红帽全球峰会15.4. 在 Keycloak 中使用 HawtIO 和 OpenID Connect 身份验证
运行 Keycloak 实例的最简单方法是使用容器：
podman run -d --name keycloak \ -p 18080:8080 \ -e KEYCLOAK_ADMIN=admin \ -e KEYCLOAK_ADMIN_PASSWORD=admin \ quay.io/keycloak/keycloak:latest start-dev
podman run -d --name keycloak \
-p 18080:8080 \
-e KEYCLOAK_ADMIN=admin \
-e KEYCLOAK_ADMIN_PASSWORD=admin \
quay.io/keycloak/keycloak:latest start-dev启动之后，浏览 http://localhost:18080/admin/master/console/ 并创建一个新域：
在 realm 创建屏幕中，上传 hawtio-demo-realm.json，它使用预先配置的 hawtio-client 客户端和 3 个用户定义新的 hawtio-demo 域：
-
带有角色
管理器、admin、viewer和user的admin/admin -
带有角色查看器和
用户的viewer/viewer -
只使用用户角色的 jdoe/jdoe
15.4.1. 检查 JWT 令牌问题
要检查授予访问令牌的内容，我们可以使用 Keycloak 接口。导航到"Clients"，选择"hawtio-client"，并使用带有"Evaluate"子选项卡的"客户端范围"选项卡：
然后，在"Users"字段中，可以选择"admin"，然后单击"确定的访问令牌"。然后，可以检查示例令牌：
{
"exp": 1709552728,
"iat": 1709552428,
"jti": "0f33971f-c4f7-4a5c-a240-c18ba3f97aa1",
"iss": "http://localhost:18080/realms/hawtio-demo",
"aud": "account",
"sub": "84d156fa-e4cc-4785-91c1-4e0bda4b8ed9",
"typ": "Bearer",
"azp": "hawtio-client",
"session_state": "181a30ac-fce1-4f4f-aaee-110304ccb0e6",
"acr": "1",
"allowed-origins":
[
"http://0.0.0.0:8181",
"http://localhost:8080",
"http://localhost:8181",
"http://0.0.0.0:10001",
"http://0.0.0.0:8080",
"http://localhost:10001",
"http://localhost:10000",
"http://0.0.0.0:10000"
],
"realm_access":
{
"roles":
[
"viewer",
"manager",
"admin",
"user"
]
},
"resource_access":
{
"account":
{
"roles":
[
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
"scope": "openid profile email",
"sid": "181a30ac-fce1-4f4f-aaee-110304ccb0e6",
"email_verified": false,
"name": "Admin HawtIO",
"preferred_username": "admin",
"given_name": "Admin",
"family_name": "HawtIO",
"email": "admin@hawt.io"
}
{
"exp": 1709552728,
"iat": 1709552428,
"jti": "0f33971f-c4f7-4a5c-a240-c18ba3f97aa1",
"iss": "http://localhost:18080/realms/hawtio-demo",
"aud": "account",
"sub": "84d156fa-e4cc-4785-91c1-4e0bda4b8ed9",
"typ": "Bearer",
"azp": "hawtio-client",
"session_state": "181a30ac-fce1-4f4f-aaee-110304ccb0e6",
"acr": "1",
"allowed-origins":
[
"http://0.0.0.0:8181",
"http://localhost:8080",
"http://localhost:8181",
"http://0.0.0.0:10001",
"http://0.0.0.0:8080",
"http://localhost:10001",
"http://localhost:10000",
"http://0.0.0.0:10000"
],
"realm_access":
{
"roles":
[
"viewer",
"manager",
"admin",
"user"
]
},
"resource_access":
{
"account":
{
"roles":
[
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
"scope": "openid profile email",
"sid": "181a30ac-fce1-4f4f-aaee-110304ccb0e6",
"email_verified": false,
"name": "Admin HawtIO",
"preferred_username": "admin",
"given_name": "Admin",
"family_name": "HawtIO",
"email": "admin@hawt.io"
}了解 JWT 访问令牌的结构，我们可以检查角色路径是否已正确配置：
example for Keycloak with use-resource-role-mappings=false
# example for Keycloak with use-resource-role-mappings=false
oidc.rolesPath = realm_access.roles
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}