Spring Boot/Security与Keycloak通信异常排查求助

环境配置 #

• Spring Boot 2.5.6
• Spring Security 5.5.3
• Java 17
• Keycloak 23
• 两者部署在同一Windows机器，运行于VPN环境

问题现象 #

• 初始配置主机名为localhost时，HTTP/HTTPS模式下均正常：用户可跳转Keycloak登录，获取JWT后正常调用API、加载SPA
• 将主机名改为机器实际名称myhost后，Spring Security在获取Keycloak OIDC端点配置时抛出ResourceAccessException，核心错误为java.net.SocketException: Permission denied: connect
• 异常中涉及的OIDC配置URL（https://myhost:8443/realms/myrealm/.well-known/openid-configuration）可通过curl、浏览器正常访问，返回预期JSON，Chrome/Firefox无证书不信任提示

错误堆栈 #

Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://myhost:8443/realms/myrealm/.well-known/openid-configuration": Permission denied: connect; nested exception is java.net.SocketException: Permission denied: connect
        at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:785) ~[spring-web-5.3.12.jar!/:5.3.12]
        at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:670) ~[spring-web-5.3.12.jar!/:5.3.12]
        at org.springframework.security.oauth2.client.registration.ClientRegistrations.lambda$oidc$0(ClientRegistrations.java:155) ~[spring-security-oauth2-client-5.5.3.jar!/:5.5.3]
        at org.springframework.security.oauth2.client.registration.ClientRegistrations.getBuilder(ClientRegistrations.java:208) ~[spring-security-oauth2-client-5.5.3.jar!/:5.5.3]
        ... 97 common frames omitted
Caused by: java.net.SocketException: Permission denied: connect
        at java.base/sun.nio.ch.Net.connect0(Native Method) ~[na:na]
        at java.base/sun.nio.ch.Net.connect(Net.java:579) ~[na:na]

相关配置 #

Spring Boot 配置（application.yml） #

server:
  port: 443
  ssl:
   enabled: true    
   keyStoreType: PKCS12
   key-store: classpath:myhost.p12
   key-store-password: mypass
   key-alias: myhost
   # JVM should read JDK truststore
   # trust store location
   # trust-store: classpath:cacerts
   # trust store password
   # trust-store-password: changeit
spring:
  security:
    oauth2:
      client:
        registration:
          #keycloak: 
          myclient:
            client-id: "myclient"
            authorization-grant-type: "authorization_code"          
            scope: "openid"
            provider: "keycloak"     
            authorization-endpoint: https://myhost:8443/realms/myrealm/protocol/openid-connect/auth
            redirect-uri: 'https://myhost:443'
            issuer-uri: https://myhost:8443/myrealm 
        provider:
          keycloak:
            user-name-attribute: preferred_username
            authorization-endpoint: https://myhost:8443/myrealm/protocol/openid-connect/auth
            authorization-uri: https://myhost:8443/myrealm/
            oidc-provider:  https://myhost:8443/myrealm/.well-known/openid-configuration 
            issuer-uri: https://myhost:8443/myrealm
            token-uri: https://myhost:8443/myrealm/protocol/openid-connect/token 
            user-info-uri: https://myhost:8443/myrealm/protocol/openid-connect/userinfo
            logout-uri: https://myhost:8443/myrealm/protocol/openid-connect/logout    
            
      resourceserver:
        jwt:   
          issuer-uri: https://myhost:8443/myrealm
          jwk-set-uri: https://myhost:8443/auth/myrealm/protocol/openid-connect/certs

Keycloak 配置（keycloak.conf） #

# basic keystore--same file as in Spring Boot app
https-key-store-file=C:/Keycloak/keycloak-23.0.0/conf/certs/myhost.p12
https-key-store-password=mypass

# truststore--JDK truststore, used by JVM
https-trust-store-file=C:/Program Files/Java/jdk-17.0.1/lib/security/cacerts
https-trust-store-password=changeit
https-trust-store-type=jks

hostname=myhost
hostname-strict-https=true

Keycloak客户端设置 #

• Root URL: https://myhost:443
• Valid redirect URIs: /*
• Web origins: + *

已排查动作 #

• 日志排查：开启Keycloak TRACE日志仅输出PostgreSQL相关内容；开启Quarkus HTTP日志仅看到成功请求，无错误信息
• 主机解析：用nslookup、nbtstat查询myhost可得到适配器及地址信息，疑似存在IPv4/IPv6解析混淆，添加JVM参数-Djava.net.preferIPv4Stack=true -Djava.net.preferIPv6Addresses=false无效果
• DNS问题：VPN连接后私有域DNS优先级高于本地DNS，myhost.privatedomain.com解析到虚拟适配器IP，但本机无法访问该IP；在本地Verizon路由器DNS添加对应A记录、调整适配器DNS顺序后，私有域DNS仍优先生效；断开VPN后本地DNS正常返回路由器分配的DHCP地址

需求 #

解决Spring Boot/Security初始化阶段连接Keycloak的权限拒绝问题，实现应用正常对接Keycloak身份认证

内容的提问来源于stack exchange，提问作者user4512668