Fatal编程技术网
  • spring-boot/
  • Spring boot KeyClope:无法在Spring启动应用程序中加载URL

Spring boot KeyClope:无法在Spring启动应用程序中加载URL

spring-boot keycloak

Spring boot KeyClope:无法在Spring启动应用程序中加载URL,spring-boot,keycloak,Spring Boot,Keycloak,我目前正在尝试开发一个SpringBootRESTAPI，该Api由KeyClope保护 当我试图调用一个必须识别用户的api时，我遇到了一个错误 错误消息如下： 2020-04-10 16:09:00.324 WARN 44525 --- [nio-8080-exec-7] o.keycloak.adapters.KeycloakDeployment : Failed to load URLs from https://{{keycloakserver}}.de/auth/realm

我目前正在尝试开发一个SpringBootRESTAPI，该Api由KeyClope保护

当我试图调用一个必须识别用户的api时，我遇到了一个错误

错误消息如下：

2020-04-10 16:09:00.324  WARN 44525 --- [nio-8080-exec-7] 
o.keycloak.adapters.KeycloakDeployment   : Failed to load URLs from 
https://{{keycloakserver}}.de/auth/realms/{{realm}}/.well-known/openid-configuration

java.lang.RuntimeException: java.lang.RuntimeException: Stub!
at org.keycloak.adapters.KeycloakDeployment.getClient(KeycloakDeployment.java:327) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.KeycloakDeployment.getOidcConfiguration(KeycloakDeployment.java:219) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.KeycloakDeployment.resolveUrls(KeycloakDeployment.java:178) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.KeycloakDeployment.getRealmInfoUrl(KeycloakDeployment.java:232) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.rotation.AdapterTokenVerifier.createVerifier(AdapterTokenVerifier.java:107) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.rotation.AdapterTokenVerifier.verifyToken(AdapterTokenVerifier.java:47) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.BearerTokenRequestAuthenticator.authenticateToken(BearerTokenRequestAuthenticator.java:103) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.BearerTokenRequestAuthenticator.authenticate(BearerTokenRequestAuthenticator.java:88) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:67) [keycloak-adapter-core-9.0.2.jar:9.0.2]
at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter.attemptAuthentication(KeycloakAuthenticationProcessingFilter.java:154) [keycloak-spring-security-adapter-9.0.2.jar:9.0.2]
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.doFilter(KeycloakPreAuthActionsFilter.java:96) [keycloak-spring-security-adapter-9.0.2.jar:9.0.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:97) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.1.10.RELEASE.jar:5.1.10.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
我不知道从加载URL失败意味着什么。当我点击链接并显示配置文件时，我可以访问这一侧

设置

钥匙斗篷：

KeyClope服务器位于web中，因此没有本地主机

我创建了一个领域（测试领域）
我创建了一个客户端（测试客户端）
我创建了一个用户（测试用户）
我在创建的客户端（管理员）中有一个角色
我已将角色（管理员）分配给用户（测试用户）

客户端的客户端协议为
openid connect
，访问类型为
confidental

弹簧靴：

Spring引导rest应用程序正在本地主机8080上运行

我在下面的KeyClope配置中添加了
applications.properties

keycloak.realm={{test-realm}}
keycloak.auth-server-url = https://{{keycloakserver}}.de/auth
keycloak.resource = {{test-client}}
keycloak.ssl-required=external
keycloak.bearer-only=true
keycloak.principal-attribute=preferred_username
keycloak.use-resource-role-mappings = true
为了确保测试用户只能访问一个api调用，我使用以下配置

 @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests()
                .antMatchers("/getTest")
                .hasRole("ADMIN")
                .anyRequest()
                .authenticated();
    }
测试

当我呼叫
http://localhost:8080/getTest
有了邮递员，我得到了一个正确的
401

然后，我用
授权
和登录的
测试用户的访问令牌调用了相同的URL

通过第二次呼叫，我得到了上面的错误消息

有人知道这件事吗？
如果我遗漏了您需要知道的配置值，只需询问

谢谢你的帮助

编辑：

SecurityConfig.java


import org.keycloak.adapters.KeycloakConfigResolver;
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springboot.KeycloakSpringBootProperties;
import org.keycloak.adapters.springsecurity.KeycloakConfiguration;
import org.keycloak.adapters.springsecurity.KeycloakSecurityComponents;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;

/**
 * Created by johannes on 07.04.20 for test App.
 */
@EnableWebSecurity
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
@Configuration
@KeycloakConfiguration
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(
                new SessionRegistryImpl());
    }

    @Bean
    @Primary
    public KeycloakConfigResolver keycloakConfigResolver(KeycloakSpringBootProperties properties) {
        return new CustomKeycloakSpringBootConfigResolver(properties);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests()
                .antMatchers("/getTest")
                .hasRole("ADMIN")
                .anyRequest()
                .authenticated();
    }
}


CustomKeyClope SpringBootConfigResolver：


import org.keycloak.adapters.KeycloakDeployment;
import org.keycloak.adapters.KeycloakDeploymentBuilder;
import org.keycloak.adapters.spi.HttpFacade;
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springboot.KeycloakSpringBootProperties;
import org.springframework.context.annotation.Configuration;

/**
 * Created by johannes on 10.04.20 for test App.*/
@Configuration
public class CustomKeycloakSpringBootConfigResolver extends KeycloakSpringBootConfigResolver {
        private final KeycloakDeployment keycloakDeployment;
    public CustomKeycloakSpringBootConfigResolver(KeycloakSpringBootProperties properties) {

        keycloakDeployment = KeycloakDeploymentBuilder.build(properties);
    }

    @Override
    public KeycloakDeployment resolve(HttpFacade.Request facade) {
        return keycloakDeployment;
    }
}


java（这只是测试获取程序）：

请求是由邮递员提出的，代码如下：


curl --location --request GET 'http://localhost:8080/getTest' \
--header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUI...' \
--header 'Cookie: JSESSIONID=41E8E82178FA181817...'



尝试将
hasRole
更改为
hasAuthority
，或在角色之前添加前缀
ROLE\u
，例如
hasRole（“ROLE\u ADMIN”）
我自己解决了这个问题

我注意到我的spring boot sdk是一个android sdk。我不知道这怎么会发生。

我把它改成了java sdk，它工作起来很有魅力。
在我的例子中：域名不正确。它区分大小写。当我将其更改为：


keycloak.realm = demo


我写过


keycloak.realm = Demo



我也有类似的问题。在我的例子中，我没有意识到在application.properties文件中的“keydove.auth服务器url”末尾有一个空格

通过这种方式，KeyClope适配器试图访问无效的URL


可能这有助于有类似问题的人找到此线程。
我也有同样的问题，对我来说，它还与有缺陷的配置值相连接


keydepot.auth-server-url=https://{{keydeposerver}}.de/auth


首先我忘记了
/auth
，然后我使用了
http
，而不是
https
仍然一样。我得到一个响应代码500，我的spring后端抛出“未能从https://{keydeposerver}.de/auth/realms/{realm}/{realm}/.well-known/openid配置加载URL”错误你能分享控制器代码和你是如何提出请求的吗？我用代码更新了我的初始问题。谢谢你的帮助。

keycloak.realm = Demo