Keycloak与ASP.NET Core Web API：多Realm认证及动态配置加载

完全可行，ASP.NET Core的认证系统支持多Scheme配置，结合Keycloak的JWT认证机制，可以实现多Realm的认证与授权需求，甚至支持动态加载Realm配置。以下是具体实现方案：

1. 配置多个Realm的Keycloak参数 #

修改appsettings.json，将多个Realm的配置结构化存储：

"KeycloakRealms": {
  "Realm1": {
    "realm": "realm1",
    "auth-server-url": "http://localhost:8080/",
    "ssl-required": "none",
    "resource": "private-client",
    "verify-token-audience": false,
    "credentials": {
      "secret": "yoursecxxxyyy"
    },
    "confidential-port": 0,
    "policy-enforcer": {
      "credentials": {}
    }
  },
  "Realm2": {
    "realm": "realm2",
    "auth-server-url": "http://localhost:8080/",
    "ssl-required": "none",
    "resource": "private-client-realm2",
    "verify-token-audience": false,
    "credentials": {
      "secret": "yoursecxxxyyy-realm2"
    },
    "confidential-port": 0,
    "policy-enforcer": {
      "credentials": {}
    }
  }
}

2. 注册多Scheme的认证服务 #

为每个Realm指定独立的认证Scheme名称，替代默认的单一Scheme注册方式：

// 注册Realm1专属认证Scheme
services.AddAuthentication()
    .AddKeycloakWebApi("Keycloak-Realm1", configuration.GetSection("KeycloakRealms:Realm1"));

// 注册Realm2专属认证Scheme
services.AddKeycloakWebApi("Keycloak-Realm2", configuration.GetSection("KeycloakRealms:Realm2"));

// 可选：设置默认认证Scheme（未指定Scheme的接口将使用此默认值）
services.Configure<AuthenticationOptions>(options =>
{
    options.DefaultAuthenticateScheme = "Keycloak-Realm1";
    options.DefaultChallengeScheme = "Keycloak-Realm1";
});

3. 配置多Realm的授权规则 #

针对不同Realm的角色配置授权策略，或在接口上直接指定对应认证Scheme：

services.AddAuthorization(options =>
{
    // Realm1管理员角色策略
    options.AddPolicy("Realm1-Admin", policy =>
        policy.RequireAuthenticatedUser()
              .AddAuthenticationSchemes("Keycloak-Realm1")
              .RequireRole("admin"));

    // Realm2编辑者角色策略
    options.AddPolicy("Realm2-Editor", policy =>
        policy.RequireAuthenticatedUser()
              .AddAuthenticationSchemes("Keycloak-Realm2")
              .RequireRole("editor"));
});

在控制器中使用策略：

[Authorize(Policy = "Realm1-Admin")]
[ApiController]
[Route("api/realm1")]
public class Realm1Controller : ControllerBase
{
    // 接口逻辑
}

[Authorize(Policy = "Realm2-Editor")]
[ApiController]
[Route("api/realm2")]
public class Realm2Controller : ControllerBase
{
    // 接口逻辑
}

4. 动态加载Realm配置（可选） #

若需无需重启服务即可新增Realm，可通过自定义认证Handler实现动态配置加载：

public class DynamicKeycloakAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
    private readonly IConfiguration _configuration;

    public DynamicKeycloakAuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock, IConfiguration configuration)
        : base(options, logger, encoder, clock)
    {
        _configuration = configuration;
    }

    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        // 从请求路径/请求头提取Realm标识（示例：从路径/api/{realm}/xxx中获取）
        var realmName = Request.Path.Value?.Split('/')[2];
        if (string.IsNullOrEmpty(realmName))
        {
            return AuthenticateResult.Fail("未指定Realm");
        }

        var realmConfig = _configuration.GetSection($"KeycloakRealms:{realmName}");
        if (!realmConfig.Exists())
        {
            return AuthenticateResult.Fail($"Realm {realmName}未配置");
        }

        // 绑定Keycloak配置并执行Token验证逻辑
        var keycloakOptions = new KeycloakAuthenticationOptions();
        realmConfig.Bind(keycloakOptions);

        var tokenExtractor = new KeycloakTokenExtractor(Options, Logger);
        var token = await tokenExtractor.ExtractTokenAsync(Request);
        if (token == null)
        {
            return AuthenticateResult.Fail("未找到Token");
        }

        // 调用Keycloak的JWT验证逻辑完成Token校验
        var validator = new KeycloakJwtSecurityTokenHandler(keycloakOptions, _configuration);
        var validationResult = await validator.ValidateTokenAsync(token, new TokenValidationParameters
        {
            ValidAudience = keycloakOptions.Resource,
            ValidIssuer = $"{keycloakOptions.AuthServerUrl}realms/{keycloakOptions.Realm}",
            // 实现从Keycloak获取公钥的逻辑
            IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) =>
            {
                var certsEndpoint = $"{keycloakOptions.AuthServerUrl}realms/{keycloakOptions.Realm}/protocol/openid-connect/certs";
                // 此处添加公钥获取与解析逻辑
                return new List<SecurityKey>();
            }
        });

        return validationResult.IsValid 
            ? AuthenticateResult.Success(new AuthenticationTicket(new ClaimsPrincipal(validationResult.ClaimsIdentity), Scheme.Name))
            : AuthenticateResult.Fail(validationResult.Exception);
    }
}

注册自定义认证Scheme：

services.AddAuthentication()
    .AddScheme<AuthenticationSchemeOptions, DynamicKeycloakAuthenticationHandler>("Dynamic-Keycloak", options => { });

总结 #

多Realm认证完全具备可行性：

• 静态多Realm可通过注册多个独立认证Scheme实现，配置简单直观
• 动态Realm加载可通过自定义认证Handler，结合请求标识动态匹配配置实现
• 需确保每个Realm对应的Keycloak客户端配置正确，Token的Issuer与Audience与配置匹配

内容的提问来源于stack exchange，提问作者sPS