }
    }
  ],
  "scopes": [
    {
      "id": "4ee351e6-7095-453a-a4f4-badbc9ec1ba0",
      "name": "GET",
      "displayName": "GET"
    },
    {
      "id": "9119aab2-75a0-49d1-a076-8d9210c3e457",
      "name": "POST",
      "displayName": "POST"
    }
  ]
}

当我向我的 Rest API '/jpausers' 发送请求时，它会失败并在控制台上显示以下消息：

*19:17:52.044 [http-nio-38080-exec-1] INFO  o.k.a.authorization.PolicyEnforcer - Paths provided in configuration.
19:17:52.045 [http-nio-38080-exec-1] DEBUG o.k.a.authorization.PolicyEnforcer - Trying to find resource with uri [/jpausers] for path [/jpausers].
19:17:52.151 [http-nio-38080-exec-1] DEBUG o.k.a.authorization.PolicyEnforcer - Initialization complete. Path configurations:
19:17:52.151 [http-nio-38080-exec-1] DEBUG o.k.a.authorization.PolicyEnforcer - PathConfig{name='null', type='null', path='/jpausers', scopes=[], id='a8f691db-39ef-4b2c-80fb-37224e270f1e', enforcerMode='ENFORCING'}
19:17:52.154 [http-nio-38080-exec-1] DEBUG o.k.a.authorization.PolicyEnforcer - Policy enforcement is enabled. Enforcing policy decisions for path [http://192.168.109.97:38080/jpausers].
19:17:52.156 [http-nio-38080-exec-1] DEBUG o.k.a.a.KeycloakAdapterPolicyEnforcer - Sending challenge
19:17:52.157 [http-nio-38080-exec-1] DEBUG o.k.a.authorization.PolicyEnforcer - Policy enforcement result for path [http://192.168.109.97:38080/jpausers] is : DENIED
19:17:52.157 [http-nio-38080-exec-1] DEBUG o.k.a.authorization.PolicyEnforcer - Returning authorization context with permissions:*

UMA 授权已禁用。我首先使用带有密码凭据授予类型的 Openid Connect 令牌 API 检索了访问令牌，然后我尝试使用访问令牌访问我的 Rest API '/jpausers'。

有人可以在这里帮助解决这个问题吗？我该如何解决 ？我是否必须启用 UMA 才能使策略执行器工作？

Answer 1

通过快速查看，我可以看到您在 application.properties 中的映射不完整，您尚未将 HTTP 方法映射到您在 keycloak 中配置的范围。像这样的东西

keycloak.policy-enforcer-config.paths[0].path=/jpausers
keycloak.policy-enforcer-config.paths[0].methods[0].method=GET 
keycloak.policy-enforcer-config.paths[0].methods[0].scopes[0]=GET

Answer 2

我认为您缺少 keycloak.securityConstraints[0].securityCollections[0].name= jpausers

Answer 3

我遇到了同样的问题，我可以在我的应用程序属性 yaml 文件中使用类似的设置来解决它，如下所示：

    keycloak:
      security-constraints:
        - auth-roles: 
          - "*"
      security-collections:
        - name: 
          patterns:
          - /*