-
|
Hi all! I'm trying to migrate a configuration for multitenant transparent login using Keycloak Adapters with Spring Boot 2 to simple Spring Security 6. I've implemented a solution based on an HeaderBasedConfigResolver that permits redirect to the correct keycloak realm URL, based on an header prevously set, following this article -> https://www.czetsuyatech.com/2020/11/spring-boot-multi-tenancy-with-keycloak.html With this implementation I implement an HeaderBasedConfigResolver that resolve the configuration based on a specific header so the Keycloak Adapter can redirect to the correct login URL (based on the realm name). Now, Keycloak Adapters doesn't work anymore with Spring Boot 3, so I was trying to find an alternative solution. I don't find anything that can fit my needs, but only a solution that prompts for the authorization server to use... So I'm asking an advice BR |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 4 replies
-
|
If you are in the case of "static" mutli-tenancy (you know at startup which issuers you want to trust), a look at the BFF tutorial and more specifically at the GatewayController. The idea behind this implementation is that a REST endpoint exposes the list of URIs to initiate user authentication (DTO is composed of an URI and a This achieves what you want with just one small difference: the frontend uses a different URI for each issuer (provided by the Spring OAuth2 client) without any specific header, instead of a unique URI with a different header for each issuer. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @ch4mpy for the quick answer, but if you don't mind I will try to describe more in detail my original flow, because I don't think I was clear. First of all, my tenants are surely statically defined also because the creation of a new tenant cannot be performed at runtime (involves multiple components/DB so this is not the case) So, my original flow is as follow:
The header set by NGINX is needed at application level to manage the multitenancy (not only for authentication purposes), so I cannot remove it As you can see, from the user's point of view the flow is automatic (the user doesn't have to choose anything and is redirected to the correct URL of Keycloak as if it is the only one configured) If I understood well, your solution provides a URL to call to choose the issuer and if the issuer is the only one it will redirect directly to the correct login URL. I want to avoid to call a custom URL and act as if there is only an authentication server. Forgive me if this is already understood (or even less clear than before 😉 ) BR |
Beta Was this translation helpful? Give feedback.
-
|
@lucapino as a preamble, apparently, your Angular app is configured as a "public" OAuth2 client, which has been considered a worst practice for years. Spring Security team published about that 2-3 years ago and you might find posts from other security experts even before that. Requests from your Angular app should be authorized with sessions (and CSRF protection), not with tokens. You should probably use a middleware (a Backend For Frontend, aka BFF) between your Angular app and your Spring resource servers to translate from session based security to token based security. But all that is already explained in the tutorial I linked in my preceding comment. Back to your question: apparently you did not understand the solution in my preceding comment, so I'll try to be very specific with samples. Let's say that you host two sites:
Let's now say that each site has it's own realm with respectively as issuers:
Let's also say that, as BFF, you have a
user-name-attribute: preferred_username
luca-issuer: https://sso.lucapino.it/realms/luca
luca-client-id: luca-bff
luca-client-secret: change-me
tagliani-issuer: https://sso.lucapino.it/realms/tagliani
tagliani-client-id: tagliani-bff
tagliani-client-secret: change-me
spring:
security:
oauth2:
client:
provider:
luca:
issuer-uri: ${luca-issuer}
user-name-attribute: ${user-name-attribute}
tagliani:
issuer-uri: ${tagliani-issuer}
user-name-attribute: ${user-name-attribute}
registration:
luca:
provider: luca
client-id: ${luca-client-id}
client-secret: ${luca-client-secret}
authorization-grant-type: authorization_code
scope:
- openid
- offline_access
tagliani:
provider: tagliani
client-id: ${tagliani-client-id}
client-secret: ${tagliani-client-secret}
authorization-grant-type: authorization_code
scope:
- openid
- offline_accessLast, let's consider that you have a reverse-proxy with following routing with a single BFF instance and 2 distinct Angular apps served from nginx containers or dev-servers or whatever:
Now, on the BFF (which holds the OAuth2 client configuration and is responsible for driving the authorization-code flow), you expose a {
"luca": "https://www.luca.it/oauth2/authorization/luca",
"tagliani": "https://www.tagliani.it/oauth2/authorization/tagliani"
}All the Of course, if you already have a header on the frontend with an identifier of the issuer or registration you want to use with that frontend, you can send it along with the In any case, your Angular app should be ready to get:
I hope you can adapt by yourself the use-case above if you prefer to use On the resource server side, this is just standard "static" multi-tenancy configuration: requests will arrive from the BFF with tokens containing either |
Beta Was this translation helpful? Give feedback.
-
|
Hi @ch4mpy, first of all a big thanks for your help! 🙇🏼♂️ But, as I was thinking, I didn't clearly define my scenario, so your solution fits perfectly for a case that I think it's not mine. Forgive me, but my scenario is more complicated I have an architecture where the angular app is deployed inside a spring boot microservice and served by its embedded Tomcat. Let's call this app This angular app is not a real SPA, because we have different pages for different operations (dashboard, document view and search). This is the ONLY instance of the frontend SB app that serves ALL the tenants To display its UI, the app nedds to call other microservices (all SB) that provides secured REST API and are not exposed externally to the browser (are in a so-called trusted zone) To protect the trusted zone there is a gateway (SB3 with Spring Cloud Gateway) that checks the Bearer token validity before permitting the communication to proceed to these microservices. For this purpose, inside the frontend app also is configured a Zuul proxy that forwards calls to these microservices through the gateway (think about it as a BFF), to avoid CORS (angular always call its own backend on the same URL) and preserve the Bearer token. Currently, I achieve this by the use of an NGINX reverse proxy that resolve the different URL to the same app, setting only the custom header (e.g. The auth server, being a SINGLE instance of Keycloak expose its realms under What I want to achieve (and what I have with the current SB2 implementation) is that when a browser calls the public URL (through NGINX) on the app (the home or every other page, eventually with a querystring), it's redirected to the keycloak-server login without the need to use a particular URL After the authentication the user should be redirected to the original URL called. This is a possible representation of the flow:
When the angular app needs a resource from a microservice inside the trusted zone it calls an URL of the following format: The Zuul proxy, being configured to serve anything under the context If I understand correctly your example, my angular code would need to call the But with my current implementation, my angular app is called after the authorization flow, because all URLs are under security For simplicity I report the Security Configuration (SB 2) that I have now, and that can explain better the scenario @Bean
protected CustomSecurityCorsFilter customCorsFilter() {
return new CustomSecurityCorsFilter();
}
@Bean(name = "customKeycloakUtilFactory")
public CustomKeycloakUtilFactory customKeycloakUtilFactory(CustomKeycloakSpringBootProperties config) {
return new CustomKeycloakUtilFactory(config);
}
/**
* Defines the session authentication strategy.
*/
@Bean
@Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
// required for bearer-only applications.
return new NullAuthenticatedSessionStrategy();
}
/**
* Registers the KeycloakAuthenticationProvider with the authentication manager.
*/
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
// simple Authority Mapper to avoid ROLE_
keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
auth.authenticationProvider(keycloakAuthenticationProvider);
}
/**
* Required to handle spring boot configurations
*/
@Bean
public KeycloakConfigResolver KeycloakConfigResolver(CustomKeycloakUtilFactory factory) {
return new HeaderBasedConfigResolver(factory);
}
@Bean
public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("*"));
configuration.setAllowedMethods(Arrays.asList(HttpMethod.OPTIONS.name(), "GET", "POST"));
configuration.setAllowedHeaders(Arrays.asList("Access-Control-Allow-Headers", "Access-Control-Allow-Origin",
"Authorization", "realm"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.sessionManagement()
// use previously declared bean
.sessionAuthenticationStrategy(sessionAuthenticationStrategy())
// keycloak filters for securisation
.and()
// this is needed to pass the preflight CORS security on BROWSER
.addFilterBefore(customCorsFilter(), SecurityContextPersistenceFilter.class)
.addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
.addFilterBefore(keycloakAuthenticationProcessingFilter(), X509AuthenticationFilter.class)
.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
// add cors options
.and().cors()
// delegate logout endpoint to spring security
.and()
.logout()
.logoutUrl("/api/auth-helper/logout")
.invalidateHttpSession(true)
.deleteCookies("JSESSIONID")
.logoutSuccessUrl("/").and()
.authorizeRequests()
// EVERYTHING under security so we redirect to auth-server WITHOUT LOADING ANGULAR
.antMatchers("/ui-webapp-mngmt/actuator/**",
"/actuator/**",
"/health/**",
"/configuration/**",
"/swagger*/**",
"/webjars/**",
"/v2/api-docs",
"favicon.ico",
"wm-favicon.svg",
"wr-favicon.ico",
// insert /index.html and config.json under security exceptions
IndexController.INDEX_PATH,
ApplicationConfigHelperController.BASE_PATH + ApplicationConfigHelperController.CONFIG_PATH)
.permitAll()
.anyRequest().authenticated()
.and()
.csrf()
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
http.headers().frameOptions().sameOrigin();
}For me the problem arise because if I don't use the Keycloak Adapter and the solution that I have linked in my previous comment, I have no means to intercept the authorization flow at step 1. of the list above to determine which realm to use, because the flow is managed directly by Spring Security that can use only one configuration I hope I have been more clearer and ask your forgiveness for my reiterate request 🙏🏼 BR Luca Tagliani |
Beta Was this translation helpful? Give feedback.
-
Edit: my preceding answer probably better covers the subject.The solution you request sticks to the Angular app being a public client. This is bad. Have you solely read the Final Recommendation from the 1st post in the thread I linked several times already? To be very clear your Angular app should not have access to tokens (which means that it should not be able to send tokens with request) and the OAuth2 client configuration resolution should not be done in Angular. Appart from that:
|
Beta Was this translation helpful? Give feedback.
-
|
Hi @ch4mpy, I think that I will go for a deep rewrite of my hybrid application, separating the Angulr part from the SB3 part. Based on that and following your advices, I think I could customize the At this point I could make my Angular app to automatically redirect to this URL. For the public landing page I admit it should be better, but I have to talk with my UI developers and check my company requirements... Again, a big thank you for your patience BR Luca Tagliani |
Beta Was this translation helpful? Give feedback.
Edit: my preceding answer probably better covers the subject.
The solution you request sticks to the Angular app being a public client. This is bad. Have you solely read the Final Recommendation from the 1st post in the thread I linked several times already? To be very clear your Angular app should not have access to tokens (which means that it should not be able to send tokens with request) and the OAuth2 client configuration resolution should not be done in Angular.
Appart from that: