Spring Boot与Keycloak多租户：动态多Realm配置方案求助

问题根源 #

你遇到的Unable to resolve Configuration with the provided Issuer错误，是因为Spring Security默认的JWT校验逻辑要求issuer-uri与Token的Issuer完全匹配，但动态Realm场景下Issuer是http://localhost:8080/realms/{realm-name}这种带动态后缀的格式，硬编码的issuer-uri无法适配。

Spring Boot 2.7.10 实现方案 #

1. 自定义Issuer校验器，跳过硬匹配 #

替换默认的JwtIssuerValidator，只校验Issuer前缀，允许动态Realm后缀：

public class DynamicRealmIssuerValidator implements OAuth2TokenValidator<Jwt> {
    private final String baseIssuerPrefix;

    public DynamicRealmIssuerValidator(String baseIssuerPrefix) {
        this.baseIssuerPrefix = baseIssuerPrefix;
    }

    @Override
    public OAuth2TokenValidatorResult validate(Jwt token) {
        String tokenIssuer = token.getIssuer();
        if (!tokenIssuer.startsWith(baseIssuerPrefix)) {
            return OAuth2TokenValidatorResult.failure(
                new OAuth2Error(OAuth2ErrorCodes.INVALID_TOKEN, "无效的Issuer", null)
            );
        }
        return OAuth2TokenValidatorResult.success();
    }
}

2. 动态JwtDecoder，按需加载Realm的JWKS #

实现动态解码逻辑，根据Token中的Issuer自动获取对应Realm的JWKS配置：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private static final String KEYCLOAK_BASE_ISSUER = "http://localhost:8080/realms/";

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.oauth2ResourceServer()
            .jwt()
            .decoder(dynamicJwtDecoder())
            .validator(new DynamicRealmIssuerValidator(KEYCLOAK_BASE_ISSUER));
    }

    @Bean
    public JwtDecoder dynamicJwtDecoder() {
        return token -> {
            // 解析Token中的Issuer
            Jwt parsedToken = JwtParser.parse(token);
            String issuer = parsedToken.getIssuer();
            
            // 动态构建对应Realm的JWKS地址
            String jwksUri = issuer + "/protocol/openid-connect/certs";
            JwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(jwksUri).build();
            
            return decoder.decode(token);
        };
    }
}

优化建议：加入Guava Cache缓存不同Realm的JWKS配置，避免重复请求Keycloak服务器

3. 动态客户端注册（若需作为OAuth2客户端） #

如果你的服务需要主动向Keycloak请求Token，可通过Keycloak Admin API动态注册客户端，再实现自定义ClientRegistrationRepository加载客户端信息：

@Component
public class DynamicClientRegistrationRepository implements ClientRegistrationRepository {
    private final Keycloak keycloakAdminClient;
    private final Cache<String, ClientRegistration> clientCache;

    public DynamicClientRegistrationRepository(Keycloak keycloakAdminClient) {
        this.keycloakAdminClient = keycloakAdminClient;
        this.clientCache = CacheBuilder.newBuilder().expireAfterWrite(1, TimeUnit.HOURS).build();
    }

    @Override
    public ClientRegistration findByRegistrationId(String registrationId) {
        // 先查缓存，不存在则调用Keycloak Admin API获取/创建客户端
        ClientRegistration client = clientCache.getIfPresent(registrationId);
        if (client == null) {
            // 调用Keycloak Admin API创建或查询客户端
            ClientRepresentation keycloakClient = keycloakAdminClient.realm(registrationId)
                .clients().findByClientId("your-client-id").get(0);
            
            client = ClientRegistration.withRegistrationId(registrationId)
                .clientId(keycloakClient.getClientId())
                .clientSecret(keycloakClient.getSecret())
                .authorizationUri(KEYCLOAK_BASE_ISSUER + registrationId + "/protocol/openid-connect/auth")
                .tokenUri(KEYCLOAK_BASE_ISSUER + registrationId + "/protocol/openid-connect/token")
                .jwkSetUri(KEYCLOAK_BASE_ISSUER + registrationId + "/protocol/openid-connect/certs")
                .redirectUri("your-redirect-uri")
                .build();
            
            clientCache.put(registrationId, client);
        }
        return client;
    }
}

Spring Boot 3.x 原生优化支持 #

Spring Boot 3.x（对应Spring Security 6.x）对多租户OAuth2的支持更简洁，提供了JwtIssuerAuthenticationManagerResolver原生工具，无需大量自定义代码：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    private static final String KEYCLOAK_BASE_ISSUER = "http://localhost:8080/realms/";

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.oauth2ResourceServer(oauth2 -> oauth2
            .authenticationManagerResolver(issuerAuthenticationManagerResolver())
        );
        return http.build();
    }

    private JwtIssuerAuthenticationManagerResolver issuerAuthenticationManagerResolver() {
        return new JwtIssuerAuthenticationManagerResolver(issuer -> {
            // 校验Issuer前缀
            if (!issuer.startsWith(KEYCLOAK_BASE_ISSUER)) {
                throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_TOKEN));
            }
            
            // 动态创建对应Realm的AuthenticationManager
            JwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(issuer + "/protocol/openid-connect/certs").build();
            JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
            // 自定义权限转换（从Keycloak的roles字段提取权限）
            converter.setJwtGrantedAuthoritiesConverter(jwt -> {
                List<String> roles = jwt.getClaimAsStringList("roles");
                return roles.stream()
                    .map(role -> new SimpleGrantedAuthority("ROLE_" + role))
                    .collect(Collectors.toList());
            });
            
            JwtAuthenticationProvider provider = new JwtAuthenticationProvider(decoder);
            provider.setJwtAuthenticationConverter(converter);
            return new ProviderManager(provider);
        });
    }
}

Spring Security 6.x移除了WebSecurityConfigurerAdapter，改用SecurityFilterChain配置，代码更简洁，动态Issuer的处理更原生。

关键注意事项 #

• 错误处理：需捕获Realm不存在的场景（比如JWKS请求失败），返回401 Unauthorized或403 Forbidden
• 缓存策略：对JWKS配置、客户端信息做缓存，减少对Keycloak的请求压力
• 权限控制：根据Realm和Token中的角色，实现细粒度的权限校验

内容的提问来源于stack exchange，提问作者Ragin