Checking groups in KeycloakWebSecurityConfigurerAdapter - spring-boot

Question

I try to use Keycloak in spring boot app. And want to check if user belong to some group. If there any Opportunity in KeycloakWebSecurityConfigurerAdapter. Beacuse now I can only checking roles like this:
#KeycloakConfiguration
class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
// Submits the KeycloakAuthenticationProvider to the AuthenticationManager
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
SimpleAuthorityMapper grantedAuthorityMapper = new SimpleAuthorityMapper();
grantedAuthorityMapper.setPrefix("ROLE_");
KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
auth.authenticationProvider(keycloakAuthenticationProvider);
}
// Specifies the session authentication strategy
#Bean
#Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
}
#Bean
#Override
#ConditionalOnMissingBean(HttpSessionManager.class)
protected HttpSessionManager httpSessionManager() {
return new HttpSessionManager();
}
#Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
http.authorizeRequests(a-> a
.antMatchers("/customers*", "/users*")
.hasRole("user")
.anyRequest()
.permitAll());
}
}

Answer 1

Keycloak spring adapters are deprecated.
You might have look at this tutorial I wrote: https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials/resource-server_with_specialized_oauthentication
It doesn't use KeycloakWebSecurityConfigurerAdapter (I use something more flexible and compatible with latest spring-security versions), but it demoes how to make use of random private claims for security rules.

Answer 2

You could try to write an OncePerRequestFilter where you extract the JWT, decode and find the information you need:
public class AuthenticationFilter extends OncePerRequestFilter {
#Override
protected void doFilterInternal(
HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain) throws
ServletException, IOException {
String authorizationHeaderValue = request.getHeader("Authorization");
if (authorizationHeaderValue != null && authorizationHeaderValue.toLowerCase().startsWith("bearer")) {
String token = authorizationHeaderValue.substring(7, authorizationHeaderValue.length());
// decode token, check the data you need
}
filterChain.doFilter(request, response);
}
}