微服务架构下Keycloak授权服务的高效负载处理与JWT验证策略

// build.gradle (或 pom.xml) 中添加依赖
// implementation 'org.springframework.boot:spring-boot-starter-security'
// implementation 'org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure' // For older Spring Boot versions
// For newer Spring Boot versions (Spring Security 5.x+):
// implementation 'org.springframework.security:spring-security-oauth2-resource-server'
// implementation 'org.springframework.security:spring-security-oauth2-jose'

// application.yml (或 application.properties) 配置
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          # Keycloak的JWKS URI，用于获取公钥
          # 例如: http://localhost:8080/realms/your-realm/protocol/openid-connect/certs
          jwk-set-uri: http://keycloak-host:8080/realms/your-realm/protocol/openid-connect/certs
          # 如果Keycloak配置了issuer-uri，也可以直接使用issuer-uri
          # issuer-uri: http://keycloak-host:8080/realms/your-realm
          # jwk-set-uri会自动从issuer-uri/.well-known/openid-configuration中发现

// Spring Security 配置类
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorizeRequests ->
                authorizeRequests
                    // 允许所有请求访问公共端点
                    .requestMatchers("/public/**").permitAll()
                    // 其他所有请求都需要认证
                    .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2ResourceServer ->
                oauth2ResourceServer
                    .jwt(jwt -> jwt.jwkSetUri("http://keycloak-host:8080/realms/your-realm/protocol/openid-connect/certs"))
                    // 或者使用issuer-uri，Spring Security会自行发现JWKS URI
                    // .jwt(jwt -> jwt.issuerUri("http://keycloak-host:8080/realms/your-realm"))
            );
        return http.build();
    }
}

// 在控制器中使用 @PreAuthorize 进行权限控制
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class MyResourceController {

    @GetMapping("/admin/data")
    @PreAuthorize("hasRole('ADMIN')") // 示例：只有ADMIN角色才能访问
    public String getAdminData() {
        return "This is sensitive admin data.";
    }

    @GetMapping("/user/info")
    @PreAuthorize("hasAuthority('SCOPE_read')") // 示例：拥有read作用域的权限
    public String getUserInfo() {
        return "User specific information.";
    }
}