Keycloak 深度解析#

import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

@EnableWebSecurity
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);

        http
            .csrf()
                .disable()
            .authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .antMatchers("/order/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            .and()
            .oauth2ResourceServer()
                .jwt(); 
    }
}

public class KeycloakSecurityContext {

    public boolean validateToken(String token, String realmUrl) {
        try {
            // 1. 获取公开密钥（生产环境应缓存）
            String jwksUri = realmUrl + "/protocol/openid-connect/certs";
            JsonNode keys = fetchJwks(jwksUri);

            // 2. 解析并验证 Token
            DecodedJWT jwt = JWT.decode(token);
            String kid = jwt.getKeyId();

            // 3. 查找对应公钥验证签名
            PublicKey publicKey = getPublicKey(keys, kid);
            JWTVerifier verifier = JWTVerifier.require(publicKey);
            verifier.verify(jwt);

            return true;
        } catch (JWTVerificationException e) {
            return false;
        }
    }

    public Map<String, Object> extractRoles(String token) {
        DecodedJWT jwt = JWT.decode(token);
        return jwt.getClaim("realm_access").asMap();
    }
}

@Service
public class OrderPermissionEvaluator {

    @Autowired
    private KeycloakAuthorizationManager authorizationManager;

    public boolean canAccessOrder(String userId, String orderId, String scope) {
        // 从 OrderService 获取订单所有者
        String orderOwner = orderService.getOwner(orderId);

        // 构建权限请求
        AuthorizationRequest request = AuthorizationRequest.builder()
            .name("OrderResource")
            .type("urn:order-service:orders")
            .scope(scope)
            .claim("owner", orderOwner)
            .build();

        // 评估权限
        AuthorizationResponse response = authorizationManager.authorize(userId, request);
        return response.getDecision() == Decision.PERMIT;
    }
}