I am attempting to secure a Spring Boot (with Spring Security) app using Keycloak. I am following these guides:
- https://www.keycloak.org/docs/16.1/securing_apps/index.html#_spring_boot_adapter
- https://www.baeldung.com/spring-boot-keycloak
However, the authentication is simply not working; e.g., I can view web pages without being redirected to Keycloak/authenticating. I do not see any errors, however, I notice the following in the console: o.s.s.web.DefaultSecurityFilterChain : Will not secure any request
I am not sure if the above is the root problem or if that is expected because Keycloak overides the chain or something?
My KeycloakWebSecurityConfigurerAdapter
@KeycloakConfiguration
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
KeycloakAuthenticationProvider keycloakAuthenticationProvider =
keycloakAuthenticationProvider();
keycloakAuthenticationProvider
.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
auth.authenticationProvider(keycloakAuthenticationProvider);
}
@Bean
@Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
http.authorizeRequests().anyRequest().authenticated();
}
}
Relevant application properties:
keycloak.realm = myrealm
keycloak.auth-server-url = https://example.com/auth
keycloak.ssl-required = external
keycloak.resource = client-id
keycloak.credentials.secret = pass
I configured a @Bean as follows:
@Bean
public KeycloakSpringBootConfigResolver keycloakConfigResolver() {
return new KeycloakSpringBootConfigResolver();
}
Relevant dependencies:
dependencies {
implementation 'org.springframework.boot:spring-boot-starter-jdbc'
implementation 'org.springframework.boot:spring-boot-starter-security'
implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
implementation 'org.springframework.boot:spring-boot-starter-web'
implementation 'org.keycloak:keycloak-spring-boot-starter:16.1.0'
implementation 'org.mybatis.spring.boot:mybatis-spring-boot-starter:2.2.2'
implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5'
runtimeOnly 'org.postgresql:postgresql'
testImplementation 'org.springframework.boot:spring-boot-starter-test'
testImplementation 'org.springframework.security:spring-security-test'
}