Spring Boot 应用程序未重定向到托管在不同服务器上的 Keycloak

Posted 2023-02-19

【中文标题】Spring Boot 应用程序未重定向到托管在不同服务器上的 Keycloak

【英文标题】：Spring Boot Application not redirecting to Keycloak hosted on different server

【发布时间】：2020-08-07 14:53:42

【问题描述】：

我创建了一个由 Keycloak 服务器验证的简单应用程序。我已经在同一台机器上测试了应用程序和 Keycloak 服务器，应用程序运行良好并将我重定向到 Keycloak 以进行相应的领域客户端身份验证。现在我为我的 Keycloak (https://192.162.10.11:8443) 保留了一个单独的服务器，我的 Spring Boot 正在我的本地主机上运行。但是，一旦我尝试访问该服务，该应用程序不会将我重定向到 Keycloak，而是给了我 Whitelable 错误页面。有人可以指导我我做错了什么。我的完整代码详情如下

Application.properties

server.port=8081
keycloak.realm= Myrealm
keycloak.auth-server-url= https://192.162.10.11:8443/auth
keycloak.ssl-required= external
keycloak.resource= backend-app
keycloak.public-client= true
keycloak.confidential-port= 0

** 我的 keycloak 在 https://192.162.10.11:8443 上运行，我可以通过浏览器访问它

Keyclaok 的 Myrealm 设置：

我正在访问的链接是 http://localhost:8081/persons

当 Keycloak 与应用程序在同一台机器上时，此链接正在被验证

MainClass 代码

package sb.keycloak;

import java.security.Principal;
import java.util.ArrayList;
import java.util.List;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.http.ResponseEntity;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;


@SpringBootApplication
@RequestMapping
@CrossOrigin(allowCredentials="true")
public class SbKeycloakApplication 

  @GetMapping(path = "/persons")
  public ResponseEntity<List<Persons>> customers(final Principal principal, final Model model) 
    final var personas = new ArrayList<Persons>();
    personas.add(new Persons(1, "Person1"));
    personas.add(new Persons(2, "Person2"));
    return ResponseEntity.ok(personas);
  

  public static void main(final String[] args) 
    SpringApplication.run(SbKeycloakApplication.class, args);
  

错误截图

编辑

我还将 MyRealm 的 IP 更新为正确的 IP（这是我的 Spring Boot 应用程序运行的 IP - 我的 PC 的 IP），但仍然存在相同的 Whitelable 错误。

编辑 2（在下面添加了白标签错误）

Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback.

Fri Apr 24 10:53:33 PKT 2020
There was an unexpected error (type=Internal Server Error, status=500).
No message available
java.lang.NullPointerException
    at org.keycloak.adapters.OAuthRequestAuthenticator.getRedirectUri(OAuthRequestAuthenticator.java:175)
    at org.keycloak.adapters.OAuthRequestAuthenticator.loginRedirect(OAuthRequestAuthenticator.java:213)
    at org.keycloak.adapters.OAuthRequestAuthenticator.authenticate(OAuthRequestAuthenticator.java:275)
    at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:138)
    at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter.attemptAuthentication(KeycloakAuthenticationProcessingFilter.java:154)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.doFilter(KeycloakPreAuthActionsFilter.java:96)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:96)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve.invoke(AbstractAuthenticatedActionsValve.java:67)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490)
    at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.invoke(AbstractKeycloakAuthenticatorValve.java:181)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:836)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1747)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Thread.java:832)

编译器错误输出

 WARN 38292 --- [nio-8081-exec-2] o.keycloak.adapters.KeycloakDeployment   : Failed to load URLs from https://192.162.10.11:8443/auth/realms/Myrealm/.well-known/openid-configuration

【问题讨论】：

为什么localhost 在来自192.162.10.11 服务器的重定向网址中

感谢您指出先生。我也将它更新到我的 PC 的 IP 192.162.10.15 （从那里运行 spring boot）但仍然存在相同的错误。

检查您是否可以从 keycloak 服务器连接到您电脑的 8081 端口

将您的白标签错误页面堆栈跟踪错误添加为文本而不是图像。

“当 Keycloak 与应用程序在同一台机器上时，此链接正在被验证”可能是 CORS 问题，请尝试在 application.properties 中设置“keycloak.cors = true”

【参考方案1】：

stacktrace 中的NullPointerException 指向OAuthRequestAuthenticator 中的以下行。

KeycloakUriBuilder redirectUriBuilder = deployment.getAuthUrl().clone()

当我在容器化 Spring Boot 应用程序时未能通过环境变量传递 application.properties 值时，我也遇到了同样的问题。原因可能是keycloak.auth-server-url 有一个空值。

【参考方案2】：

可能会检查它是否与不受信任的证书有关，这会导致“加载 URL 失败..”警告，进而在 OAuthRequestAuthenticator.getRedirectUri() 中出现 NullPointerException

【讨论】：

这正是问题所在

请问有什么解决办法？

【参考方案3】：

当 Keycloak 客户端适配器无法首次调用身份验证服务器时，日志中会出现这种模式：

java.lang.NullPointerException
        at org.keycloak.adapters.OAuthRequestAuthenticator.getRedirectUri(OAuthRequestAuthenticator.java:175)

这是对更好的身份验证网址的绝望呼喊。在我的情况下，应该归咎于 https 通信：端口未打开、证书不可信等。