配置Keycloak Policy Enforcer，避免拦截Spring Boot公共URL

问题原因 #

你的Policy Enforcer配置中未明确排除公共路径（/public/*），即便Spring Security设置了permitAll()，Keycloak的ServletPolicyEnforcerFilter仍会对所有请求执行权限检查，导致公共资源被拦截。

解决方案 #

1. 在policy-enforcer.json中添加公共路径排除规则 #

修改policy-enforcer.json，在paths数组中新增针对公共路径的规则，将其enforcement-mode设为DISABLED，让Policy Enforcer跳过对这些路径的检查：

{
  "realm": "online",
  "auth-server-url": "http://localhost:8182",
  "resource": "client-b",
  "credentials": {
    "secret": "secret"
  },
  "enforcement-mode" : "ENFORCING",
  "paths": [
    {
      "path" : "/public/*",
      "enforcement-mode": "DISABLED"
    },
    {
      "path" : "/archive/*",
      "methods" : [
        {
          "method": "GET",
          "scopes" : ["urn:client-b:access"]
        }
      ]
    },
    {
      "path" : "/send/create",
      "methods" : [
        {
          "method": "POST",
          "scopes" : ["urn:client-b:send:create"]
        }
      ]
    }
  ]
}

2. 限制Policy Enforcer Filter的作用路径（可选） #

若不想修改Policy Enforcer配置，可在Spring Security中仅对需要管控的路径应用ServletPolicyEnforcerFilter，而非全局添加：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
            .authorizeHttpRequests((authorize) -> authorize
                     .requestMatchers("/public/*").permitAll()
                    .anyRequest().authenticated()
            )
            .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
    
    // 仅对指定受控路径添加Policy Enforcer Filter
    http.addFilterAfter(createPolicyEnforcerFilter(), BearerTokenAuthenticationFilter.class)
        .requestMatchers("/archive/**", "/send/create");
    
    return http.build();
}

3. 校验路径匹配规则 #

注意Policy Enforcer中path的匹配语法：

• /public/* 仅匹配/public/xxx，不匹配/public/xxx/yyy这类多层子路径
• 若需匹配公共路径下所有子路径，改用/public/**

补充说明 #

Keycloak Policy Enforcer的权限检查优先级高于Spring Security的permitAll()配置，必须通过上述方式明确排除公共路径或限制Filter作用范围，才能让公共资源正常访问。

内容的提问来源于stack exchange，提问作者Name1 Name2