如何在Micronaut GraphQL中使用Keycloak JWT进行身份验证

Question

我正在尝试使用keycloak JWT使用Micronaut GraphQL。我能够让事情与基本认证工作，试图转移到承载令牌，而我错过了一些东西，因为我总是得到401未经授权，但我没有看到任何有用的错误消息在日志中，即使日志设置为TRACE

使用Micronaut 3.0.0.

我的应用程序。Yml看起来像这样:

micronaut:
application:
name: myapp
server:
cors:
enabled: true
port: 8080
security:
authentication: bearer
intercept-url-map:
- pattern: /graphiql
access:
- isAnonymous()
- pattern: /graphql
access:
- isAuthenticated()
endpoints:
login:
enabled: false
token:
jwt:
enabled: true
signatures:
jwks:
keycloak:
url: http://xx.xx.xx.xx:8090/auth/realms/myrealm/protocol/openid-connect/certs
oauth2.clients.keycloak:
grant-type: password
client-id: myapp-backend
client-secret: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
authorization:
url:  http://xx.xx.xx.xx:8090/auth/realms/myrealm/protocol/openid-connect/auth
custom:
keycloak:
url: http://xx.xx.xx.xx:8090
graphql:
enabled: true
path: /graphql
graphiql:
enabled: true
path: /graphiql

下面是我要测试的内容:

curl --location --request POST 'localhost:8080/graphql' 
--header 'Authorization: Bearer {exceptionally long jwt token}' 
--header 'Content-Type: application/json' 
--data-raw '{"query":"query test { scenarios { id } }","operationName":"test"}'

我不确定还能提供什么有用的东西。任何想法吗?

Answer 1

我不太了解Micronaut，但这不是缺少一个像这样的开放配置吗:

micronaut:
security:
oauth2.clients.keycloak.openid:
issuer: http://xx.xx.xx.xx:8090/auth/realms/myrealm

Answer 2

在调试器中进行了更多的搜索和逐步执行之后，我终于能够确定我输入了错误的域名。

然而，为了子孙后代，这里是我需要运行的最小配置:

micronaut:
application:
name: myapplication
server:
cors:
enabled: true
port: 8080
security:
enabled: true
authentication: bearer
intercept-url-map:
- pattern: /graphiql
access:
- isAnonymous()
- pattern: /graphql
access:
- isAuthenticated()
endpoints:
login:
enabled: false
token:
jwt:
enabled: true
signatures:
jwks:
keycloak:
url: http://xx.xx.xx.xx:8090/auth/realms/MyRealm/protocol/openid-connect/certs
oauth2.clients.keycloak:
grant-type: password
client-id: myapp-backend
client-secret: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
authorization:
url: http://xx.xx.xx.xx:8090/auth/realms/MyRealm/protocol/openid-connect/auth
custom:
keycloak:
url: http://xx.xx.xx.xx:8090/auth/realms/MyRealm
graphql:
enabled: true
graphiql.enabled: true
graphql-ws.enabled: true