我正在尝试将keycapture与spring-boot应用程序集成，但我遇到了一些问题。我正在尝试定义一些应该从keycapture验证中排除的端点，并让每个人都向这些端点发出请求，但这不起作用。
这是我的配置：
keycloak.realm=spring-security-quickstart
keycloak.auth-server-url=######
keycloak.ssl-required=external
keycloak.resource=app-authz-spring-security
keycloak.bearer-only=true
keycloak.credentials.secret=secret
keycloak.securityConstraints[0].authRoles[0]=user
keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/testUser
keycloak.securityConstraints[1].authRoles[0]=offline_access
keycloak.securityConstraints[1].securityCollections[0].patterns[0]=/testAdmin
keycloak.securityConstraints[2].authRoles[0]=offline_access
keycloak.securityConstraints[2].securityCollections[0].patterns[0]=/testResource
keycloak.securityConstraints[3].authRoles[0]=*
keycloak.securityConstraints[3].securityCollections[0].patterns[0]=/test
keycloak.policy-enforcer-config.lazy-load-paths=true
logging.level.root=DEBUG
logging.level.org.springframework.boot=DEBUG
spring.main.banner-mode=CONSOLE
我试过使用Widlcard，但每当我调用/测试端点时，它都会给我403禁止：(
在我的控制台上，我看到了这个：
2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] o.a.tomcat.util.net.SocketWrapperBase : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read from buffer: [0]
2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read direct from socket: [230]
2020-03-04 21:45:57.421 DEBUG 4472 --- [nio-8762-exec-6] o.a.coyote.http11.Http11InputBuffer : Received [GET /test HTTP/1.1
User-Agent: PostmanRuntime/7.22.0
Accept: */*
Cache-Control: no-cache
Postman-Token: c9cb4fdc-af21-40a3-bff0-8463c81e01d6
Host: localhost:8762
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
]
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.adapters.PreAuthActionsHandler : adminRequest http://localhost:8762/test
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase : Security checking request GET /test
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : Checking constraint 'SecurityConstraint[null]' against GET /test --> false
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : Checking constraint 'SecurityConstraint[null]' against GET /test --> true
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase : Calling hasUserDataPermission()
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] org.apache.catalina.realm.RealmBase : User data constraint has no restrictions
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase : Calling authenticate()
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.adapters.RequestAuthenticator : NOT_ATTEMPTED: bearer only
2020-03-04 21:45:57.422 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer : Policy enforcement is enabled. Enforcing policy decisions for path [http://localhost:8762/test].
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.a.KeycloakAdapterPolicyEnforcer : Sending challenge
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer : Policy enforcement result for path [http://localhost:8762/test] is : DENIED
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.k.a.authorization.PolicyEnforcer : Returning authorization context with permissions:
2020-03-04 21:45:57.423 DEBUG 4472 --- [nio-8762-exec-6] o.a.c.authenticator.AuthenticatorBase : Failed authenticate() test
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] o.a.tomcat.util.net.SocketWrapperBase : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read from buffer: [0]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Read direct from socket: [0]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] o.apache.coyote.http11.Http11Processor : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]], Status in: [OPEN_READ], State out: [OPEN]
2020-03-04 21:45:57.424 DEBUG 4472 --- [nio-8762-exec-6] org.apache.tomcat.util.net.NioEndpoint : Registered read interest for [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6b4af61c:org.apache.tomcat.util.net.NioChannel@6a67dfe1:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8762 remote=/0:0:0:0:0:0:0:1:51222]]
问题从哪里来？是因为我在没有令牌的情况下提出了请求吗？还是因为政策执行者？此外，我需要对keyloak仪表板进行任何更改吗？
看起来要将"/test"端点公开，只需删除即可：
keycloak.securityConstraints[3].authRoles[0]=*
keycloak.securityConstraints[3].securityCollections[0].patterns[0]=/test
下面是一个关于公共和安全端点的好例子：维修弹簧靴支架
要使/test不安全，可以执行以下操作：
keycloak.securityConstraints[3].securityCollections[0].name=insecure
keycloak.securityConstraints[3].securityCollections[0].patterns[0]=/test
keycloak.policy-enforcer-config.enforcement-mode=PERMISSIVE
keycloak.policy-enforcer-config.paths[0].name=Insecure Resource
keycloak.policy-enforcer-config.paths[0].path=/test
keycloak.policy-enforcer-config.paths[0].enforcement-mode=DISABLED