配置Geoserver与Keycloak SSO集成时认证过滤器报错求助

问题 #

在将Keycloak SSO与GeoServer 2.23.0集成时，配置新的Keycloak认证过滤器出现错误，错误日志如下：

org.geoserver.security.validation.FilterConfigException: java.lang.RuntimeException: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "verify-token-audience" (class org.keycloak.representations.adapters.config.AdapterConfig), not marked as ignorable (40 known properties: "ssl-required", "cors-allowed-headers", "register-node-period", "redirect-rewrite-rules", "turn-off-change-session-id-on-login", "truststore", "client-key-password", "token-store", "resource", "realm", "proxy-url", "disable-trust-manager", "bearer-only", "autodetect-bearer-only", "truststore-password", "use-resource-role-mappings", "client-keystore", "confidential-port", "enable-pkce", "auth-server-url", "cors-allowed-methods", "public-client", "expose-token", "token-minimum-time-to-live", "min-time-between-jwks-requests", "ignore-oauth-query-parameter", "cors-max-age", "enable-cors", "allow-any-hostname", "realm-public-key", "credentials", "principal-attribute", "always-refresh-token", "policy-enforcer", "public-key-cache-ttl", "connection-pool-size", "client-keystore-password", "enable-basic-auth", "cors-exposed-headers", "register-node-at-startup"]) at [Source: (ByteArrayInputStream); line: 6, column: 32] (through reference chain: org.keycloak.representations.adapters.config.AdapterConfig["verify-token-audience"])

使用版本：GeoServer 2.23.0、Keycloak 2.21.1

错误截图：

解决方案 #

• 移除配置中的verify-token-audience参数，该参数是Keycloak高版本新增的配置项，但GeoServer 2.23.0适配的Keycloak适配器版本不支持这个属性，导致解析失败。
• 若需要保留验证受众的功能，可选择：
  • 升级GeoServer到2.25及以上版本，这些版本适配的Keycloak适配器已支持verify-token-audience参数；
  • 降级Keycloak到19.x及以下版本，与GeoServer 2.23.0的适配器版本保持兼容。
• 检查配置中的其他参数，确保没有引入其他高版本Keycloak专属的配置项，避免同类错误。

内容的提问来源于stack exchange，提问作者Pradeep Rakshe