Spring Boot集成Keycloak 20.0.2遇OAuth2 401/403认证问题求助

更新说明：关闭客户端认证与授权后，401提示不再出现，但受保护端点会返回403。

我正尝试集成通过Docker容器运行的Keycloak核心版本20.0.2，最初遵循Spring Boot+Keycloak相关教程操作，但参考多个论坛建议后仍无法完成集成。

应用配置（application.properties） #

keycloak.auth-server-url=localhost:1337
keycloak.realm=SARServices
keycloak.resource=sar-login
keycloak.public-client=false
keycloak.principal-attribute=preferred_username
keycloak.credentials.secret=NvkAdEPqbN39ubjqtrjn7dKElgLlUNLj

spring.security.oauth2.client.registration.keycloak.client-id=sar-login
spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.keycloak.scope=openid
spring.security.oauth2.client.provider.keycloak.issuer-uri=https://localhost:1337/realms/SARServices
spring.security.oauth2.client.provider.keycloak.user-name-attribute=preferred_username

Web配置（WebConfig） #

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(jsr250Enabled = true)
class SecurityConfig(
    private val keycloakLogoutHandler: KeycloakLogoutHandler
) {

    @Bean
    fun keycloakConfigResolver(): KeycloakConfigResolver? {
        return KeycloakSpringBootConfigResolver()
    }


    @Bean
    protected fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy {
        return RegisterSessionAuthenticationStrategy(SessionRegistryImpl())
    }

    @Bean
    @Throws(Exception::class)
    fun filterChain(http: HttpSecurity): SecurityFilterChain {
        http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/user/*")
            .hasRole("adventurer")
            .anyRequest()
            .permitAll()
        http.oauth2Login()
            .and()
            .logout()
            .addLogoutHandler(keycloakLogoutHandler)
            .logoutSuccessUrl("/")
        return http.build()
    }
}

Keycloak服务器日志 #

2023-01-07 18:46:55 2023-01-07 17:46:55,045 WARN  [org.keycloak.events] (executor-thread-65) type=CODE_TO_TOKEN_ERROR, realmId=7eec0241-e69f-4d5c-8b7f-7a96926e8315, clientId=sar-login, userId=null, ipAddress=172.18.0.1, error=invalid_client_credentials, grant_type=authorization_code

Docker Compose配置 #

version: '1'
services:
  postgresql:
    image: docker.io/bitnami/postgresql:latest
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
      - POSTGRESQL_USERNAME=bn_keycloak
      - POSTGRESQL_DATABASE=bitnami_keycloak
    volumes:
      - 'postgresql_data:/bitnami/postgresql'
      - './certs:/etc/codelance/cert'

  keycloak:
    image: quay.io/keycloak/keycloak:latest
    command: start --hostname-port=1337
    ports:
      - "1337:8443"
    environment:
      - KC_HOSTNAME=localhost
      - KC_HTTPS_CERTIFICATE_FILE=/etc/codelance/cert/keycloakcert.pem
      - KC_HTTPS_CERTIFICATE_KEY_FILE=/etc/codelance/cert/keycloak.pem
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=password
    depends_on:
      - postgresql
    volumes:
      - './certs:/etc/codelance/cert'
volumes:
  postgresql_data:
    driver: local

相关截图 #

• 登录后的Web响应：
  

• 客户端配置截图：
  
  

内容的提问来源于stack exchange，提问作者Viktor Baert