依賴包

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

啟動類

啟動類

@SpringBootApplication
@EnableWebSecurity
public class KeycloakDemoApplication extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http
                .authorizeRequests(a -> a
                        .antMatchers("/", "/error", "/webjars/**").permitAll()
                        .anyRequest().authenticated()
                )
                .exceptionHandling(e -> e
                        .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
                )
                .logout(l -> l
                        .logoutSuccessUrl("/").permitAll()
                )
                .csrf(c -> c
                        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                )
                .oauth2Login();
        // @formatter:on
    }

    public static void main(String[] args) {
        SpringApplication.run(KeycloakDemoApplication.class, args);
    }

}

resources/static/index.html

<div class="container unauthenticated">
    With GitHub: <a href="/oauth2/authorization/keycloak">click here</a>
</div>

spring 配置

核心路徑

• 執(zhí)行首次跳轉(zhuǎn)地址模板: /oauth2/authorization/{registrationId}
• redirectUri: 默認的模板 {baseUrl}/login/oauth2/code/{registrationId}

配置樣本

spring:
  security:
    oauth2:
      client:
        registration:
          keycloak:
            clientId: test
            clientSecret: zwd2yOiUqn0jowH2hrPYJvFsCGWnVZvL
            authorizationGrantType: authorization_code
            redirectUri: http://localhost:8082/login/oauth2/code/keycloak
        provider:
          keycloak:
            authorizationUri: http://localhost:8080/realms/test/protocol/openid-connect/auth
            tokenUri: http://localhost:8080/realms/test/protocol/openid-connect/token
            userInfoUri: http://localhost:8080/realms/test/protocol/openid-connect/userinfo
            userNameAttribute: preferred_username

代碼跟蹤

• DefaultOAuth2AuthorizationRequestResolver: 用于讀取當前 provider 配置, 并執(zhí)行跳轉(zhuǎn)邏輯
• OAuth2LoginAuthenticationFilter: 用于處理callback 的地址, 執(zhí)行 code 換 open id token 的操作
• OAuth2AuthorizationCodeAuthenticationProvider: 用于code 交換 access token, refresh token
• DefaultOAuth2UserService: 用于用戶信息加載
• AuthorizationGrantType: 定義授權(quán)類型

遇到的問題

1. 配置 userNameAttribute: preferred_username 遺漏, 會導(dǎo)致Missing required "user name" attribute name in UserInfoEndpoint for Client Registration

文檔

• oauth2