Spring Boot中集成Keycloak作为OAuth2提供者

发布时间：2024-11-15 15:52:05 作者：小樊
来源：亿速云阅读：124

在Spring Boot中集成Keycloak作为OAuth2提供者是一个相对简单的过程。以下是一个基本的步骤指南，帮助你完成这个集成：

1. 添加依赖

首先，在你的pom.xml文件中添加Spring Security和Keycloak的依赖。

<dependencies>
    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <!-- Keycloak Spring Boot Starter -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-keycloak-security</artifactId>
    </dependency>

    <!-- Other dependencies -->
    <!-- ... -->
</dependencies>

2. 配置Keycloak

在你的application.yml或application.properties文件中配置Keycloak。

application.yml

spring:
  keycloak:
    auth-server-url: http://localhost:8080/auth
    realm: your-realm
    resource: your-client-id
    credentials:
      secret: your-client-secret
    security-realm: your-security-realm

application.properties

spring.keycloak.auth-server-url=http://localhost:8080/auth
spring.keycloak.realm=your-realm
spring.keycloak.resource=your-client-id
spring.keycloak.credentials.secret=your-client-secret
spring.keycloak.security-realm=your-security-realm

3. 配置Spring Security

创建一个配置类来设置Spring Security和Keycloak的集成。

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
import org.springframework.security.web.firewall.HttpStatusRequestRejectedHandler;
import org.springframework.security.web.firewall.RequestRejectedHandler;
import org.springframework.security.web.servletapi.SecurityMockMvcRequestPostProcessors;
import org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestPostProcessors;
import org.springframework.security.web.util.matcher.AntPathRequest;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    public void configureGlobal(HttpSecurity http) throws Exception {
        http
            .cors().and()
            .csrf().disable()
            .authorizeRequests()
                .antMatchers("/admin/**").hasRole("admin")
                .antMatchers("/user/**").hasAnyRole("admin", "user")
                .anyRequest().authenticated()
            .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .sessionFixation().migrateSession()
                .maximumSessions(1)
                .expiredUrl("/sessionExpired")
                .maxSessionsPreventsLogin(true)
                .sessionRegistry(sessionRegistry());

        http.exceptionHandling()
            .defaultAuthenticationEntryPointFor(new HttpStatusRequestRejectedHandler(HttpStatus.UNAUTHORIZED), new AntPathRequest("/.*"));
    }

    @Bean
    public SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }

    @Bean
    public RequestRejectedHandler requestRejectedHandler() {
        return new HttpStatusRequestRejectedHandler(HttpStatus.UNAUTHORIZED);
    }
}

4. 创建Keycloak客户端

在Keycloak管理控制台中创建一个新的客户端。确保设置正确的客户端ID、客户端密钥和所需的权限。

5. 测试集成

启动你的Spring Boot应用程序，并尝试访问受保护的资源。你应该会被重定向到Keycloak的登录页面。登录成功后，你应该能够访问受保护的资源。

总结

通过以上步骤，你已经成功在Spring Boot中集成了Keycloak作为OAuth2提供者。你可以根据需要进一步配置和扩展这个集成。