Spring 4.2.4与Keycloak Spring Security Adapter兼容吗？需哪些依赖？

兼容性说明 #

Spring 4.2.4 仅兼容 Keycloak Spring Security Adapter 4.x 及更早版本，Keycloak 5.0.0 及以上版本已停止对 Spring 4.x 的支持，推荐使用稳定的 4.8.3.Final 版本，该版本与 Spring 4.2.4 兼容性良好。

同时需注意：Spring 4.2.4 对应的 Spring Security 版本应为 4.0.3.RELEASE（Spring 与 Spring Security 版本存在严格匹配关系，需避免版本冲突）。

pom.xml 依赖配置 #

需引入 Keycloak 核心依赖、Spring Security Adapter 依赖，以及匹配版本的 Spring Security 依赖（若项目未预先引入）：

<!-- Spring Security 依赖（匹配 Spring 4.2.4） -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
    <version>4.0.3.RELEASE</version>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
    <version>4.0.3.RELEASE</version>
</dependency>

<!-- Keycloak Spring Security Adapter 依赖 -->
<dependency>
    <groupId>org.keycloak</groupId>
    <artifactId>keycloak-spring-security-adapter</artifactId>
    <version>4.8.3.Final</version>
</dependency>
<dependency>
    <groupId>org.keycloak</groupId>
    <artifactId>keycloak-core</artifactId>
    <version>4.8.3.Final</version>
</dependency>

集成核心步骤指导 #

1. 创建 Keycloak 安全配置类
   继承 KeycloakWebSecurityConfigurerAdapter，配置认证规则与资源权限：

import org.keycloak.adapters.springsecurity.KeycloakSecurityComponents;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;

@Configuration
@EnableWebSecurity
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        // 转换Keycloak角色为Spring Security权限（可选，按需配置）
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        // 无状态模式配置，若需会话管理可替换为其他实现
        return new NullAuthenticatedSessionStrategy();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http
            .authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .antMatchers("/secured/**").hasRole("USER")
            .anyRequest().authenticated();
    }
}

2. 配置 Keycloak 客户端参数
   在 application.properties 中添加 Keycloak 服务端及客户端配置：

keycloak.auth-server-url=http://your-keycloak-server/auth
keycloak.realm=your-realm-name
keycloak.resource=your-client-id
keycloak.credentials.secret=your-client-secret
keycloak.use-resource-role-mappings=true
keycloak.bearer-only=false

3. 注册 Keycloak Filter
   通过 Java 配置注册 Keycloak 的 Servlet Filter：

import org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter;
import org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;

@Configuration
public class KeycloakFilterConfig {

    @Bean
    public FilterRegistrationBean<KeycloakPreAuthActionsFilter> keycloakPreAuthActionsFilterRegistrationBean(KeycloakPreAuthActionsFilter filter) {
        FilterRegistrationBean<KeycloakPreAuthActionsFilter> registrationBean = new FilterRegistrationBean<>(filter);
        registrationBean.setEnabled(false);
        return registrationBean;
    }

    @Bean
    public FilterRegistrationBean<KeycloakAuthenticationProcessingFilter> keycloakAuthenticationProcessingFilterRegistrationBean(KeycloakAuthenticationProcessingFilter filter) {
        FilterRegistrationBean<KeycloakAuthenticationProcessingFilter> registrationBean = new FilterRegistrationBean<>(filter);
        registrationBean.setEnabled(false);
        return registrationBean;
    }
}

注意事项 #

• 确保 Keycloak 服务端版本与 Adapter 版本一致（推荐均使用 4.8.3.Final），避免跨版本兼容性问题。
• 若项目使用 XML 配置而非 Java 配置，可参考 Keycloak 官方老版本文档配置 web.xml 及 spring-security.xml。

内容的提问来源于stack exchange，提问作者ayoubmrk