使用Security OAuth2客户端的多租户

Question

我使用Security Oauth2客户端和Keycloak作为身份提供程序。

我的应用程序将被部署到多个域，我们希望使用Keycloak的单个实例。

我已经在一个单独的实例中设置了两个领域，将它们作为不同的租户对待。

在application.properties中，我为两个房客设置了房产-

但是，为什么具有URl-http://demo-app-1.com的应用程序1会重定向到keycloak 1，而同样地，对于具有URl-http://demo-app-2.com的应用程序2，将重定向到keycloak 2。

server.port=8300
spring.security.oauth2.client.registration.demo1.client-name=spring-boot-web
spring.security.oauth2.client.registration.demo1.client-id=spring-boot-web
spring.security.oauth2.client.registration.demo1.client-secret=213e66d5-206f-4948-bd9d-bfa14a70c4cf
spring.security.oauth2.client.registration.demo1.provider=keycloak
spring.security.oauth2.client.registration.demo1.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.demo1.redirect-uri=http://localhost:8300

spring.security.oauth2.client.provider.keycloak.authorization-uri=http://localhost:8081/auth/realms/spring-boot/protocol/openid-connect/auth
spring.security.oauth2.client.provider.keycloak.token-uri=http://localhost:8081/auth/realms/spring-boot/protocol/openid-connect/token


spring.security.oauth2.client.registration.demo2.client-name=spring-boot-web
spring.security.oauth2.client.registration.demo2.client-id=spring-boot-web
spring.security.oauth2.client.registration.demo2.client-secret=d69a7fd1-2297-49d0-b236-7b8039c845b2
spring.security.oauth2.client.registration.demo2.provider=keycloak2
spring.security.oauth2.client.registration.demo2.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.demo2.redirect-uri=http://localhost:8301

spring.security.oauth2.client.provider.keycloak2.authorization-uri=http://localhost:8081/auth/realms/spring-boot-2/protocol/openid-connect/auth
spring.security.oauth2.client.provider.keycloak2.token-uri=http://localhost:8081/auth/realms/spring-boot-2/protocol/openid-connect/token

查询--我们是否可以设置其他属性来自动将请求路由到密钥掩体中的相应领域？

当我点击我需要绕过的应用程序URL时，我得到了一个选择提供者的页面

​

​

Answer 1

这里是不透明令牌(多租户配置)的示例，也许这是有帮助的-- Security中多租户的关键是身份验证Manger Resolver

@Component public class CustomAuthenticationManagerResolver implements AuthenticationManagerResolver {

@Override
public AuthenticationManager resolve(HttpServletRequest request) {
    String tenantId = request.getHeader("tenant");
    OpaqueTokenIntrospector opaqueTokenIntrospector;
    if (tenantId.equals("1")) {
        opaqueTokenIntrospector =  new NimbusOpaqueTokenIntrospector(
                "https://test/authorize/oauth2/introspect",
                "clientId",
                "clientSecret"
        );
    } else {
        opaqueTokenIntrospector =  new NimbusOpaqueTokenIntrospector(
                "https://test/authorize/oauth2/introspect",
                "clientId",
                "clientSecret");
    }
    return new OpaqueTokenAuthenticationProvider(opaqueTokenIntrospector)::authenticate;
}
}

网络安全配置

@Autowired
 private CustomAuthenticationManagerResolver customAuthenticationManagerResolver;




     @Override
        public void configure(HttpSecurity http) throws Exception {
         http.anyRequest()
                        .authenticated().and().oauth2ResourceServer()
                        .authenticationEntryPoint(restEntryPoint).authenticationManagerResolver(customAuthenticationManagerResolver);
    }