Spring Boot WebFlux集成Keycloak高级RBAC实现方案咨询

在WebFlux响应式环境下，你可以通过**ReactivePolicyEnforcerFilter**替代Servlet版本的ServletPolicyEnforcerFilter，实现基于角色、权限范围、策略的API授权，具体步骤如下：

1. 添加必要依赖 #

确保项目依赖中包含WebFlux、Keycloak Starter以及授权客户端支持：

Maven 依赖示例 #

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-webflux</artifactId>
    </dependency>
    <dependency>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-spring-boot-starter</artifactId>
    </dependency>
    <dependency>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authorization-client</artifactId>
    </dependency>
</dependencies>

2. 实现配置解析器 #

和Servlet版本逻辑一致，实现ConfigurationResolver来加载policy-enforcer.json配置文件：

import org.keycloak.adapters.authorization.ConfigurationResolver;
import org.keycloak.adapters.authorization.PolicyEnforcerConfig;
import org.keycloak.adapters.authorization.util.JsonSerialization;
import java.io.IOException;

public class ReactivePolicyConfigResolver implements ConfigurationResolver {

    @Override
    public PolicyEnforcerConfig resolve(org.keycloak.adapters.spi.HttpRequest request) {
        try {
            return JsonSerialization.readValue(
                    getClass().getResourceAsStream("/policy-enforcer.json"),
                    PolicyEnforcerConfig.class
            );
        } catch (IOException e) {
            throw new RuntimeException("加载Policy Enforcer配置失败", e);
        }
    }
}

3. 注册Reactive Policy Enforcer过滤器 #

在Spring配置类中，将ReactivePolicyEnforcerFilter注册到WebFlux过滤器链，同时完成WebFlux请求到Keycloak HttpRequest的适配：

import org.keycloak.adapters.authorization.ReactivePolicyEnforcerFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.server.WebFilter;

@Configuration
public class KeycloakReactiveSecurityConfig {

    @Bean
    public WebFilter keycloakPolicyEnforcerFilter() {
        ReactivePolicyEnforcerFilter enforcerFilter = new ReactivePolicyEnforcerFilter(
                new ReactivePolicyConfigResolver()
        );

        return (exchange, chain) -> {
            // 适配WebFlux请求为Keycloak兼容的HttpRequest
            org.keycloak.adapters.spi.HttpRequest keycloakRequest = new org.keycloak.adapters.spi.HttpRequest() {
                @Override
                public String getURI() {
                    return exchange.getRequest().getPath().value();
                }

                @Override
                public String getMethod() {
                    return exchange.getRequest().getMethodValue();
                }

                @Override
                public String getHeader(String name) {
                    return exchange.getRequest().getHeaders().getFirst(name);
                }

                @Override
                public String getRemoteAddr() {
                    return exchange.getRequest().getRemoteAddress().getAddress().getHostAddress();
                }
            };

            return enforcerFilter.filter(exchange, chain, keycloakRequest);
        };
    }
}

4. 配置policy-enforcer.json #

在src/main/resources下创建配置文件，定义资源路径、权限范围、执行模式等规则，示例：

{
  "realm": "your-realm-name",
  "auth-server-url": "http://localhost:8080/auth",
  "resource": "your-api-client-id",
  "credentials": {
    "secret": "your-client-secret"
  },
  "authorization": {
    "policy-enforcer": {
      "paths": [
        {
          "path": "/api/admin/**",
          "enforcement-mode": "ENFORCING",
          "scopes": ["admin:manage"]
        },
        {
          "path": "/api/user/**",
          "enforcement-mode": "ENFORCING",
          "scopes": ["user:view"]
        }
      ]
    }
  }
}

关键说明 #

• 确保Keycloak后台已配置好对应的客户端、角色、权限策略，逻辑和Servlet环境一致；
• ReactivePolicyEnforcerFilter会自动拦截请求，根据配置文件和Keycloak授权策略完成权限校验；
• 若需自定义校验逻辑，可扩展ReactivePolicyEnforcerFilter或结合Spring Security Reactive模块协同使用。

内容的提问来源于stack exchange，提问作者Dinusha