Spring Cloud Docker环境下Keycloak创建用户时HTTP 401未授权错误

在Docker运行的Spring Cloud示例中，通过API网关请求http://localhost:8600/api/v1/users/signup调用用户服务创建Keycloak用户时，控制台输出HTTP 401 Unauthorized错误。

错误日志 #

2022-08-24 10:45:22.610  INFO 1 --- [nio-9000-exec-1] c.s.u.controller.UserController          : UserController | signUpUser is started
2022-08-24 10:45:22.610  INFO 1 --- [nio-9000-exec-1] c.s.u.controller.UserController          : UserController | signUpUser | SignUpRequest role : ROLE_USER
2022-08-24 10:45:22.610  INFO 1 --- [nio-9000-exec-1] c.s.u.controller.UserController          : UserController | signUpUser | SignUpRequest email : springbootmicroserviceuser@user.com
2022-08-24 10:45:22.611  INFO 1 --- [nio-9000-exec-1] c.s.u.controller.UserController          : UserController | signUpUser | SignUpRequest name : Micro User
2022-08-24 10:45:22.623  INFO 1 --- [nio-9000-exec-1] c.s.u.service.impl.UserServiceImpl       : UserServiceImpl | signUpUser is started
2022-08-24 10:45:22.627  INFO 1 --- [nio-9000-exec-1] c.s.u.service.impl.KeycloakServiceImpl   : KeycloakServiceImpl | createUserWithKeycloak is started
2022-08-24 10:45:22.763 ERROR 1 --- [nio-9000-exec-1] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is javax.ws.rs.ProcessingException: javax.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized] with root cause

javax.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized

用户服务Keycloak配置类 #

@Configuration
public class KeycloakConfig {

    public final static String serverUrl = "http://keycloak:8080";
    public final static String realm = "master";
    public final static String clientId = "spring-boot-microservice-keycloak";
    public final static String clientSecret = "ZDyqUYwec1qUeTdxiM2Ym99KiPE73vzU";
    final static String userName = "admin";
    final static String password = "admin";

    @Bean
    public KeycloakConfigResolver keycloakConfigResolver(){
        return new KeycloakSpringBootConfigResolver();
    }

    @Bean
    public Keycloak keycloak(){
          return Keycloak.getInstance(serverUrl,
                realm,
                userName,
                password,
                clientId,
                clientSecret);
    }
}

Docker-compose中的Keycloak配置 #

keycloak:
    image: quay.io/keycloak/keycloak:18.0.2
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=admin
    ports:
      - "8181:8080"
    networks:
      - backend
    command:
      - start-dev

解决方案 #

• 检查Keycloak客户端配置：确保spring-boot-microservice-keycloak客户端在master realm中已创建，且：
  • 访问类型设置为confidential
  • 开启Service Accounts Enabled选项
  • 为服务账号分配manage-users、create-users等master realm管理权限
• 验证容器网络连通性：确认用户服务容器与Keycloak容器处于同一backend网络，且Keycloak服务正常启动
• 核对认证参数：确认配置中的clientSecret、管理员账号密码与Keycloak后台实际值一致，注意Keycloak 18+版本需从客户端Credentials标签页获取密钥
• 匹配版本兼容性：确保项目中Keycloak Java客户端版本与服务端18.0.2版本一致，避免版本不兼容问题
• 查看Keycloak日志：执行docker logs <keycloak容器ID>查看服务端详细日志，定位具体认证失败原因

内容的提问来源于stack exchange，提问作者Sercan Noyan Germiyanoğlu