[英]Keycloak Bad token response, error=not_allowed when user doesn't have the offline_access role
我们有一个在 tomcat 9 上运行的 JSF 应用程序,我们使用 keycloak (v10.0.2) 进行登录。
因为keycloak 弃用了他们的 tomcat-adapter我们想从 keycloak tomcat-adapter 切换到pac4j 。
所以我创建了以下配置。
import org.pac4j.core.client.Clients;
import org.pac4j.core.config.Config;
import org.pac4j.core.config.ConfigFactory;
import org.pac4j.oidc.client.KeycloakOidcClient;
import org.pac4j.oidc.config.KeycloakOidcConfiguration;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
public class SecurityConfigFactory implements ConfigFactory {
@Override
public Config build(final Object... parameters) {
System.out.print("Building Security configuration...\n");
final KeycloakOidcConfiguration keycloak = new KeycloakOidcConfiguration();
keycloak.setBaseUri("http://localhost:8180/auth");
keycloak.setRealm("testRealm");
keycloak.setClientId("local-test");
keycloak.setSecret("abc-xyz");
keycloak.setClientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
keycloak.setLogoutUrl("http://localhost:8180/auth/realms/testRealm/protocol/openid-connect/logout");
final KeycloakOidcClient keycloakClient = new KeycloakOidcClient(keycloak);
keycloakClient.setName("keycloakClient");
final String callbackUrl = "http://localhost:8080/callback";
final Clients clients = new Clients(callbackUrl, keycloakClient/* , new AnonymousClient() */);
final Config config = new Config(clients);
return config;
}
}
并将以下内容添加到我的 web.xml
<filter>
<filter-name>callbackFilter</filter-name>
<filter-class>org.pac4j.j2e.filter.CallbackFilter</filter-class>
<init-param>
<param-name>defaultUrl</param-name>
<param-value>/</param-value>
</init-param>
<init-param>
<param-name>renewSession</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>multiProfile</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>saveInSession</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>callbackFilter</filter-name>
<url-pattern>/callback</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
<filter>
<filter-name>OidcFilter</filter-name>
<filter-class>org.pac4j.j2e.filter.SecurityFilter</filter-class>
<init-param>
<param-name>configFactory</param-name>
<param-value>abc.xyz.SecurityConfigFactory</param-value>
</init-param>
<init-param>
<param-name>clients</param-name>
<param-value>keycloakClient</param-value>
</init-param>
<init-param>
<param-name>authorizers</param-name>
<param-value>securityHeaders</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>OidcFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
所以现在我的问题是,当用户具有 offline_access 角色时,他能够登录到 keycloak。 但是一旦我删除了offline_access角色,如果我在 keycloak 上单击登录按钮,我就会得到这个异常。
2022-12-14 10:19:11,304 DEBUG [http-nio-8080-exec-10] - authenticator.OidcAuthenticator.validate - Token response: status=400, content={"error":"not_allowed",
"error_description":"Offline tokens not allowed for the user or client"}
...
org.pac4j.core.exception.TechnicalException: Bad token response, error=not_allowed
at org.pac4j.oidc.credentials.authenticator.OidcAuthenticator.validate(OidcAuthenticator.java:147)
at org.pac4j.oidc.credentials.authenticator.OidcAuthenticator.validate(OidcAuthenticator.java:35)
at org.pac4j.core.client.BaseClient.retrieveCredentials(BaseClient.java:71)
at org.pac4j.core.client.IndirectClient.getCredentials(IndirectClient.java:140)
at org.pac4j.core.engine.DefaultCallbackLogic.perform(DefaultCallbackLogic.java:89)
at org.pac4j.j2e.filter.CallbackFilter.internalFilter(CallbackFilter.java:84)
at org.pac4j.j2e.filter.AbstractConfigFilter.doFilter(AbstractConfigFilter.java:84)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:745)
所以我认为我必须告诉配置不要使用离线令牌,或者他们明显缺少我的东西?
我的 Pom.xml 包括(我们使用的是 Java 8,我无法获得更新的 pac4j 版本来编译)
<dependency>
<groupId>org.pac4j</groupId>
<artifactId>j2e-pac4j</artifactId>
<version>4.1.0</version>
</dependency>
<dependency>
<groupId>org.pac4j</groupId>
<artifactId>pac4j-oidc</artifactId>
<version>3.9.0</version>
</dependency>
我的问题是我的密钥斗篷测试实例中的密钥斗篷配置错误。
我将“离线访问”客户端范围添加到我的默认客户端范围。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.