移除offline_access角色后Keycloak报not_allowed错误求助

我们有一个运行在Tomcat 9上的JSF应用，使用*Keycloak（v10.0.2）*实现登录功能。由于Keycloak已弃用其tomcat-adapter，我们计划从Keycloak tomcat-adapter切换为pac4j。

已完成的配置 #

1. SecurityConfigFactory代码配置 #

import org.pac4j.core.client.Clients;
import org.pac4j.core.config.Config;
import org.pac4j.core.config.ConfigFactory;
import org.pac4j.oidc.client.KeycloakOidcClient;
import org.pac4j.oidc.config.KeycloakOidcConfiguration;

import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;

public class SecurityConfigFactory implements ConfigFactory {

  @Override
  public Config build(final Object... parameters) {
    System.out.print("Building Security configuration...\n");

    final KeycloakOidcConfiguration keycloak = new KeycloakOidcConfiguration();
    keycloak.setBaseUri("http://localhost:8180/auth");
    keycloak.setRealm("testRealm");
    keycloak.setClientId("local-test");
    keycloak.setSecret("abc-xyz");
    keycloak.setClientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
    keycloak.setLogoutUrl("http://localhost:8180/auth/realms/testRealm/protocol/openid-connect/logout");
    final KeycloakOidcClient keycloakClient = new KeycloakOidcClient(keycloak);
    keycloakClient.setName("keycloakClient");

    final String callbackUrl = "http://localhost:8080/callback";
    final Clients clients = new Clients(callbackUrl, keycloakClient/* , new AnonymousClient() */);

    final Config config = new Config(clients);
    return config;
  }

}

2. web.xml过滤器配置 #

<filter>
    <filter-name>callbackFilter</filter-name>
    <filter-class>org.pac4j.j2e.filter.CallbackFilter</filter-class>
    <init-param>
        <param-name>defaultUrl</param-name>
        <param-value>/</param-value>
    </init-param>
    <init-param>
        <param-name>renewSession</param-name>
        <param-value>false</param-value>
    </init-param>
    <init-param>
        <param-name>multiProfile</param-name>
        <param-value>false</param-value>
    </init-param>
    <init-param>
        <param-name>saveInSession</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>callbackFilter</filter-name>
    <url-pattern>/callback</url-pattern>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>


<filter>
    <filter-name>OidcFilter</filter-name>
    <filter-class>org.pac4j.j2e.filter.SecurityFilter</filter-class>
    <init-param>
        <param-name>configFactory</param-name>
        <param-value>abc.xyz.SecurityConfigFactory</param-value>
    </init-param>
    <init-param>
        <param-name>clients</param-name>
        <param-value>keycloakClient</param-value>
    </init-param>
    <init-param>
        <param-name>authorizers</param-name>
        <param-value>securityHeaders</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>OidcFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>FORWARD</dispatcher>
</filter-mapping>

问题现象 #

当用户拥有offline_access角色时可以正常登录Keycloak，但一旦移除该角色，点击Keycloak登录按钮就会抛出如下异常：

2022-12-14 10:19:11,304 DEBUG [http-nio-8080-exec-10]  - authenticator.OidcAuthenticator.validate - Token response: status=400, content={"error":"not_allowed",
"error_description":"Offline tokens not allowed for the user or client"}
...
org.pac4j.core.exception.TechnicalException: Bad token response, error=not_allowed
    at org.pac4j.oidc.credentials.authenticator.OidcAuthenticator.validate(OidcAuthenticator.java:147)
    at org.pac4j.oidc.credentials.authenticator.OidcAuthenticator.validate(OidcAuthenticator.java:35)
    at org.pac4j.core.client.BaseClient.retrieveCredentials(BaseClient.java:71)
    at org.pac4j.core.client.IndirectClient.getCredentials(IndirectClient.java:140)
    at org.pac4j.core.engine.DefaultCallbackLogic.perform(DefaultCallbackLogic.java:89)
    at org.pac4j.j2e.filter.CallbackFilter.internalFilter(CallbackFilter.java:84)
    at org.pac4j.j2e.filter.AbstractConfigFilter.doFilter(AbstractConfigFilter.java:84)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)

我认为需要在配置中设置不使用离线令牌，或者是否有我忽略的明显配置项？

Keycloak中记录的事件显示当前登录请求在申请offline_access权限。

依赖配置（Java 8环境） #

<dependency>
        <groupId>org.pac4j</groupId>
        <artifactId>j2e-pac4j</artifactId>
        <version>4.1.0</version>
    </dependency>
    <dependency>
        <groupId>org.pac4j</groupId>
        <artifactId>pac4j-oidc</artifactId>
        <version>3.9.0</version>
    </dependency>

内容的提问来源于stack exchange，提问作者JavaMan