I'm trying to integrate keycloak with a spring boot app and i have a few issues with it.I'm trying to define some endpoints that should be excluded from keycloak validation and let everyone make requests to those endpoints but it's not working.
Here is my config:
keycloak.realm=spring-security-quickstart
keycloak.auth-server-url=######
keycloak.ssl-required=external
keycloak.resource=app-authz-spring-security
keycloak.bearer-only=true
keycloak.credentials.secret=secret
keycloak.securityConstraints[0].authRoles[0]=user
keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/testUser
keycloak.securityConstraints[1].authRoles[0]=offline_access
keycloak.securityConstraints[1].securityCollections[0].patterns[0]=/testAdmin
keycloak.securityConstraints[2].authRoles[0]=offline_access
keycloak.securityConstraints[2].securityCollections[0].patterns[0]=/testResource
keycloak.securityConstraints[3].authRoles[0]=*
keycloak.securityConstraints[3].securityCollections[0].patterns[0]=/test
keycloak.policy-enforcer-config.lazy-load-paths=true
logging.level.root=DEBUG
logging.level.org.springframework.boot=DEBUG
spring.main.banner-mode=CONSOLE
I've tried to use widlcards but whenever i make a call to /test endpoint it gives me 403 forbidden :(
And in my console i see this:
2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] o.a.tomcat.util.net.SocketWrapperBase : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read from buffer: [0]
2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read direct from socket: [230]
2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] o.a.coyote.http11.Http11InputBuffer : Received [GET /test HTTP/1.1
User-Agent: PostmanRuntime/7.22.0
Accept: */*
Cache-Control: no-cache
Postman-Token: c9cb4fdc-af21-40a3-bff0-8463c81e01d6
Host: localhost:8762
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
]
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.adapters.PreAuthActionsHandler : adminRequest http://localhost:8762/test
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase : Security checking request GET /test
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : Checking constraint 'SecurityConstraint[null]' against GET /test --> true
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase : Calling hasUserDataPermission()
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : User data constraint has no restrictions
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase : Calling authenticate()
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.adapters.RequestAuthenticator : NOT_ATTEMPTED: bearer only
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer : Policy enforcement is enabled. Enforcing policy decisions for path [http://localhost:8762/test].
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.a.KeycloakAdapterPolicyEnforcer : Sending challenge
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer : Policy enforcement result for path [http://localhost:8762/test] is : DENIED
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer : Returning authorization context with permissions:
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase : Failed authenticate() test
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] o.a.tomcat.util.net.SocketWrapperBase : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read from buffer: [0]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read direct from socket: [0]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] o.apache.coyote.http11.Http11Processor : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Status in: [OPEN_READ], State out: [OPEN]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint : Registered read interest for [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]]
Where's the problem coming from?Is it because i did the request without a token?Or is it because of the policy enforcer?Also, do i need to make any changes into keyloak dashboard?