[英]How to enable policy enforcing in keycloak for node.js application?
我必須將 node.js 應用程序與 keycloak 集成。該應用程序是快速的。但政策沒有強制執行。它授予所有用戶訪問所有 api 的權限。 對於 /test api:只有具有“首席”角色的用戶才能訪問。我已經在 keycloak 管理控制台中給出了這些策略。但是這些沒有反映出來。為什么?
沒有“首席”角色的用戶也在訪問 /test
應用程序.js:
'use strict';
const Keycloak = require('keycloak-connect');
const express = require('express');
const session = require('express-session');
const expressHbs = require('express-handlebars');
const app = express();
app.engine('hbs', expressHbs({extname:'hbs',
defaultLayout:'layout.hbs',
relativeTo: __dirname}));
app.set('view engine', 'hbs');
var memoryStore = new session.MemoryStore();
var keycloak = new Keycloak({ store: memoryStore });
app.use(session({
secret:'thisShouldBeLongAndSecret',
resave: false,
saveUninitialized: true,
store: memoryStore
}));
app.use(keycloak.middleware());
app.get('/*', keycloak.protect('user'), function(req, res){
res.send("User has base permission");
});
app.get('/test', keycloak.protect(), function(req, res){
res.send("access granted");
});
app.get('/',function(req,res){
res.send("hello world");
});
app.use( keycloak.middleware( { logout: '/'} ));
app.listen(3000, function () {
console.log('Listening at http://localhost:3000');
});
密鑰斗篷.json:
{
"realm": "nodejs-example",
"auth-server-url": "http://localhost:8180/auth",
"ssl-required": "external",
"resource": "nodejs-connect",
"credentials": {
"secret": "451317a2-09a1-48b8-b036-e578051687dd"
},
"use-resource-role-mappings": true,
"confidential-port": 0,
"policy-enforcer": {
"enforcement-mode":"PERMISSIVE",
}
}
您將 keycloak.json 中的強制模式設置為 PERMISSIVE,我相信這應該是 ENCFORCE。
在json中添加以下行
"verify-token-audience": true
var Keycloak = require('keycloak-connect');
var hogan = require('hogan-express');
var express = require('express');
var session = require('express-session');
const app = express();
var server = app.listen(3000, function () {
var host = server.address().address;
var port = server.address().port;
console.log('Example app listening at http://%s:%s', host, port);
});
app.set('view engine', 'html');
app.set('views', require('path').join(__dirname, '/view'));
app.engine('html', hogan);
var memoryStore = new session.MemoryStore();
var keycloak = new Keycloak({
store: memoryStore });
// session
app.use(session({
secret:'thisShouldBeLongAndSecret',
resave: false,
saveUninitialized: true,
store: memoryStore
}));
app.use(keycloak.middleware({
admin: '/',
protected: '/protected/resourcea'
}));
app.get('/leads/assign',keycloak.enforcer(['leads:assign'],{
claims: function(request){
return {
"location":["chennai"]
}
}
} ), function (req, res) {
res.send("granted");
});
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.