Question

我有一个嵌入了tomcat的spring-boot应用程序，我使用keycloak-spring-boot-adapter根据以下链接配置我的应用程序

我将我的应用程序打包为Jar，并且每件事情都完美无缺。我的上下文根是

本地主机：8080 /服务/ API / *

并没有问题，所有终点都是安全的。没有身份验证，没有人可以访问API。这是属性

server.contextPath=/service

keycloak.realm = demo
keycloak.resource = client-apps
keycloak.auth-server-url = http://localhost:8180/auth
keycloak.ssl-required = external
keycloak-bearer-only = true
keycloak.credentials.secret = client-apps
keycloak.public-client = true
keycloak.enabled = true
keycloak.use-resource-role-mappings = true
keycloak.securityConstraints[0].authRoles[0] = admin
keycloak.securityConstraints[0].securityCollections[0].name = Secure Mappings
keycloak.securityConstraints[0].securityCollections[0].patterns[0] = /api/*
keycloak.securityConstraints[0].securityCollections[0].patterns[1] = /service/api/*
keycloak.securityConstraints[0].securityCollections[0].patterns[1] = /*/api/*

现在需求变更，我们需要在Tomcat上部署Jar as War。这是POM

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>group</groupId>
    <artifactId>service</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>${packaging.type}</packaging>
    <name>Loan Service</name>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <java.version>1.8</java.version>
        <junit.version>4.12</junit.version>
    </properties>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.5.10.RELEASE</version>
    </parent>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-tomcat</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-spring-boot-starter</artifactId>
        </dependency>

        <!-- <dependency> <groupId>io.github.benas</groupId> <artifactId>random-beans</artifactId> 
            <version>3.7.0</version> </dependency> -->
        <dependency>
            <groupId>org.jsondoc</groupId>
            <artifactId>jsondoc-core</artifactId>
            <version>1.2.19</version>
        </dependency>
    </dependencies>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.keycloak.bom</groupId>
                <artifactId>keycloak-adapter-bom</artifactId>
                <version>3.4.3.Final</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>



    <profiles>
        <profile>
            <id>jar</id>
            <properties>
                <packaging.type>jar</packaging.type>
            </properties>
            <dependencies>
                <dependency>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-tomcat</artifactId>
                </dependency>
            </dependencies>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-maven-plugin</artifactId>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>war</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>
            <properties>
                <packaging.type>war</packaging.type>
            </properties>
            <dependencies>
                <dependency>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-tomcat</artifactId>
                    <scope>provided</scope>
                </dependency>
            </dependencies>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-maven-plugin</artifactId>

                        <!-- <configuration>
                            <webResources>
                                <resource>
                                    <directory>src/main/resources</directory>
                                    <includes>
                                        <include>**/*</include>
                                    </includes>
                                    <targetPath>WEB-INF/classes</targetPath>
                                </resource>
                            </webResources>
                        </configuration> -->
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>

War已成功完成，在tomcat webapps目录上部署后，我的REST端点不再安全。现在Root上下文路径与之前相同

本地主机：8080 /服务/ API / *

您可以在属性文件中看到哪些路径需要安全。现在我已经尝试过，但无法弄清楚这是什么原因？

任何关于钥匙披风和弹簧靴的专家都可以帮助我解决我失踪或我做错的地方。

项目结构：

Spring Boot配置：

@SpringBootApplication
public class Application extends SpringBootServletInitializer{

    @Autowired
    private MessageSource messageSource;

    public static void main(String[] args) {
        new SpringApplicationBuilder(Application.class)
        .properties("spring.config.name=application,master-data")
        .run(args);
    }

    @Override
    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
        return application.sources(Application.class).properties("spring.config.name=application,master-data");
    }

    @Bean
    @Scope(scopeName = WebApplicationContext.SCOPE_REQUEST, proxyMode = ScopedProxyMode.TARGET_CLASS)
    public AccessToken getAccessToken() {
        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes())
                .getRequest();
        return ((KeycloakPrincipal<?>) request.getUserPrincipal()).getKeycloakSecurityContext().getToken();
    }

    @Bean
    public LocalValidatorFactoryBean validator() {
        LocalValidatorFactoryBean bean = new LocalValidatorFactoryBean();
        bean.setValidationMessageSource(messageSource);
        return bean;
    }

}

Answer 1

问题是您的新Root上下文：host：port / service / api / *与/ api /中的Rest端点不匹配。那有意义吗？您的上下文中有额外的路径[port]。这就是把它扔掉的原因。

Answer 2

我的建议是切换到Spring Security Adapter。使用此适配器，您可以以更灵活的方式执行Spring Boot Adapter所执行的所有操作（以及更多）。您只需要编写一些配置代码。

与您的问题相关，here您有一个讨论类似于您的问题的线程，这个问题引发了JIRA问题（我无法找到该链接，虽然）。它已经有几年了，但KC团队成员表示他们甚至没有尝试过这种情况（Spring Boot Adapter + War部署）。

Spring Boot应用程序的REST端点作为带有keycloak的tomcat上的WAR不再安全

2 个答案: