Spring Security and Boot deprecation #10187
Replies: 23 comments 45 replies
-
|
Ultimately, with some effort, it will be possible for us to deal with this. But I don’t agree with the reasoning of „more features“. We use two adapter features that I don’t see a replacement in Spring Security:
Additionally I didn’t come across backchannel logout support in Spring Security, although that might be an oversight on my part. So it seems I might benefit from better Spring integration, but have to deal with missing features. |
Beta Was this translation helpful? Give feedback.
-
|
Is the UMA 2.0 functionality also to be deprecated? |
Beta Was this translation helpful? Give feedback.
-
|
What about SAML? |
Beta Was this translation helpful? Give feedback.
-
|
The Authorization Service with configurations like Policy Enforcer to centralize the authorization management in Keycloak not exist in Spring Security. Are you going to maintain this functionality from a separate library? |
Beta Was this translation helpful? Give feedback.
-
|
So will keycloak-spring-boot-starter and keycloak-adapter-bom become deprecated as well? We are using springboot 2.x. |
Beta Was this translation helpful? Give feedback.
-
|
Hi all, I created an alternative spring-boot adapter for OpenID resource-servers. Usage:Pom: <dependency>
<groupId>com.c4-soft.springaddons</groupId>
<artifactId>spring-addons-webmvc-jwt-resource-server</artifactId>
<version>6.0.2</version>
</dependency>Properties: com.c4-soft.springaddons.security.issuers[0].location=https://localhost:9443/realms/master
com.c4-soft.springaddons.security.issuers[0].authorities.claims=realm_access.roles,resource_access.spring-addons.rolesJava conf: @EnableGlobalMethodSecurity(prePostEnabled = true)
public static class WebSecurityConfig {
}Features:
DocumentationTutorials: https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials Home page: https://github.com/ch4mpy/spring-addons |
Beta Was this translation helpful? Give feedback.
-
|
Hi all,
Can you please confirm which from the above are going to be deprecated and which I can still use it, because I found that the keycloak-spring-security-adapter include keycloak-adapter-core in pom.xml? Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
So I removed all the spring adapters as @ch4mpy and for UMA and token exchange we are using keycloak AUTH client and admin client and com.nimbusds.oauth2-oidc-sdk which comes with spring oauth2 .. |
Beta Was this translation helpful? Give feedback.
-
|
I hope not, afaik it Its not
…On Fri, 11 Nov 2022, 09:57 Bragolgirith, ***@***.***> wrote:
Ah, so the keycloak-admin-client and keycloak-authz-client are not
deprecated?
—
Reply to this email directly, view it on GitHub
<#10187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAF3P54JVIYYGXNERKOE5Z3WHYDALANCNFSM5OLEWQWQ>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
I'm confused. The main reason we have been using the Keycloak adapter instead of Spring Security directly is for the authorization service functionality (which we rely heavily upon). We also use the KeycloakRestTemplate in a few projects. I discovered this deprecation when I was trying out Spring Boot 3 and discovered that the Keycloak adapter won't work. Are you saying that the Keycloak adapters are being deprecated and there is no firm estimate on when (or even if) we will be able to use Keycloak authorization again? |
Beta Was this translation helpful? Give feedback.
-
|
You can use Keycloak "Authorization services" without the adapters. Just use your favorite REST client ( Following are very personal arguments (please note I'm absolutely not part of Keycloak team). I don't like "Authorization services" feature and would not use it:
I don't even agree with the argument that policies are more powerfull, easier to read or easier to modify compared to spring-security expressions, even in scenarios where you need more than role-based access-control. Let's illustrate with a sample taken from the third of those tutorials: @GetMapping("/on-behalf-of/{username}")
@PreAuthorize("is(#username) or isNice() or onBehalfOf(#username).can('greet')")
public String getGreetingFor(@PathVariable("username") String username, Authentication auth) {
return String.format("Hi %s from %s!", username, auth.getName());
}The user is granted access if one of the following is true for current user:
And here is how access-control is tested: @Test
@ProxiesAuth(
authorities = { "AUTHOR" },
claims = @OpenIdClaims(preferredUsername = "Tonton Pirate"),
proxies = { @Proxy(onBehalfOf = "ch4mpy", can = { "greet" }) })
void whenNotNiceWithProxyThenCanGreetFor() throws Exception {
mockMvc.get("/greet/on-behalf-of/ch4mpy").andExpect(status().isOk()).andExpect(content().string("Hi ch4mpy from Tonton Pirate!"));
}
@Test
@ProxiesAuth(
authorities = { "AUTHOR", "ROLE_NICE_GUY" },
claims = @OpenIdClaims(preferredUsername = "Tonton Pirate"))
void whenNiceWithoutProxyThenCanGreetFor() throws Exception {
mockMvc.get("/greet/on-behalf-of/ch4mpy").andExpect(status().isOk()).andExpect(content().string("Hi ch4mpy from Tonton Pirate!"));
}
@Test
@ProxiesAuth(
authorities = { "AUTHOR" },
claims = @OpenIdClaims(preferredUsername = "Tonton Pirate"),
proxies = { @Proxy(onBehalfOf = "jwacongne", can = { "greet" }) })
void whenNotNiceWithoutRequiredProxyThenForbiddenToGreetFor() throws Exception {
mockMvc.get("/greet/on-behalf-of/greeted").andExpect(status().isForbidden());
}
@Test
@ProxiesAuth(
authorities = { "AUTHOR" },
claims = @OpenIdClaims(preferredUsername = "Tonton Pirate"))
void whenHimselfThenCanGreetFor() throws Exception {
mockMvc.get("/greet/on-behalf-of/Tonton Pirate").andExpect(status().isOk()).andExpect(content().string("Hi Tonton Pirate from Tonton Pirate!"));
}I see only one advantage for "Authorization services": rules syntax can be edited without needing resource-server re-deployment. But, honestly, most often, editing roles and context is enough (that doesn't require a restart even with spring-security rules) and, as far as I can remember, I never had to edit rules syntax without having to deploy other business rules too. The fact that I unit-test access-control probably has a strong impact on expressions stability... |
Beta Was this translation helpful? Give feedback.
-
|
There are pros and cons to the authorization service, but that isn't the point here unless you are saying you want to deprecate the entire authorization service component in Keycloak. For us, the benefits of being able to centrally manage permissions across many microservices and change those permissions without code deploys outweighed all the negatives. Yes, we could spend the time writing our own adapter to replace the Keycloak one, but that is a ridiculous. Where would it stop? Should we write our own authorization service in case the Keycloak one randomly gets deprecated one day? As someone pointed out, one negative of using the authorization service is that it puts a heavy dependence on Keycloak and it looks like we are getting shafted as a result or is this just going behind a paywall, where the next response is that we will have to pay for Redhat SSO to get a maintained adapter or possibly even the authorization service entirely? |
Beta Was this translation helpful? Give feedback.
-
|
If the keycloak adapters are no longer supported, wouldn't it make sense to reflect this in the demo projects at https://github.com/keycloak/keycloak-quickstarts.git, at least with a note in the README that the adapter examples are outdated? |
Beta Was this translation helpful? Give feedback.
-
|
keycloak supports realm role vs client role.. and i think thats very specific to keycloak, how should one port such things to spring? or even for that matter how keycloak filters does few url manipulations when port is provided/not provided, ssl is enabled/disabled, and x-forward redirections another example is when a 5xx or 4xx happens in auth call keycloak filters presently throughs only 401 (not the underlying error say 404, or 429 , or 5xx)... Also, keycloak filter by default assumes /sso/login (or /login) as the default login page ,, there are many such things which the keyclaok provided libraries does and many of these things many not be compatible.. It will be better if there is a clear migration guide and some set of recommendations on alternate library and thier usage. |
Beta Was this translation helpful? Give feedback.
-
|
I am actually surprised that almost no one seems to talk about the whole backchannel communication (e.g. SSO). So basically everything previously done by the PreAuthActionsHandler plus probably some more things. Do I understand correctly that we need to reimplement this behaviour if we still want to have SSO? |
Beta Was this translation helpful? Give feedback.
-
|
Has anyone got multi-tenant support working with Spring Boot 3 ( Spring 6 ) ? With Spring Boot 2.x and the Keycloak adapters we were able to support multitenant installations using the following code:
Where KeycloakHeaderConfigResolver could configure the org.keycloak.representations.adapters.config.AdapterConfig.realm Is there an equivalent 'hook' in oauth2 implementations ? |
Beta Was this translation helpful? Give feedback.
-
|
Thanks everyone for their input, we've revised our plans to remove adapters, so please take a look at https://www.keycloak.org/2023/03/adapter-deprecation-update.html for more details. |
Beta Was this translation helpful? Give feedback.
-
|
Awsome work @ch4mpy , your library seems pretty solid and just on top of spring security, and i think it has most compoent required to custmozie multitenancy, dealing with keycloak specific claims/roles etc.. This is great.. I am almost tempted to use your library or follow your suggestions to comeup with custom implementation.. The only problem i have now is how to deal with Basic Auth, my rest services were avaialble through both basic auth and bearer, the keycloak library, kind of handled it well, with enable-basic-auth: true configuration, it would use the client sec configured in application yml and use the basic auth cred of user to trade for a token.. I know, its out of fashion and not as secured as Bearer Token, my many of my legacy application needs the basic auth ... I am just wondering how to enable basic auth (this is something i guess is not availble at spring boot auth library). One way of doing it is adding a filter prior to oauth filter for basic auth use case.. What will be your suggestion for REST apps which needs to support both basic auth + bearer and in multitenant fashion.. |
Beta Was this translation helpful? Give feedback.
-
|
password grant
Sent from Yahoo Mail on Android
On Fri, 7 Apr 2023 at 1:59 am, Jérôme ***@***.***> wrote:
How are you using basic auth exactly? As a relay to password-grant or client-credentials flow to fetch an identity from Keycloak (a bit like introspection but of a basic authentication header instead of a Bearer one) ?
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
with some effort i was able to modify the keycloak spring boot 2 library to be compliant with jakarata.servlet/JEE8/spring6/springboo3. There are still some minor work like apache upgrade ( keycloak uses a dated apached library with most methods deprecated). If the community is interested i can have a PR raised and included in keycloak like the https://github.com/keycloak/keycloak/tree/main/adapters/oidc/jakarta-servlet-filter module. Please let me know your opinions. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @stianst and keycloak team, Will there be any keycloak adapter coming out to support spring boot 3? |
Beta Was this translation helpful? Give feedback.
-
|
I saw that there was mention of splitting out the auth functionality to a separate library with 22.0. I didn't see anything in the release notes but then I noticed this quick start. I started playing around with the code and it seems to with with sb 3. I was hoping someone could help me validate what I am doing. It passed some quick tests on an existing project that was sb 2 + Keycloak adapter I prefer to keep the custom code to as little as possible and keep as much Spring Autoconfig as possible. Is all of this custom config necessary? I also noticed that setting paths to enforcer = disabled were still requiring auth. I had to add that custom code to ignore the two given paths at the Spring Security level. Is there a way to get the policy enforcer functionality to bypass them? |
Beta Was this translation helpful? Give feedback.
-
|
Hello guys, the solution provided by @westmc is working ok with keycloak's policy enforcement. But when I tried to implement http method scope based authorization for the same uri resource then its not working. For example:
Now when the user with the role view_employee try to access GET /employee, then it got forbidden. In the log I check that spring boot always sending challange with edit employee resource whenever the /employee api is called with either GET or POST method. Is there any way to achieve this so that same uri resource could be authorized idependently in keycloak from spring boot 3? Here is my application.properties: Here is my simple security config: |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Keycloak is deprecating most adapters in the future, for more information see https://www.keycloak.org/2023/03/adapter-deprecation-update.html.
Spring Security has had good OAuth and OIDC support built-in for a long time, which removes the need to maintain a Keycloak specific adapter.
Beta Was this translation helpful? Give feedback.
All reactions