0

我正在使用Quarkus框架编写一套服务。这些服务被设计为多租户，并且应该使用 KeyCloak 进行保护。每个租户都有一个单独的 KeyCloak 安全领域，有自己的一组用户、组、角色等。

我找到了Quarkus guide to KeyCloak protection，解释了如何配置 JAX-RS 以使用 KeyCloak 进行授权。但是，本指南假设只有 1 个 KeyCloak 领域。我还发现这个示例展示了如何将 WAR 文件部署到 Wildfly，该文件根据指定的领域加载多个 KeyCloak 领域配置文件之一。

但是，尚不清楚此代码是否可以转换为 Quarkus。
是否可以通过这种方式在 Quarkus 中动态加载 KeyCloak 配置？有没有更好的方法来为这些 Quarkus 服务实现多租户安全？

更新： 根据下面 Pedro 和 Shadov 的建议，我添加了一个非常简单的KeycloakConfigResolver实现并将其标记为@ApplicationScoped. 但是，当我尝试启动 Quarkus 时，我得到以下异常并且从未看到我的自定义KeycloakConfigResolver被调用：

17:53:55,340 INFO  [io.qua.dep.QuarkusAugmentor] Beginning quarkus augmentation
17:53:55,758 INFO  [org.jbo.threads] JBoss Threads version 3.0.0.Beta4
17:53:56,888 INFO  [org.hib.Version] HHH000412: Hibernate Core {5.4.3.Final}
17:53:57,812 INFO  [io.qua.dep.QuarkusAugmentor] Quarkus augmentation completed in 2472ms
17:53:57,967 ERROR [io.qua.dev.DevModeMain] Failed to start quarkus: java.lang.ExceptionInInitializerError
    at java.base/java.lang.J9VMInternals.ensureError(J9VMInternals.java:193)
    at java.base/java.lang.J9VMInternals.recordInitializationFailure(J9VMInternals.java:182)
    at java.base/java.lang.J9VMInternals.newInstanceImpl(Native Method)
    at java.base/java.lang.Class.newInstance(Class.java:2082)
    at io.quarkus.runner.RuntimeRunner.run(RuntimeRunner.java:117)
    at io.quarkus.dev.DevModeMain.doStart(DevModeMain.java:166)
    at io.quarkus.dev.DevModeMain.main(DevModeMain.java:88)
Caused by: java.lang.RuntimeException: Failed to start quarkus
    at io.quarkus.runner.ApplicationImpl1.<clinit>(ApplicationImpl1.zig:333)
    ... 5 more
Caused by: java.lang.RuntimeException: com.fasterxml.jackson.databind.exc.MismatchedInputException: No content to map due to end-of-input
 at [Source: UNKNOWN; line: 1, column: 0]
    at org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:198)
    at org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:187)
    at io.quarkus.keycloak.KeycloakTemplate.createKeycloakDeploymentContext(KeycloakTemplate.java:36)
    at io.quarkus.deployment.steps.KeycloakAdapterProcessor$configureAdapter5.deploy_0(KeycloakAdapterProcessor$configureAdapter5.zig:47)
    at io.quarkus.deployment.steps.KeycloakAdapterProcessor$configureAdapter5.deploy(KeycloakAdapterProcessor$configureAdapter5.zig:106)
    at io.quarkus.runner.ApplicationImpl1.<clinit>(ApplicationImpl1.zig:207)
    ... 5 more
Caused by: com.fasterxml.jackson.databind.exc.MismatchedInputException: No content to map due to end-of-input
 at [Source: UNKNOWN; line: 1, column: 0]
    at com.fasterxml.jackson.databind.exc.MismatchedInputException.from(MismatchedInputException.java:59)
    at com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:4145)
    at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4000)
    at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3070)
    at org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:196)
    ... 10 more

17:53:57,968 ERROR [io.qua.dev.DevModeMain] Failed to start Quarkus, attempting to start hot replacement endpoint to recover
17:53:58,003 INFO  [org.xnio] XNIO version 3.7.2.Final
17:53:58,017 INFO  [org.xni.nio] XNIO NIO Implementation Version 3.7.2.Final

我的自定义KeycloakConfigResolver是空的，除了一些日志记录语句。我从来没有看到我的resolve方法被调用或任何日志记录语句。下面是实现的样子：

@ApplicationScoped
public class MultiTenantKeycloakConfigResolver implements KeycloakConfigResolver {

    /**
     * Logger for this class
     */
    private static final Logger logger = LoggerFactory.getLogger(MultiTenantKeycloakConfigResolver.class);

    /*
     * (non-Javadoc)
     *
     * @see
     * org.keycloak.adapters.KeycloakConfigResolver#resolve(org.keycloak.adapters.
     * spi.HttpFacade.Request)
     */
    @Override
    public KeycloakDeployment resolve(Request facade) {
        if (logger.isDebugEnabled()) {
            logger.debug("resolve(Request) - start"); //$NON-NLS-1$
        }

        if (logger.isInfoEnabled()) {
            logger.info("resolve(Request) - HERE!!!"); //$NON-NLS-1$
        }

        // TODO Implement method

        if (logger.isDebugEnabled()) {
            logger.debug("resolve(Request) - end"); //$NON-NLS-1$
        }
        return null;
    }

}
4

2 回答 2

2

这在 Spring-Boot 中是可能的，几乎与您发布的示例相同。仅从版本开始4.6.0-Final，他们添加KeycloakSpringBootConfigResolverWrapper了实际检查是否KeycloakConfigResolver已经存在的类。在以前的版本中，它只是放置了自己的解析器。现在您所要做的就是注册一个自定义KeycloakConfigResolverbean，它就可以工作了。

我看到 Quarkus 中有与 keycloak-spring-boot-adapters 中非常相似的类 - https://github.com/quarkusio/quarkus/blob/master/extensions/keycloak/runtime/src/main/java/io/quarkus /keycloak/QuarkusKeycloakConfigResolver.java。代码很明显，无需解释。

Since I'm not familiar with Quarkus, I can't be 100% sure it's gonna work, but the field is annotated with Inject, so it suggests that you can just provide your own resolver, the same way as possible in Spring-Boot and in the example you posted.

于 2019-06-27T01:09:26.917 回答
2

@Shadov, is right. You need a KeycloakConfigResolver.

With Quarkus, you just need to create a class that implements KeycloakConfigResolver. Similar to this.

I'll update the guide with some reference about this.

于 2019-06-27T12:59:54.717 回答