I developed a client server application with angular java and keycloak everything works well with a docker for keycloak ensiute I put my UI under docker all works well, last step I but my java code and there I always get a 401 not understand . I tried to get my code out and run it on a linux as a docker doesn’t work either. but only on window and the rest on linux no problem. here are my config and code in java.
This is the adapter
@KeycloakConfiguration
@ConditionalOnProperty(name = "keycloak.enabled", havingValue = "true", matchIfMissing = true)
class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
@Autowired
private Cors cors;
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
auth.authenticationProvider(keycloakAuthenticationProvider);
}
@Bean
public CorsConfigurationSource corsConfigurationSource() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
for (String origin : cors.getAllowedOrigin()) {
config.addAllowedOrigin(origin);
}
for (String method : cors.getAllowedMethods()) {
config.addAllowedMethod(method);
}
for (String header : cors.getAllowedHeaders()) {
config.addAllowedHeader(header);
}
config.setAllowCredentials(true);
config.setMaxAge(cors.getMaxAge());
source.registerCorsConfiguration(cors.getMapping(), config);
return source;
}
@Bean
@Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
//return new NullAuthenticatedSessionStrategy();
return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
http.cors().and().csrf().disable().sessionManagement()
// use previously declared bean
.sessionAuthenticationStrategy(sessionAuthenticationStrategy())
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
// keycloak filters for securisation
.and().addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
.addFilterBefore(keycloakAuthenticationProcessingFilter(), X509AuthenticationFilter.class)
.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
// delegate logout endpoint to spring security
.and().logout().addLogoutHandler(keycloakLogoutHandler()).logoutUrl("/logout").logoutSuccessHandler(
// logout handler for API
(HttpServletRequest request, HttpServletResponse response,
Authentication authentication) -> response.setStatus(HttpServletResponse.SC_OK))
.and()
// manage routes securisation here
.authorizeRequests().antMatchers(HttpMethod.OPTIONS).permitAll()
.antMatchers("/logout", "/", "/unsecured").permitAll().antMatchers("/poc").hasRole("poc")
.antMatchers("/admin").hasRole("admin").antMatchers("/all").hasRole("all").anyRequest().denyAll();
}
}
Resolver
public class CustomKeycloakSpringBootConfigResolver extends KeycloakSpringBootConfigResolver {
private final KeycloakDeployment keycloakDeployment;
public CustomKeycloakSpringBootConfigResolver(KeycloakSpringBootProperties properties) {
keycloakDeployment = KeycloakDeploymentBuilder.build(properties);
}
@Override
public KeycloakDeployment resolve(HttpFacade.Request facade) {
return keycloakDeployment;
}
}
this is my docker compose file
version: '3'
volumes:
postgres_data:
driver: local
services:
pack-solution-postgres-keycloak:
container_name: pack-solution-postgres-keycloak
image: postgres
volumes:
- postgres_data:/var/lib/postgresql/data
networks:
- pack-solution-network
environment:
- POSTGRES_PASSWORD=keycloak
- POSTGRES_DB=keycloak
- POSTGRES_USER=keycloak
pack-solution-keycloak:
container_name: pack-solution-keycloak
image: jboss/keycloak
depends_on:
- pack-solution-postgres-keycloak
volumes:
- ./Scripts/keycloak/Init-keycloak.json:/opt/jboss/keycloak/imports/Init-keycloak.json
- ./pack-theme:/opt/jboss/keycloak/themes/pack-theme
- ./fileconfig/standalone.xml:/opt/jboss/keycloak/standalone/configuration/standalone.xml
command:
- "-b 0.0.0.0 -Dkeycloak.import=/opt/jboss/keycloak/imports/Init-keycloak.json"
networks:
- pack-solution-network
environment:
- DB_VENDOR=POSTGRES
- DB_ADDR=pack-solution-postgres-keycloak
- DB_DATABASE=keycloak
- DB_USER=keycloak
- DB_PASSWORD=keycloak
- KEYCLOAK_USER=admin
- KEYCLOAK_PASSWORD=admin
- KEYCLAOK_HOSTNAME=pack-solution-keycloak
- PROXY_ADDRESS_FORWARDING=true
ports:
- 8080:8080
pack-solution-ui:
container_name: pack-solution-ui
build: ./ui/dev
networks:
- pack-solution-network
ports:
- 4200:80
pack-solution-api:
container_name: pack-solution-api
build: ./api/dev
links:
- pack-solution-keycloak
networks:
- pack-solution-network
ports:
- 8081:8080
networks:
pack-solution-network:
driver: bridge
my application.yml
########################################
# Spring Boot / Server configuration
########################################
server:
port: 8080
use-forward-headers: true
########################################
# Spring Boot / Keycloak Configuration
########################################
keycloak:
enabled: true
auth-server-url: http://pack-solution-keycloak:8080/auth
#auth-server-url: http://localhost:8080/auth
realm: Pack-Solutions
resource: PackApi
ssl-required: external
#bearer-only: false
#enable-basic-auth: false
#use-resource-role-mappings : true
verify-token-audience: true
credentials:
secret: 04ae23ef-a331-427b-8160-15edd68e78e9
cors: true
##################################################
#keycloak.securityConstraints[0].securityCollections[0].name: insecure endpoint
#keycloak.securityConstraints[0].securityCollections[0].patterns[0]: /unsecured
#keycloak.securityConstraints[0].securityCollections[0].patterns[1]: /
#keycloak.securityConstraints[1].authRoles[0]: poc
#keycloak.securityConstraints[1].securityCollections[0].patterns[0]: /*
######################################
# CORS
######################################
cross-origin-resource-sharing:
allowed-origin:
- http://pack-solution-ui:4200/*
- http://localhost:4200/*
- http://localhost:4200
- http://pack-solution-ui:4200
mapping: /**
allowed-methods:
- POST
- GET
- OPTIONS
- DELETE
- PUT
allowed-headers:
- WWW-Authenticate
- Authorization
- Content-Type
- xsrf-token
exposed-headers:
- WWW-Authenticate
- xsrf-token
max-age: 600
logging:
level:
org:
springframework:
security: DEBUG
web: DEBUG
Please if you have question or answer?
This is work on Windows 10 but not on linux …
zonaut
April 2, 2020, 5:25pm
2
Can you show us the configuration you’ve done in your Angular app for Keycloak?
export function initializer(keycloak: KeycloakService): () => Promise<any> {
return (): Promise<any> => keycloak.init({
config: {
url: 'http://localhost:8080/auth',
realm: 'Pack-Solutions',
clientId: 'PACK-Solutions'
},
initOptions: {
onLoad: 'login-required',
checkLoginIframe: false
},
enableBearerInterceptor: true,
bearerPrefix: 'Bearer',
bearerExcludedUrls: [
'/assets',
'/clients/public']
});
}
Hi Zonaut , I rephrase my question it’s more clear?
zonaut
April 2, 2020, 9:31pm
5
I meant the description of your issue because it mentions Docker but it’s not clear what situation does work or not.
You are using localhost to test your setup or are you using host name?http://pack-solution-keycloak:8080/auth is reachable.
You can always put this setup in a Git repo so we can have a closer look an try running it.
if I start mu rest api on windows and keycloak on linux it’s work fine. but in all linux configuration in docker or in my linux os my rest api alway return 401. this is work only in window… this is my docker configuration:
FROM openjdk:8
COPY backend-0.0.1-SNAPSHOT.jar app.jar
copy application.yml application.yml
ENTRYPOINT [“java”,"-Djava.security.egd=file:/dev/./urandom","-Dspring.config.location=application.yml","-jar","/app.jar"]
If its work on windows I have this stack:
2020-04-01 13:27:37.919 DEBUG 24356 — [nio-8081-exec-2] o.s.security.web.FilterChainProxy : /poc at position 1 of 17 in additional filter chain; firing Filter: ‘WebAsyncManagerIntegrationFilter’/ ] and supported [application/json]
and on linux I have this stack and it’s can’t work:
pack-solution-api | 2020-04-02 20:06:35.115 DEBUG 1 — [nio-8080-exec-2] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
zonaut
April 2, 2020, 11:22pm
9
The beginning of the Linux log you posted shows that there is being a redirect to /error so the error is happening before that. You need to see what happens before that.http://pack-solution-keycloak:8080/auth is reachable from within the Docker container.
zonaut
April 3, 2020, 4:29pm
11
Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter
Try adding ‘Strict-Transport-Security’ your allowed headers config or enable all headers for now
Also try reaching http://pack-solution-keycloak:8080/auth/realms/Pack-Solutions/.well-known/openid-configuration from withing your docker container
zonaut
April 6, 2020, 1:34pm
14
Yeah I think I see your problem. You are trying to call Keycloak on localhost in your Spring boot Docker container, it doesn’t know of anything running there on port 8080, only the spring boot application.
That’s why I mentioned that it had to be Docker because of Windows/Linux, it seems that your Docker on Windows runs in host mode or something.
You need to use http://pack-solution-keycloak:8080/auth/realms/Pack-Solutions/.well-known/openid-configuration
Bash into your spring boot container and try to curl http://pack-solution-keycloak:8080/auth/realms/Pack-Solutions/.well-known/openid-configuration first so you know it works that way.
I put this in tomcat under windows And I have same trouble
But I have public key
zonaut
April 9, 2020, 12:01pm
16
Is your previous problem solved? It would be great if you could reply on previous comments without throwing new problems into the mix.
no is the same error, but I active more verbose
zonaut
April 9, 2020, 2:26pm
18
It could be a problem with the naming of your clients, Linux is case sensitive so make sure you use the correct client name everywhere. Best to be safe and only use lowercase chars when naming things.