Keycloak授权服务器中已允许客户端仍返回Deny问题排查

环境与配置情况 #

• 使用Keycloak镜像：quay.io/keycloak/keycloak:24.0.2
• 已创建两个客户端：
  • store-700
  • my-resource-server（已配置为资源服务器）

资源服务器具体配置步骤 #

1. 创建名为upload的scope
2. 创建名为transaction的资源，关联upload scope
3. 创建Client Policy类型策略store-clients，仅允许client-id为store-700的客户端
4. 创建权限permission-700，允许访问transaction:upload

完整配置JSON #

{"allowRemoteResourceManagement": true,"policyEnforcementMode": "ENFORCING","resources": [{"name": "transaction","ownerManagedAccess": false,"displayName": "","attributes": {},"_id": "e61bc461-85d4-4390-af7b-d594c5f4c6d7","uris": [],"scopes": [{"name": "upload"}],"icon_uri": ""}],"policies": [{"id": "c2fec000-591d-41e2-94e7-6062bca6ca5b","name": "store-clients","description": "","type": "client","logic": "POSITIVE","decisionStrategy": "UNANIMOUS","config": {"clients": "[\"store-700\"]"}},{"id": "82cdb7dd-a70b-4272-abbd-f9d941fbdd27","name": "permission-700","description": "","type": "scope","logic": "POSITIVE","decisionStrategy": "UNANIMOUS","config": {"resources": "[\"transaction\"]","scopes": "[\"upload\"]","applyPolicies": "[\"store-clients\"]"}}],"scopes": [{"id": "9b14076d-17a9-42a8-a8ac-a0c98dc253ca","name": "upload","iconUri": ""}],"decisionStrategy": "UNANIMOUS"}

授权评估结果 #

在Evaluate标签页执行授权评估时，结果为Deny：

疑问 #

该客户端已被策略允许，为何授权请求仍被策略否决？

内容的提问来源于stack exchange，提问作者Eitan