Spring Boot Keycloak not seeing realm roles #12637

bpracht · 2022-06-21T15:07:19Z

bpracht
Jun 21, 2022

I'm using Keycloak 12.0.1 (I can't upgrade, please don't ask :) ) and Spring Boot. I thought adding authentication would be possible but is incredibly difficult. I've followed multiple tutorials, each contributing a little and assuming things work, but when I try to use @RolesAllowed, it does not work.

I can authenticate with KC, when I get the security context, I'm seeing data from KC, such as a username, email, etc. However, it refuses to pass the roles. So when I have a @RolesAllowed, it gives me a 403 because the packaging refused to provide the realm role. For testing purposes, I created a client role for the same user, and it refuses to pass that also. I've checked the list of authorities and see things like ROLE_USER, SCOPE_email, SCOPE_openid, and SCOPE_profile. But no relevant role. Initially, I thought it was because I stopped short of using JWT. But when I added JWT, to my SB program, it didn't care. However, when I accessed this same page using Postman, I was able to get a JWT token that had the roles that I wanted.

I get conflicting advice, and as best as possible, I've tried to stick to guides based on Spring Boot and Keycloak. Occaisionally, I've glanced at OAUTH2 guides, but KC is it's own animal.

Attached is SecurityConfiguration to show how I attempted to define authorization and authentication and a snippet from the WorkQueue controller class.

SecurityConfiguration.java:

package com.mycompany.myapp.configurations;

import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springsecurity.KeycloakConfiguration;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Import;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.core.session.SessionRegistry;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;



// configure in extends WebSecurityConfigurerAdapter 
@EnableWebSecurity
@EnableGlobalMethodSecurity(jsr250Enabled = true)
@KeycloakConfiguration
@Import(KeycloakSpringBootConfigResolver.class)
public class SecurityConfiguration extends KeycloakWebSecurityConfigurerAdapter {

    /**
     * Registers the KeycloakAuthenticationProvider with the authentication manager.
     */
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = new KeycloakAuthenticationProvider();
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
        
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }
    
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
        .antMatchers(
                // Client-side JS
                // TODO
                // "/**",

                // the standard favicon URI
                "/favicon.ico",

                // the robots exclusion standard
                "/robots.txt",

                // web application manifest
                "/manifest.webmanifest", "/sw.js", "/offline.html",
                
                // icons and images
                "/icons/**", "/images/**", "/styles/**", "/css/**", "/js/**",
                "/sw-runtime-resources-precache.js");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
                .authorizeRequests()
                .antMatchers("/work_queue/**").permitAll()//hasRole("myapp")
                .antMatchers("/actuator/**").permitAll()
                .anyRequest().authenticated().and().oauth2Login()
                .and()
                .logout()
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .logoutSuccessUrl("/login?logout")
                .deleteCookies("JSESSIONID")
                .permitAll()
                .and()
                .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
                
//              .permitAll().and().authorizeRequests().anyRequest().authenticated().and().oauth2Login();
//              .formLogin()
//              .loginPage("/login")
//              .permitAll();

    }

    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(buildSessionRegistry());
    }

    @Bean
    protected SessionRegistry buildSessionRegistry() {
        return new SessionRegistryImpl();
    }
}

Snippet from WorkQueueController.java:
When Line A is present, I get a 403 (forbidden). When I comment line A, the method executes, and I'm able to see values I defined in Keycloak:

@Controller
@RequestMapping("/work_queue")
public class WorkQueueController
    @GetMapping
    @RolesAllowed("my-role")  // Line A
    public String work_queue(Principal principal, Model model) {
        log.debug("Principal is a "+principal.getClass().getName());
        OAuth2AuthenticationToken token = (OAuth2AuthenticationToken) principal; 
        Object principal2 = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        Collection<? extends GrantedAuthority> authorities = SecurityContextHolder.getContext().getAuthentication().getAuthorities();
        for(GrantedAuthority authority : authorities) {
            log.debug("Authority: "+authority.getAuthority());
        }
        
        log.debug("Principal2 is a "+principal2.getClass().getName());      
        DefaultOidcUser user = null;
        if(user!=null && user instanceof DefaultOidcUser) {
            user = (DefaultOidcUser) principal2;
        }

//      log.debug("Roles "+simpleKeycloakAccount.getRoles());
        Object principal3 = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        if(principal3 != null && principal3 instanceof DefaultOidcUser) {
            DefaultOidcUser user3 = (DefaultOidcUser)principal3;
//          user = (DefaultOidcUser) principal;
            for(String key : user3.getAttributes().keySet()) {
                Object value = user3.getAttributes().get(key);
                log.debug("user3 key={} value={}",key,value);
            }
    
        }

    }

Snippet of things KC and SB packaging does care to share:

Principal is a org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken
Authority: ROLE_USER
Authority: SCOPE_email
Authority: SCOPE_openid
Authority: SCOPE_profile
Principal2 is a org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser
user3 key=at_hash value=<some-hash-value>
user3 key=sub value=<some-guid>
user3 key=email_verified value=true
user3 key=iss value=https://auth.mycompanytest.com/auth/realms/MyRealmk
user3 key=typ value=ID
user3 key=preferred_username value=ben.pracht@ruralsourcing.com
user3 key=given_name value=Woods
user3 key=nonce value=CZfW09_IKZbF5e0QhL-cDC4Uvk0QIJvmMqys0VmczlQ
user3 key=aud value=[myapp-app]
user3 key=acr value=0
user3 key=azp value=myapp-app
user3 key=auth_time value=2022-06-20T22:56:52Z
user3 key=name value=Woods Man
user3 key=exp value=2022-06-20T23:11:44Z
user3 key=session_state value=aa3e95e1-47e5-463b-a599-bf486a40fc00
user3 key=family_name value=Man
user3 key=iat value=2022-06-20T23:06:44Z
user3 key=email value=<my-email-address>
user3 key=jti value=d0f1b89f-ee20-424f-b12e-1ea869f5e712

Sanitized snippet of application.properties:

keycloak.realm = myrealm
keycloak.auth-server-url = https://auth.mycompany.com/auth 
keycloak.ssl-required = external
keycloak.resource = ${KEYCLOAK_CLIENT_ID}
keycloak.credentials.secret = ${KEYCLOAK_CLIENT_SECRET}
keycloak.use-resource-role-mappings = true
keycloak.bearer-
keycloak.realm-key=<realm-key-from-Ream-Settings->Keys->RS256->Public Key
keycloak.public-client=true

What do I have to do to get Spring Boot+Keycloak to pass in the roles??

kkcmadhu · 2022-06-21T16:13:01Z

kkcmadhu
Jun 21, 2022

you can either see realm roles or client roles and not both.. this is unfortunate but thats how it is.. :(

you can set keycloak.use-resource-role-mappings = false to start using realm roles.

if you want both.. the best option is to control it through client scopes and mappers in the keycloak server.
years ago i raised a an enhancment request, but i thin, its not an issue for majority of users and hence did not get addressed. https://issues.redhat.com/browse/KEYCLOAK-8376

0 replies

bpracht · 2022-06-21T16:35:10Z

bpracht
Jun 21, 2022
Author

Thanks for your reply. Likely my properties have changed since the time of the original post, but I did change the keycloak.user-resource-mappings = false, but it still didn't care. Here's a snippet of what I have so far: ``` keycloak.realm = myrealm keycloak.auth-server-url = https://auth.mcompanytest.com/auth keycloak.ssl-required = external keycloak.resource = ${KEYCLOAK_CLIENT_ID} keycloak.credentials.secret = ${KEYCLOAK_CLIENT_SECRET} keycloak.use-resource-role-mappings = false keycloak.bearer- #keycloak.realm-key=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhtC8a3bnj1zFV2ay9OHn+Zqms3aRkzHtF0/9Dy9RRkvUsCigwdltxaWgwzLBUumVkBzvmHn+0Vpw89prrZ4sKYiWFJ72pMYSk6SgWZzvypHjlKGypLyH/jyk/8spSyx0gT5+l4ca8vbo+BA+aVXBCB+ZrrGXYc5iIMDOWvc/MODceOuUX4CNnC4oKjn+du79xxEMN34aAIxvzYy22aiBTwjdLpcNeIpPF8DLGnLK7QOFaEHNH1SJb/9tioZNQf3zTRwX8y7SRBysmEAHKKmD/085NvxZ04OcRZJRzCiMkUYUYuOkN91gYeobl1LU/zK+1SI3penGWpLD9hiVS5xWfQIDAQAB keycloak.public-client=true #keycloak.principal-attribute=my-email ```

…

On Tue, Jun 21, 2022 at 12:13 PM kkcmadhu ***@***.***> wrote: you can either see realm roles or client roles and not both.. this is unfortunate but thats how it is.. :( you can set keycloak.use-resource-role-mappings = false to start using realm roles. if you want both.. the best option is to control it through client scopes and mappers in the keycloak server. years ago i raised a an enhancment request, but i thin, its not an issue for majority of users and hence did not get addressed. https://issues.redhat.com/browse/KEYCLOAK-8376 — Reply to this email directly, view it on GitHub <#12637 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKZEXVLFQTYYCA22CYZHJFDVQHSZRANCNFSM5ZMWIGQA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

0 replies

Navigation Menu

Repository navigation

Spring Boot Keycloak not seeing realm roles #12637

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Spring Boot Keycloak not seeing realm roles #12637

Uh oh!

bpracht Jun 21, 2022

Replies: 2 comments

Uh oh!

kkcmadhu Jun 21, 2022

Uh oh!

Uh oh!

bpracht Jun 21, 2022 Author

bpracht
Jun 21, 2022

kkcmadhu
Jun 21, 2022

bpracht
Jun 21, 2022
Author