Quarkus启用Keycloak策略执行器后公共资源加载报错，如何排除？

使用Quarkus 3.3.2，通过Keycloak Bearer Token保护部分API，核心配置如下：

# keycloak
# OIDC Configuration
%prod.quarkus.oidc.auth-server-url=https://keycloak....
%test.quarkus.oidc.auth-server-url=https://keycloak....
%dev.quarkus.oidc.auth-server-url=https://keycloak....
quarkus.oidc.client-id=my-client
%prod.quarkus.oidc.credentials.secret=...
%test.quarkus.oidc.credentials.secret=...
%dev.quarkus.oidc.credentials.secret=...
quarkus.oidc.tls.verification=required
quarkus.keycloak.policy-enforcer.enable=true

启用quarkus.keycloak.policy-enforcer.enable=true后，AuthzClient功能正常，但请求公共资源（如健康检查、/css/enunciate.css等）时触发错误：

2023-09-25 16:31:02,956 ERROR [org.key.ada.aut.PolicyEnforcer] (vert.x-worker-thread-1) Could not lazy load resource with path [/css/enunciate.css] from server: org.keycloak.authorization.client.AuthorizationDeniedException: org.keycloak.authorization.client.util.HttpResponseException: Unexpected response from server: 403 / Forbidden / Response from server: {"error":"invalid_clientId","error_description":"Client application [my-client] is not registered as a resource server."}
    at org.keycloak.authorization.client.util.Throwables.handleAndWrapHttpResponseException(Throwables.java:96)
    at org.keycloak.authorization.client.util.Throwables.handleWrapException(Throwables.java:42)
    at org.keycloak.authorization.client.util.Throwables.retryAndWrapExceptionIfNecessary(Throwables.java:87)
    at org.keycloak.authorization.client.resource.ProtectedResource.find(ProtectedResource.java:233)
    at org.keycloak.authorization.client.resource.ProtectedResource.findByMatchingUri(ProtectedResource.java:292)
    at org.keycloak.adapters.authorization.PathConfigMatcher.matches(PathConfigMatcher.java:81)
    ...
Caused by: org.keycloak.authorization.client.util.HttpResponseException: Unexpected response from server: 403 / Forbidden / Response from server: {"error":"invalid_clientId","error_description":"Client application [my-client] is not registered as a resource server."}
    at org.keycloak.authorization.client.util.HttpMethod.execute(HttpMethod.java:103)
    at org.keycloak.authorization.client.util.HttpMethodResponse$3.execute(HttpMethodResponse.java:68)
    at org.keycloak.authorization.client.resource.ProtectedResource$5.call(ProtectedResource.java:227)
    at org.keycloak.authorization.client.resource.ProtectedResource$5.call(ProtectedResource.java:223)
    at org.keycloak.authorization.client.resource.ProtectedResource.find(ProtectedResource.java:231)
    ... 19 more

尝试配置公共资源权限无效：

quarkus.http.auth.permission.public.paths=/,/css/enunciate.css,/favicon.ico
quarkus.http.auth.permission.public.policy=permit
quarkus.http.auth.permission.public.methods=GET,HEAD,POST,PUT,OPTION,PATCH

尝试指定需认证路径导致启动失败：

quarkus.keycloak.policy-enforcer.paths.1.path=/tlnv-restservice/api,/tlnv-restservice/api/*
quarkus.keycloak.policy-enforcer.paths.1.enforcement-mode=ENFORCING

启动错误日志：

2023-09-25 16:37:31,775 ERROR [io.qua.run.Application] (Quarkus Main Thread) Failed to start application (with profile [dev]): java.lang.RuntimeException: Failed to start quarkus
    at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
    ... 
Caused by: org.keycloak.authorization.client.util.HttpResponseException: Unexpected response from server: 403 / Forbidden / Response from server: {"error":"invalid_clientId","error_description":"Client application [my-client] is not registered as a resource server."}
    at org.keycloak.authorization.client.util.HttpMethod.execute(HttpMethod.java:103)
    at org.keycloak.authorization.client.util.HttpMethodResponse$3.execute(HttpMethodResponse.java:68)
    at org.keycloak.authorization.client.resource.ProtectedResource$5.call(ProtectedResource.java:227)
    at org.keycloak.authorization.client.resource.ProtectedResource$5.call(ProtectedResource.java:223)
    at org.keycloak.authorization.client.resource.ProtectedResource.find(ProtectedResource.java:231)
    ... 23 more

需解决：如何排除公共资源，使其不被Keycloak策略执行器加载？

1. 配置策略执行器的排除路径 #

直接在Keycloak策略执行器配置中添加需要排除的公共资源，设置其enforcement-mode为DISABLED，且排除规则需放在强制规则前面（策略执行器按顺序匹配路径）：

quarkus.keycloak.policy-enforcer.paths.0.path=/,/css/*,/favicon.ico,/health/*
quarkus.keycloak.policy-enforcer.paths.0.enforcement-mode=DISABLED

quarkus.keycloak.policy-enforcer.paths.1.path=/tlnv-restservice/api/*
quarkus.keycloak.policy-enforcer.paths.1.enforcement-mode=ENFORCING

2. 修正Keycloak客户端配置 #

启动报错的核心原因是my-client未在Keycloak中注册为资源服务器，需在Keycloak控制台操作：

• 进入对应客户端的设置页面
• 开启Authorization Enabled选项
• 保存后重启应用

3. 调整HTTP权限策略优先级（可选） #

若需使用quarkus.http.auth.permission配置，需确保公共权限优先级高于Keycloak认证权限，通过priority参数设置：

quarkus.http.auth.permission.public.paths=/,/css/*,/favicon.ico,/health/*
quarkus.http.auth.permission.public.policy=permit
quarkus.http.auth.permission.public.methods=GET,HEAD,OPTIONS
quarkus.http.auth.permission.public.priority=1

quarkus.http.auth.permission.secured.paths=/tlnv-restservice/api/*
quarkus.http.auth.permission.secured.policy=authenticated
quarkus.http.auth.permission.secured.priority=2

此方式下公共资源会被直接放行，不会进入Keycloak策略执行器的检查流程。

内容的提问来源于stack exchange，提问作者caromag