Keycloak、Apache Shiro 和 Pac4j 安装/配置

Question

我正在尝试为我的 JSF Web 应用程序实现使用 Keycloak 的身份验证。 我已经花了很多小时了，但它仍然不起作用。 从 Keycloak 登录登录屏幕后，我在 Keycloak 中的登录正在运行，我可以在 Keycloak 的管理门户中看到我的会话。 之后我将被重定向到我的 Web 应用程序。 但在我的网络应用程序中，我仍然没有身份验证，无法登录我的门户网站。 所以我的设置似乎有些问题。

pom.xml：

<pac4jVersion>5.7.0</pac4jVersion>
<bujiVersion>8.0.0</bujiVersion>
<jeePac4jVersion>7.1.0</jeePac4jVersion>

         <dependency>
            <groupId>io.buji</groupId>
            <artifactId>buji-pac4j</artifactId>
            <version>${bujiVersion}</version>
        </dependency>

        <dependency>
            <groupId>org.pac4j</groupId>
            <artifactId>javaee-pac4j</artifactId>
            <version>${jeePac4jVersion}</version>
        </dependency>

        <dependency>
            <groupId>org.pac4j</groupId>
            <artifactId>pac4j-javaee</artifactId>
            <version>${pac4jVersion}</version>
        </dependency>
        <dependency>
            <groupId>org.pac4j</groupId>
            <artifactId>pac4j-core</artifactId>
            <version>${pac4jVersion}</version>
        </dependency>

        <dependency>
            <groupId>org.pac4j</groupId>
            <artifactId>pac4j-cas</artifactId>
            <version>${pac4jVersion}</version>
        </dependency>

        <dependency>
            <groupId>org.pac4j</groupId>
            <artifactId>pac4j-saml</artifactId>
            <version>${pac4jVersion}</version>
        </dependency>

        <dependency>
            <groupId>org.pac4j</groupId>
            <artifactId>pac4j-oidc</artifactId>
            <version>${pac4jVersion}</version>
        </dependency>

        <dependency>
            <groupId>org.pac4j</groupId>
            <artifactId>pac4j-http</artifactId>
            <version>${pac4jVersion}</version>
        </dependency>

这是我的shiro.ini

[main]

#Keycloack
oidcConfig = org.pac4j.oidc.config.OidcConfiguration
oidcConfig.discoveryURI = http://localhost:9009/auth/realms/gixxjobsharing/.well-known/openid-configuration
oidcConfig.clientId = gixxjobsharing-frontend
oidcConfig.secret = UMS5aWN4bnJ5Q0ZlOpEdn1tWcHlbx7H0
oidcConfig.clientAuthenticationMethodAsString = client_secret_basic
#oidcConfig.scope = openid
#oidcConfig.useNonce = true
#oidcConfig.responseType = code
oidcConfig.withState = false
oidcConfig.logoutUrl = http://localhost:9009/auth/realms/gixxjobsharing/protocol/openid-connect/logout

oidcClient = org.pac4j.oidc.client.OidcClient
oidcClient.configuration = $oidcConfig

clients = org.pac4j.core.client.Clients
clients.callbackUrl = http://localhost:8080/gixxjobsharing/callback
clients.clients = $oidcClient

pac4jRealm = io.buji.pac4j.realm.Pac4jRealm
pac4jRealm.principalNameAttribute = preferred_username

pac4jSubjectFactory = io.buji.pac4j.subject.Pac4jSubjectFactory
securityManager.subjectFactory = $pac4jSubjectFactory

config = org.pac4j.core.config.Config
config.clients = $clients

oidcSecurityFilter = org.pac4j.jee.filter.SecurityFilter
oidcSecurityFilter.config = $config
oidcSecurityFilter.clients = $oidcClient

callbackFilter = org.pac4j.jee.filter.CallbackFilter
callbackFilter.defaultUrl = http://localhost:8080/gixxjobsharing
callbackFilter.config = $config

ajaxRequestResolver = org.pac4j.core.http.ajax.DefaultAjaxRequestResolver
ajaxRequestResolver.addRedirectionUrlAsHeader = true
oidcClient.ajaxRequestResolver = $ajaxRequestResolver

#logoutFilter = io.buji.pac4j.filter.LogoutFilter
#logoutFilter.defaultUrl = http://localhost:8080/gixxjobsharing
#logoutFilter.localLogout = true
#logoutFilter.centralLogout = true
#logoutFilter.config = $config


# AuthStrategy
securityManager.realms = $pac4jRealm


# Using default form based security filter org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authc = org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authc.loginUrl = /common/login.jsf
authc.successUrl = /portal/dashboard.jsf


# Redirect to an access denied page if user does not have access rights
#[roles]
#roles.unauthorizedUrl = /common/access-denied.jsf
#perms.unauthorizedUrl = /accessdenied.jsp

anyofpermission = de.dpunkt.myaktion.util.CustomPermissionsAuthorizationFilter

# Protected URLs
[urls]
/callback = callbackFilter

## NO_SECURITY (Rendering)
#/portal/reporting/execution/** = authc, anon




## OTHER
/WEB-INF/layout/portal/** = authc
/portal/** = authc
/admin/** = authc
/community/** = authc

另外，如果我只是尝试从浏览器中调用： http://localhost:8080/myapp/callback

我在 org.pac4j.oidc.profile.creator.OidcProfileCreator.create() 中得到了一个 NPE，因为 getIdToken() 为 NULL...

我的 Keycloak 客户端有这样的设置：

我正在使用 Keycloak 版本 22。 感谢您的帮助

Answer 1

根据规范，似乎可能没有 ID 令牌：https://openid.net/specs/openid-connect-core-1_0.html#Authentication

我认为 pac4j 中有一个错误。我刚刚承诺：https://github.com/pac4j/pac4j/commit/24f263d2c1c50683243edd2413b20e365c127237

可以用5.7.2-SNAPSHOT版本进行测试吗？ （Sonatype 快照存储库）