Spring Gateway集成Keycloak时服务端部署失败求助

我正在开发一个用Spring Gateway结合Keycloak保护Spring服务的Demo原型。未添加安全配置时，网关能正常转发流量到服务；但加了安全配置后，服务部署失败。排查后确认网关功能正常，Keycloak已成功创建客户端会话，用Postman测试用户/密码/客户端密钥能正常获取Token。服务端启动时触发错误，核心异常是NoClassDefFoundError: org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter，导致无法创建filterChain Bean。

错误日志 #

middleware-tomcat-1      | 2023-06-19T15:21:51.291Z DEBUG 1 --- [           main] swordEncoderAuthenticationManagerBuilder : No authenticationProviders and no parentAuthenticationManager defined. Returning null.
middleware-tomcat-1      | 2023-06-19T15:21:51.432Z  WARN 1 --- [           main] ConfigServletWebServerApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'filterChain' defined in class path resource [com/webdemo/SecurityConfiguration.class]: Failed to instantiate [org.springframework.security.web.SecurityFilterChain]: Factory method 'filterChain' threw exception with message: org/springframework/security/oauth2/server/resource/web/authentication/BearerTokenAuthenticationFilter
...（省略部分日志）
Caused by: java.lang.ClassNotFoundException: org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter

服务端POM配置 #

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.0.5</version>
        <relativePath/> 
    </parent>
    <groupId>com.demoweb</groupId>
    <artifactId>webdemo</artifactId>
    <version>1.0</version>
    <packaging>war</packaging>
    ...（省略部分依赖）
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-oauth2-resource-server</artifactId>
        <version>5.6.2</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>6.1.0</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
        <version>6.1.0</version>
    </dependency>
</project>

SecurityConfiguration类 #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated()).oauth2ResourceServer((oauth2ResourceServer) -> oauth2ResourceServer.jwt((jwt) -> jwt.decoder(jwtDecoder())));
        return http.build();
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        return NimbusJwtDecoder.withJwkSetUri("http://[KEYCLOAK_IP:PORT]/realms/my-realm/protocol/openid-connect/certs").build();
    } 
}

服务端相关配置 #

spring.security.oauth2.resourceserver.jwt.issuer-uri=http://[KEYCLOAK_IP:PORT]/realms/my-realm

核心原因 #

Spring Boot 3.0.5对应的Spring Security版本为6.0.x，但你手动指定了spring-security-web和spring-security-config为6.1.0，同时spring-security-oauth2-resource-server却使用了5.6.2，版本严重不兼容。Spring Security 6.x中BearerTokenAuthenticationFilter的包路径与实现发生了变化，5.6.2版本的oauth2-resource-server依赖中不存在该类，导致类找不到异常。

解决步骤 #

1. 统一Spring Security版本：移除所有Spring Security相关依赖的手动版本号，让Spring Boot父项目自动管理版本，确保所有Spring Security组件版本一致。

修改后的POM依赖部分：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-resource-server</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
</dependency>

2. 简化JwtDecoder配置：配置文件中已指定issuer-uri，无需手动创建JwtDecoder Bean，Spring Boot会自动根据配置生成，避免重复配置。

修改后的SecurityConfiguration类：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated())
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> {}));
        return http.build();
    }
}

3. 清理并重新构建项目：执行mvn clean install更新依赖，随后重启服务即可。

内容的提问来源于stack exchange，提问作者Richter