keycloak(弹簧启动)未验证REST端点
我正在尝试使用像keycloak这样的开源用户管理服务。构建一个angularJs应用程序,该应用程序将向通过keycloak保护的REST端点发送HTTP请求。我在后端使用了spring启动。我可以调用端点并获得不可能的结果,因为它应该阻止来自未经授权来源的请求。keycloak(弹簧启动)未验证REST端点
这是两个链接,我跟着
2. Github link to keycloak example
控制器,它包括REST端点,用户将调用。与CORS
@RequestMapping(value = "/api/getSample")
public test welcome() {
return new test("sample");
}
@RequestMapping(value = "/check/test")
public test welcome2() {
return new test("test");
}
春季启动应用程序
@SpringBootApplication
public class Application
{
public static void main(String[] args)
{
SpringApplication.run(Application.class, args);
}
@Bean
public FilterRegistrationBean corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("*");
config.addAllowedHeader("*");
config.addAllowedMethod("*");
source.registerCorsConfiguration("/api/*", config);
FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
bean.setOrder(0);
return bean;
}
}
应用程序属性文件
server.port = 8090
keycloak.realm = demo
keycloak.auth-server-url = http://localhost:8080/auth
keycloak.ssl-required = external
keycloak.resource = tutorial-backend
keycloak.bearer-only = true
keycloak.credentials.secret = 111-1111-111-111
keycloak.use-resource-role-mappings = true
keycloak.cors= true
keycloak.securityConstraints[0].securityCollections[0].name = spring secured api
keycloak.securityConstraints[0].securityCollections[0].authRoles[0] = user
keycloak.securityConstraints[0].securityCollections[0].patterns[0] = /api
keycloak.securityConstraints[0].securityCollections[1].name = insecure stuff
keycloak.securityConstraints[0].securityCollections[1].authRoles[0] = user
keycloak.securityConstraints[0].securityCollections[1].patterns[0] = /check
有两种测试用例
制作REST调用无需登录。在这种情况下我能够取回结果。这不应该是这样,我得到应该阻止(得到401错误)。
登录时进行REST调用。我可以调用api/getSample,这是正确的行为。然而,当我打电话检查/测试,我得到
XMLHttpRequest cannot load http://localhost:8090/check/test. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9000' is therefore not allowed access. The response had HTTP status code 403.
你有没有在你的pom.xml添加的春天引导Keycloak适配器依赖。
对于2.您没有为/支票(仅用于/ API)
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-spring-boot-adapter</artifactId>
<version>${keycloak.version}</version>
</dependency>
1)
我不知道你的测试究竟怎么看起来像配置CORS,但也许系统认为你还在登录?您可以尝试删除您的Cookie以确保没有保存访问令牌。
另一种选择可能是Spring Boot无法识别Keycloak适配器,因此无法保护访问。您主要通过添加keycloak-spring-boot-adapter
和keycloak-tomcat8-adapter
依赖关系(more details here)来配置适配器。
2)
它看起来像CORS未正确配置。你可以考虑这个配置的实现(more details here):
@Bean
FilterRegistrationBean corsFilter(
@Value("${tagit.origin:http://localhost:9000}") String origin) {
return new FilterRegistrationBean(new Filter() {
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
String method = request.getMethod();
// this origin value could just as easily have come from a database
response.setHeader("Access-Control-Allow-Origin", origin);
response.setHeader("Access-Control-Allow-Methods",
"POST,GET,PUT,DELETE");
response.setHeader("Access-Control-Max-Age", Long.toString(60 * 60));
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader(
"Access-Control-Allow-Headers",
"Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization");
if ("OPTIONS".equals(method)) {
response.setStatus(HttpStatus.OK.value());
}
else {
chain.doFilter(req, res);
}
}
public void init(FilterConfig filterConfig) {
}
public void destroy() {
}
});
}
ofcourse I have have – krs8888