Spring Boot 2.0.5.RELEASE启用OAuth2资源服务器时http.oauth2ResourceServer()方法缺失求助

问题根源 #

Spring Boot 2.0.5.RELEASE对应的Spring Security版本是5.0.x，而oauth2ResourceServer()方法是Spring Security 5.1及以上版本才新增的API，因此在5.0.x版本的Security中不存在该方法，这是导致你无法调用的直接原因。

解决方案 #

方案一：升级Spring Boot版本（推荐） #

将Spring Boot版本升级到2.1.x及以上（比如2.1.20.RELEASE，稳定的LTS版本），对应的Spring Security版本会自动升级到5.1+，此时就能直接使用oauth2ResourceServer()方法。

修改Maven的pom.xml中Spring Boot父依赖版本：

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.1.20.RELEASE</version>
    <relativePath/>
</parent>

升级后，SecurityConfig可按如下方式配置Keycloak令牌验证：

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .oauth2ResourceServer()
                .jwt()
                .decoder(jwtDecoder());
    }

    private JwtDecoder jwtDecoder() {
        // 替换为你的Keycloak realm的JWKS端点
        String jwksUri = "http://your-keycloak-host:8080/auth/realms/your-realm/protocol/openid-connect/certs";
        return NimbusJwtDecoder.withJwkSetUri(jwksUri).build();
    }
}

方案二：不升级版本，使用Spring Security 5.0.x的资源服务器配置 #

如果无法升级版本，可使用Spring Security 5.0.x中的resourceServer()方法替代，结合JWT验证Keycloak令牌：

1. 添加必要依赖（Maven）：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-jose</artifactId>
    <version>5.0.14.RELEASE</version> <!-- 与Spring Security 5.0.x版本匹配 -->
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-resource-server</artifactId>
    <version>5.0.14.RELEASE</version>
</dependency>

2. 配置SecurityConfig：

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .resourceServer()
                .jwt()
                .decoder(jwtDecoder());
    }

    private JwtDecoder jwtDecoder() {
        String jwksUri = "http://your-keycloak-host:8080/auth/realms/your-realm/protocol/openid-connect/certs";
        return NimbusJwtDecoder.withJwkSetUri(jwksUri).build();
    }
}

方案三：使用Keycloak官方Spring Boot适配器 #

如果更倾向于Keycloak原生支持，可引入Keycloak适配器：

1. 添加Keycloak依赖（Maven）：

<dependency>
    <groupId>org.keycloak</groupId>
    <artifactId>keycloak-spring-boot-starter</artifactId>
    <version>4.8.3.Final</version> <!-- 选择与Keycloak服务器版本兼容、且支持Spring Boot 2.0.x的版本 -->
</dependency>

2. 在application.properties中配置Keycloak参数：

keycloak.realm=your-realm-name
keycloak.auth-server-url=http://your-keycloak-host:8080/auth
keycloak.resource=your-client-id
keycloak.credentials.secret=your-client-secret
keycloak.security-constraints[0].authRoles[0]=user
keycloak.security-constraints[0].securityCollections[0].patterns[0]=/*

3. 配置SecurityConfig：

import org.keycloak.adapters.springsecurity.KeycloakConfiguration;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;

@KeycloakConfiguration
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        KeycloakAuthenticationProvider provider = keycloakAuthenticationProvider();
        provider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        auth.authenticationProvider(provider);
    }

    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new NullAuthenticatedSessionStrategy(); // 无状态API场景使用
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.authorizeRequests().anyRequest().authenticated();
    }
}

内容的提问来源于stack exchange，提问作者Rodja