3

Keycloak version 2.4.0_FINAL.

In my Spring Boot REST API, I want to verify bearer tokens in Keycloak.

I followed the following steps:

I added the maven dependencies and the following to the application.properties.

keycloak.realm = realm
keycloak.auth-server-url = http://localhost:8080/auth
keycloak.ssl-required = external
keycloak.resource = app
keycloak.bearer-only = true
keycloak.credentials.secret = ...

keycloak.securityConstraints[0].securityCollections[0].patterns[0] = /r/secure/*

What is the next step? According to me, this was the last step but it does not seem to do something.

Update application.properties:

server.port = 8081
org.keycloak keycloak-tomcat8-adapter 2.4.0.Final
keycloak.realm = myapp
keycloak.auth-server-url = http://localhost:8080/auth
keycloak.ssl-required = external
keycloak.resource = mybackend
keycloak.bearer-only = true
keycloak.credentials.secret = ...
keycloak.use-resource-role-mappings = false

keycloak.securityConstraints[0].securityCollections[0].name = secure
keycloak.securityConstraints[0].securityCollections[0].patterns[0] = /r/secure/*
12
  • What is your question, what is not working? Apr 17, 2017 at 18:25
  • When is keycloak verifying the token? I can still access the api without token, no feedback.
    – user5853948
    Apr 17, 2017 at 19:54
  • on which port is spring boot running and on which port keycloak? Apr 18, 2017 at 5:05
  • spring boot at port 8081 (other than default)
    – user5853948
    Apr 18, 2017 at 8:45
  • 1
    I've got the spring security adapter + spring boot working all together properly. However, if your configuration is not working for you, you should do some debugging. Enable the logs for keycloak adapter (passing logging.level.org.keycloak=DEBUG) and see what's going on.
    – Aritz
    Apr 19, 2017 at 14:37

2 Answers 2

2

Your security constraint must at least contain a role , i.e :

keycloak.security-constraints[0].securityCollections[0].authRoles[0]=admin

Be sure to add this role in keycloak and assign it to your user.

4
  • Thanks for the solution to this problem.
    – user5853948
    Apr 22, 2017 at 12:41
  • I now get this error on the server: NOT_ATTEMPTED: bearer only
    – user5853948
    Apr 22, 2017 at 12:42
  • Added new question: stackoverflow.com/questions/43559997/…
    – user5853948
    Apr 22, 2017 at 13:48
  • I don't have enough SO reputation to comment on the other question but for some reasons your Spring Boot app doesn't think the http request is an XHR request Apr 25, 2017 at 8:11
2

You can solve your problem using spring security, if that's an option for you. I find it better. The instructions can be found here.

For example:

@Override
protected void configure(HttpSecurity http) throws Exception
{
    super.configure(http);
    http
            .authorizeRequests()
            .antMatchers("/customers*").hasRole("USER")
            .antMatchers("/admin*").hasRole("ADMIN")
            .anyRequest().permitAll();
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.