鍚姩鏃墮厤緗笉閫氳繃localhost璁塊棶鎺у埗鍙幫細
#! /bin/bash
BIN_PATH=$(cd `dirname $0`; pwd)
IP=10.10.27.69
KEYCLOAK_OPT="-b ${IP} -Djboss.bind.address.management=${IP} -Dkeycloak.profile.feature.upload_scripts=enabled"
KEYCLOAK_OPT="${KEYCLOAK_OPT} -Djboss.socket.binding.port-offset=100 -Dkeycloak.frontendUrl=http://${IP}:81/auth "
#-Dkeycloak.hostname=${IP} -Dkeycloak.httpPort=81 -Dkeycloak.httpsPort=82
nohup ${BIN_PATH}/bin/standalone.sh ${KEYCLOAK_OPT} > /dev/null &
BIN_PATH=$(cd `dirname $0`; pwd)
IP=10.10.27.69
KEYCLOAK_OPT="-b ${IP} -Djboss.bind.address.management=${IP} -Dkeycloak.profile.feature.upload_scripts=enabled"
KEYCLOAK_OPT="${KEYCLOAK_OPT} -Djboss.socket.binding.port-offset=100 -Dkeycloak.frontendUrl=http://${IP}:81/auth "
#-Dkeycloak.hostname=${IP} -Dkeycloak.httpPort=81 -Dkeycloak.httpsPort=82
nohup ${BIN_PATH}/bin/standalone.sh ${KEYCLOAK_OPT} > /dev/null &
鏇存敼KEYCLOAK鐨凞ATASOURCE鏃訛紝鍙洿鎺ユ洿鏀歸粯璁ょ殑鑰屾棤闇閲嶆柊閰嶇疆錛?br />https://medium.com/@pratik.dandavate/setting-up-keycloak-standalone-with-mysql-database-7ebb614cc229
KEYCLOAK鐨凧BOSS綆＄悊鐣岄潰鍦板潃鏀逛負闈濴OCALHOST錛?br />
-Djboss.bind.address.management=${IP}
濡傛灉鏄敱NGINX榪囨潵鐨勮闂紝榪欐牱鍓嶇鐨勫湴鍧鏄拰榛樿鐨勪笉涓鏍鳳紝闇閰嶇疆鍓嶇URL錛?br />
-Dkeycloak.frontendUrl=http://${IP}:81/auth
鏇存敼JVM澶у皬standalone.conf錛?br />
#
# Specify options to pass to the Java VM.
#
JBOSS_JAVA_SIZING="-server -Xms3G -Xmx3G -Xmn512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m"
# Specify options to pass to the Java VM.
#
JBOSS_JAVA_SIZING="-server -Xms3G -Xmx3G -Xmn512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m"
REFERENCE:
https://www.keycloak.org/docs/latest/server_installation/index.html#_hostname
]]>
]]>
"resource_access": {
"app-springboot-confidential": {
"roles": [
"user"
]
},
"test-employee-service": {
"roles": [
"READ_EMPLOYEE"
]
},
"service-springboot": {
"roles": [
"READ_PRODUCTS"
]
},
"account": {
"roles": [
"manage-account",
"manage-account-links"
]
},
"test-department-service": {
"roles": [
"READ_DEPARTMENT"
]
}
}
"app-springboot-confidential": {
"roles": [
"user"
]
},
"test-employee-service": {
"roles": [
"READ_EMPLOYEE"
]
},
"service-springboot": {
"roles": [
"READ_PRODUCTS"
]
},
"account": {
"roles": [
"manage-account",
"manage-account-links"
]
},
"test-department-service": {
"roles": [
"READ_DEPARTMENT"
]
}
}
- 闇瑕佸皢鏉冮檺鐨勪俊鎭緭鍑哄埌涓涓狵EY涓紝榪欐椂鍙互鏂板鑷畾涔塁LIENT SCOPE銆侻apper涓柊澧濳EYCLOAK宸插唴緗殑銆恟ealm roles/client roles銆戯紝瀹氫箟杈撳嚭鍒癑TW鐨勫瓧孌靛悕錛歮y-roles銆?/li>
- 鎺堟潈鍝簺CLIENT鍙互璇誨彇姝LIENT SCOPE.
- 鍦ㄧ櫥褰曞弬鏁皊cope涓紝鍔犲叆姝ゅ鹼細my-roles錛岃繖鏍峰湪杈撳嚭鐨凧WT灝變細浠ュ鉤闈㈢殑鏂瑰紡杈撳嚭鎵鏈塺oles
"my-roles": [
"user",
"READ_EMPLOYEE",
"READ_PRODUCTS",
"manage-account",
"manage-account-links",
"READ_DEPARTMENT",
"offline_access",
"user"
]
"user",
"READ_EMPLOYEE",
"READ_PRODUCTS",
"manage-account",
"manage-account-links",
"READ_DEPARTMENT",
"offline_access",
"user"
]
- SPRING SECURITY涓彇鍑烘潈闄愪俊鎭細
@Bean
public ReactiveJwtAuthenticationConverter jwtAuthenticationConverter(ObjectMapper objectMapper) {
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("my-roles");
// KeycloakRealmRoleConverter keycloakRealmRoleConverter = new KeycloakRealmRoleConverter(objectMapper);
ReactiveJwtGrantedAuthoritiesConverterAdapter reactiveJwtGrantedAuthoritiesConverterAdapter =
new ReactiveJwtGrantedAuthoritiesConverterAdapter(
// new KeycloakRealmRoleConverter(objectMapper);
jwtGrantedAuthoritiesConverter
);
ReactiveJwtAuthenticationConverter jwtConverter = new ReactiveJwtAuthenticationConverter();
jwtConverter.setJwtGrantedAuthoritiesConverter(reactiveJwtGrantedAuthoritiesConverterAdapter);
return jwtConverter;
}
public ReactiveJwtAuthenticationConverter jwtAuthenticationConverter(ObjectMapper objectMapper) {
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("my-roles");
// KeycloakRealmRoleConverter keycloakRealmRoleConverter = new KeycloakRealmRoleConverter(objectMapper);
ReactiveJwtGrantedAuthoritiesConverterAdapter reactiveJwtGrantedAuthoritiesConverterAdapter =
new ReactiveJwtGrantedAuthoritiesConverterAdapter(
// new KeycloakRealmRoleConverter(objectMapper);
jwtGrantedAuthoritiesConverter
);
ReactiveJwtAuthenticationConverter jwtConverter = new ReactiveJwtAuthenticationConverter();
jwtConverter.setJwtGrantedAuthoritiesConverter(reactiveJwtGrantedAuthoritiesConverterAdapter);
return jwtConverter;
}
- 鍒ゆ柇鏄惁鏈夋潈闄?/li>
ServerHttpSecurity
.authorizeExchange(
a -> a.pathMatchers("/", "/error").permitAll()
.matchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
.pathMatchers(HttpMethod.GET, "/protected/**").hasRole("READ_DEPARTMENT")
.anyExchange()
.authenticated()
)
.authorizeExchange(
a -> a.pathMatchers("/", "/error").permitAll()
.matchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
.pathMatchers(HttpMethod.GET, "/protected/**").hasRole("READ_DEPARTMENT")
.anyExchange()
.authenticated()
)
]]>
https://gitee.com/itmuch/spring-cloud-yes
]]>
鏈夋彁渚涗竴濂梂EB鐣岄潰緇存姢鐢ㄦ埛銆佸簲鐢ㄤ笌瑙掕壊銆?br />
Ream鍒欏彲璁や負鏄縐熸埛錛屾瘡涓鎴風殑搴旂敤鍜岀敤鎴鋒暟鎹槸闅旂鐨勩?br />
http://10.80.27.69:8180/auth/realms/quickstart/.well-known/openid-configuration 鎻愪緵褰撳墠鎵鏈夌殑API鑺傜偣銆?br />
get_access_token_from_public_client:
curl --location --request POST 'http://10.80.27.69:8180/auth/realms/quickstart/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'username=alice' \
--data-urlencode 'password=123456' \
--data-urlencode 'client_id=app-springboot-public' \
--data-urlencode 'grant_type=password' \
| jq
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'username=alice' \
--data-urlencode 'password=123456' \
--data-urlencode 'client_id=app-springboot-public' \
--data-urlencode 'grant_type=password' \
| jq
./get_access_token_from_confidential_client.sh
curl --location --request POST 'http://10.80.27.69:8180/auth/realms/quickstart/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=app-springboot-confidential' \
--data-urlencode 'client_secret=3acf7692-49cb-4c45-9943-6f3dba512dae' \
--data-urlencode 'grant_type=client_credentials' \
| jq
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=app-springboot-confidential' \
--data-urlencode 'client_secret=3acf7692-49cb-4c45-9943-6f3dba512dae' \
--data-urlencode 'grant_type=client_credentials' \
| jq
璁塊棶涓涓狝CCESS TYPE涓築are only鐨勫簲鐢ㄧ殑涓涓狝PI錛?br />
access_token=$(curl \
-d "client_id=app-springboot-public" \
-d "username=alice" \
-d "password=123456" \
-d "grant_type=password" \
"http://10.80.27.69:8180/auth/realms/quickstart/protocol/openid-connect/token" \
| jq -r '.access_token')
#echo $access_token
curl -H "Authorization: Bearer $access_token" 'http://10.80.27.69:8182/products' | jq
-d "client_id=app-springboot-public" \
-d "username=alice" \
-d "password=123456" \
-d "grant_type=password" \
"http://10.80.27.69:8180/auth/realms/quickstart/protocol/openid-connect/token" \
| jq -r '.access_token')
#echo $access_token
curl -H "Authorization: Bearer $access_token" 'http://10.80.27.69:8182/products' | jq
璁塊棶鐢ㄦ埛淇℃伅錛?br />
access_token=$(curl \
-d "client_id=app-springboot-public" \
-d "username=alice" \
-d "password=123456" \
-d "grant_type=password" \
"http://10.80.27.69:8180/auth/realms/quickstart/protocol/openid-connect/token" | jq -r '.access_token')
curl -H "Authorization: Bearer $access_token" http://10.80.27.69:8180/auth/realms/quickstart/protocol/openid-connect/userinfo | jq
-d "client_id=app-springboot-public" \
-d "username=alice" \
-d "password=123456" \
-d "grant_type=password" \
"http://10.80.27.69:8180/auth/realms/quickstart/protocol/openid-connect/token" | jq -r '.access_token')
curl -H "Authorization: Bearer $access_token" http://10.80.27.69:8180/auth/realms/quickstart/protocol/openid-connect/userinfo | jq
]]>
Keycloak鏀寔OpenID銆丱Auth 2.0鍜孲AML 2.0鍗忚錛涙敮鎸佺敤鎴鋒敞鍐屻佺敤鎴風鐞嗐佹潈闄愮鐞嗭紱鏀寔OTP錛屾敮鎸佷唬鐞哋penID銆丼AML 2.0 IDP錛屾敮鎸丟itHub銆丩inkedIn絳夌涓夋柟鐧誨綍錛屾敮鎸佹暣鍚圠DAP鍜孉ctive Directory錛涙敮鎸佽嚜瀹氫箟璁よ瘉嫻佺▼銆佽嚜瀹氫箟鐢ㄦ埛鐣岄潰錛屾敮鎸佸浗闄呭寲銆?br />
鏈夌敤鎴風鐞嗙晫闈紝鍙敤浜嶢PI鐨勮璇佸拰鐢ㄦ埛鐨勮璇侊紝鐢ㄦ埛璁よ瘉闇浜轟負杈撳叆鐢ㄦ埛鍚嶄笌瀵嗙爜錛孉PI鍒欏嚟BARE TOKEN鍗沖彲璁よ瘉銆?br />
Spring Boot/Angular鏁村悎Keycloak瀹炵幇鍗曠偣鐧誨綍
https://blog.51cto.com/7308310/2446368
鍍呭崄鍒嗛悩鍗沖彲鎺ュ叆Spring Boot/Vue鍓嶅緦绔垎闆㈡噳鐢ㄥ鐝維SO鍠粸鐧婚寗
https://kknews.cc/code/a6am5pj.html
SpringBoot鏁村悎KeyCloak鏉冮檺綆＄悊
https://qianmoq.com/fuwuduan/springboot/springbootzhenghekeycloakquanxianguanli.html
浣跨敤Spring Gateway鍜孠eyCloak鏋勫緩涓涓狾IDC璁よ瘉緋葷粺
https://zhuanlan.zhihu.com/p/138578359
A Quick Guide to Using Keycloak with Spring Boot
https://www.baeldung.com/spring-boot-keycloak
Keycloak涓庡井鏈嶅姟鐨勬暣鍚?br />https://gitee.com/itmuch/spring-cloud-yes/blob/master/doc/keycloak-learn/Keycloak%E6%90%AD%E5%BB%BA%E6%89%8B%E6%8A%8A%E6%89%8B%E6%93%8D%E4%BD%9C%E6%8C%87%E5%8D%97.md
RedHat
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/html/securing_applications_and_services_guide/openid_connect_3
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/html-single/authorization_services_guide/index
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/
]]>