如何在Spring Thymeleaf中结合Keycloak配置基于角色的权限控制

各位好，我是Spring Thymeleaf新手，以下是我的代码，恳请帮助我解决问题：

@Controller
public class DefaultController {

     @RequestMapping("/default")
        public String defaultAfterLogin(HttpServletRequest request) {
         
            if (request.isUserInRole("ROLE_ADMIN")) {
                
                System.out.println("ROLE_ADMIN");
                return "redirect:/";
                
            }else if(request.isUserInRole("ROLE_USER")) {
                
                System.out.println("ROLE_USER");
                return "redirect:/user";
                
            }else if(request.isUserInRole("ROLE_SH")) {
                
                System.out.println("ROLE_SE");
                return "redirect:/sectionHead";
                
            }
            
            return "redirect:/access-denied";
            
           
        }

}

@Override
protected void configure(HttpSecurity http) throws Exception {
     
    super.configure(http);
    http.csrf().disable();
    http.headers().frameOptions().sameOrigin().and().authorizeRequests()
        
            .antMatchers(("/user"),"/user/**").hasAnyRole("ADMIN","USER")
            .antMatchers(("/sectionHead"),"/reqSectionHead/**").hasRole("SH")
            .anyRequest().authenticated().and().formLogin()
            .defaultSuccessUrl("/default")
            .loginProcessingUrl("/sso/login")
            .and()
            .exceptionHandling().accessDeniedHandler(accessDeniedHandler())
            .and().logout()
            .invalidateHttpSession(true).clearAuthentication(true)
            .logoutRequestMatcher(new AntPathRequestMatcher("/sso/logout")).logoutSuccessUrl("/sso/login").permitAll();
    
}

1. 拼写错误修正 #

在DefaultController的ROLE_SH分支中，打印语句存在拼写错误：

System.out.println("ROLE_SE"); // 应为ROLE_SH

修正后：

System.out.println("ROLE_SH");

2. 移除冗余的默认配置调用 #

继承WebSecurityConfigurerAdapter时，super.configure(http)会引入框架默认的Security规则，可能和你自定义的配置冲突（比如默认开启CSRF，你又手动关闭），建议删除这行代码。

3. 权限判断逻辑优化 #

直接通过Authentication对象获取用户权限，比依赖HttpServletRequest更简洁直观：

@Controller
public class DefaultController {

    @RequestMapping("/default")
    public String defaultAfterLogin(Authentication authentication) {
        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        
        for (GrantedAuthority authority : authorities) {
            String role = authority.getAuthority();
            switch (role) {
                case "ROLE_ADMIN":
                    System.out.println("ROLE_ADMIN");
                    return "redirect:/";
                case "ROLE_USER":
                    System.out.println("ROLE_USER");
                    return "redirect:/user";
                case "ROLE_SH":
                    System.out.println("ROLE_SH");
                    return "redirect:/sectionHead";
            }
        }
        
        return "redirect:/access-denied";
    }
}

4. 路径配置简化 #

antMatchers中的路径写法可去掉多余括号，保持简洁：

.antMatchers("/user", "/user/**").hasAnyRole("ADMIN","USER")
.antMatchers("/sectionHead", "/reqSectionHead/**").hasRole("SH")

5. 登录成功跳转规则优化 #

如果希望无论用户从哪个页面发起登录，成功后都强制跳转到/default，可为defaultSuccessUrl添加alwaysUse = true参数：

.defaultSuccessUrl("/default", true)

默认alwaysUse为false时，会优先跳转到用户之前访问的受保护页面。

内容的提问来源于stack exchange，提问作者Phortsophea MMO