Keycloak policy enforcement authorization with spring boot 3 #23287

nazmul-prince · 2023-09-15T11:44:43Z

nazmul-prince
Sep 15, 2023

Hello guys, I tried to implement http method scope based authorization for the same uri resource then its not working. For example:
I've created 2 resources in keyckloak for my client:

view employee resource with uri /employee, then assign GET scope there and add a role based policy(with role view_employee) for this and add a corresponding permission.
edit employee resource, with the uri /employee, then assign POST scope there and add a role based policy (with role edit_employee) for this and add a corresponding permission.

Now when the user with the role view_employee try to access GET /employee, then it got forbidden. In the log I check that spring boot always sending challange with to check the policy enforcement edit employee resource whenever the /employee api is called with either GET or POST method.

Is there any way to achieve this so that same uri resource could be authorized idependently in keycloak from spring boot 3?

Here is my application.properties:

server.port=8282

logging.level.org.keycloak=DEBUG

policy-enforcer.realm=acc
policy-enforcer.auth-server-url=http://localhost:8080
policy-enforcer.resource=hrm
policy-enforcer.credentials.secret=EEFfiW0uxaATdQGveeUd2AjTEi38uh5K
policy-enforcer.lazy-load-paths=true
policy-enforcer.http-method-as-scope=true

spring.security.oauth2.resourceserver.jwt.issuer-uri=http://localhost:8080/realms/acc
spring.security.oauth2.resourceserver.jwk-set-uri= ${spring.security.oauth2.resourceserver.jwt.issuer-uri}/protocol/openid-connect/certs

jwt.auth.converter.resource-id= hrm
jwt.auth.converter.principal-attribute= sub

Here is my simple security config:

package com.keycloak.permissions.configurations;

import lombok.RequiredArgsConstructor;
import org.keycloak.adapters.authorization.integration.jakarta.ServletPolicyEnforcerFilter;
import org.keycloak.adapters.authorization.spi.ConfigurationResolver;
import org.keycloak.adapters.authorization.spi.HttpRequest;
import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
import org.keycloak.util.JsonSerialization;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import java.io.IOException;

@RequiredArgsConstructor
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true, jsr250Enabled = true)
public class WebSecurityConfig {
	private final JwtAuthConverter jwtAuthConverter;

	@Value("${spring.security.oauth2.resourceserver.jwk-set-uri}")
	String jwkSetUri;

	@Bean
	@ConfigurationProperties(prefix = "policy-enforcer")
	public PolicyEnforcerConfig policyEnforcerConfig()
	{
		return new PolicyEnforcerConfig();
	}


	@Bean
	public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity, PolicyEnforcerConfig policyEnforcerConfig) throws Exception {
		httpSecurity
				.authorizeHttpRequests(authorize -> authorize
						.anyRequest().authenticated()
				);
		httpSecurity
				.oauth2ResourceServer(oauth2 -> oauth2
						.jwt(jwtConfigurer -> jwtConfigurer.jwtAuthenticationConverter(jwtAuthConverter)))
//				.addFilterAfter(createPolicyEnforcerFilter(), BearerTokenAuthenticationFilter.class);
		.addFilterAfter(new ServletPolicyEnforcerFilter(httpRequest -> policyEnforcerConfig),
				BearerTokenAuthenticationFilter.class);

		httpSecurity.sessionManagement(session -> session
				.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
		return httpSecurity.build();
	}

	@Bean
	CorsConfigurationSource corsConfigurationSource() {

		final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
		final CorsConfiguration config = new CorsConfiguration();
		config.addAllowedOrigin("*");
		config.addAllowedHeader("*");
		config.addExposedHeader("Authorization");
		config.addAllowedMethod("OPTIONS");
		config.addAllowedMethod("HEAD");
		config.addAllowedMethod("GET");
		config.addAllowedMethod("PUT");
		config.addAllowedMethod("POST");
		config.addAllowedMethod("DELETE");
		config.addAllowedMethod("PATCH");
		source.registerCorsConfiguration("/**", config);
		return source;
	}

	@Bean
	JwtDecoder jwtDecoder() {
		return NimbusJwtDecoder.withJwkSetUri(this.jwkSetUri).build();
	}

}

glaucolrc · 2025-01-17T15:02:53Z

glaucolrc
Jan 17, 2025

Good morning, Nazmul Huda,

I hope you’re doing well.

I’m facing the same issue you described regarding the http-method-as-scope configuration in Keycloak. Were you able to solve it?

If so, could you share how you resolved it or provide any guidance? That would be extremely helpful.

Thank you very much for your attention!

Best regards,
Glauco Luiz

0 replies

marciprete · 2025-05-30T16:56:24Z

marciprete
May 30, 2025

Hello all,
long time ago, before spring boot adapter were deprecated, I wrote a java library to simplify this configuration.
I have just completed a new version, that works with Spring Boot 3, spring 6 and Keycloak 25+

I would greatly appreciate any comment, here's the repo:
https://github.com/marciprete/spring-boot-keycloak-policy-enforcer

Ciao
michele

0 replies

Navigation Menu

Repository navigation

Keycloak policy enforcement authorization with spring boot 3 #23287

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Keycloak policy enforcement authorization with spring boot 3 #23287

Uh oh!

Uh oh!

nazmul-prince Sep 15, 2023

Replies: 2 comments

Uh oh!

glaucolrc Jan 17, 2025

Uh oh!

Uh oh!

marciprete May 30, 2025

nazmul-prince
Sep 15, 2023

glaucolrc
Jan 17, 2025

marciprete
May 30, 2025