Spring boot security with keycloak not working for graphql - spring-boot

Question

Apologies for the lengthy post. I have a spring boot application which contains both rest and graphql APIs. Also I'm using keycloak auth server. I want to add keycloak authentication for both apis. Setup is as follows
Dependencies
I have added following dependencies as mentioned in docs.
<dependencies>
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-spring-boot-starter</artifactId>
</dependency>
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-spring-security-adapter</artifactId>
<version>13.0.1</version>
</dependency>
//-- other dependencies
</dependencies>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.keycloak.bom</groupId>
<artifactId>keycloak-adapter-bom</artifactId>
<version>13.0.1</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
Additionally I'm using following dependencies for spring security and expediagroup graphql kotlin support.
<dependency>
<groupId>com.expediagroup</groupId>
<artifactId>graphql-kotlin-spring-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-webflux</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
Security Configuration
import org.keycloak.adapters.KeycloakConfigResolver
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver
import org.keycloak.adapters.springsecurity.KeycloakConfiguration
import org.keycloak.adapters.springsecurity.KeycloakSecurityComponents
import org.keycloak.adapters.springsecurity.client.KeycloakClientRequestFactory
import org.keycloak.adapters.springsecurity.client.KeycloakRestTemplate
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.beans.factory.config.ConfigurableBeanFactory
import org.springframework.context.annotation.*
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper
import org.springframework.security.core.session.SessionRegistryImpl
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy
#KeycloakConfiguration
#EnableWebSecurity
#EnableGlobalMethodSecurity(jsr250Enabled = true)
#ComponentScan(basePackageClasses = [KeycloakSecurityComponents::class])
class KeycloakSecurityConfig: KeycloakWebSecurityConfigurerAdapter() {
#Autowired
var keycloakClientRequestFactory: KeycloakClientRequestFactory? = null
#Throws(Exception::class)
override fun configure(http: HttpSecurity) {
super.configure(http)
http.csrf().disable().cors().disable()
.authorizeRequests()
.anyRequest()
.permitAll()
}
#Autowired
#Throws(Exception::class)
fun configureGlobal(auth: AuthenticationManagerBuilder) {
val keycloakAuthenticationProvider = keycloakAuthenticationProvider()
keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(SimpleAuthorityMapper())
auth.authenticationProvider(keycloakAuthenticationProvider)
}
#Bean
override fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy? {
return RegisterSessionAuthenticationStrategy(SessionRegistryImpl())
}
#Bean
fun KeycloakConfigResolver(): KeycloakConfigResolver? {
return KeycloakSpringBootConfigResolver()
}
#Bean
#Scope(ConfigurableBeanFactory.SCOPE_PROTOTYPE)
fun keycloakRestTemplate(): KeycloakRestTemplate? {
return KeycloakRestTemplate(keycloakClientRequestFactory)
}
}
Endpoints
These are my sample rest and graphql endpoints.
GraphQL
import com.expediagroup.graphql.spring.operations.Query
import org.springframework.stereotype.Component
import reactor.core.publisher.Mono
import java.util.concurrent.CompletableFuture
#Component
class HelloQuery: Query {
fun helloWorld():CompletableFuture<String>{
return Mono.just("hello from graphql").toFuture()
}
}
Rest Controller
import org.springframework.stereotype.Controller
import org.springframework.web.bind.annotation.GetMapping
import org.springframework.web.bind.annotation.ResponseBody
#Controller
class HelloController {
#GetMapping("/hello")
#ResponseBody
fun hello(): String {
return "hello from rest"
}
}
Results
When I run the application and test the APIs get following results.
Rest API - work successfully
GraphQL - 404 error
But when I remove all security configs graphql api also work successfully.
My problem is can I use graphql with keycloak spring security. If yes what am I doing wrong here?
Any help is appreciated.

Answer 1

Needed to do some changes to security config file.
adding corsFilter
adding securityWebFilterChain
Also I'm using dependency
<dependency>
<groupId>com.expediagroup</groupId>
<artifactId>graphql-kotlin-spring-server</artifactId>
<version>${graphql-kotlin-spring-server.version}</version>
</dependency>
It worked for me. Posting the answer hopefully will help someone.
Security config file
#EnableWebFluxSecurity
#Configuration
internal class SecurityConfig(
private val monitoringProperties: MonitoringProperties,
private val securityProperties: SecurityProperties,
private val graphQLConfigurationProperties: GraphQLConfigurationProperties
) {
companion object {
const val AUTHORITY_ACTUATOR = "AUTHORITY_ACTUATOR"
const val AUTHORITY_ACCESS_MONITORING = "AUTHORITY_ACCESS_MONITORING"
const val AUTHORITY_ACCESS_INTERNAL_API = "AUTHORITY_ACCESS_INTERNAL_API"
}
#Bean
#ConditionalOnProperty(value = ["spring.security.user.passwordGenerated"], matchIfMissing = true, havingValue = "false")
fun userDetailsService(): MapReactiveUserDetailsService {
val actuatorUser = User
.withUsername(securityProperties.user.name)
.password("{noop}${securityProperties.user.password}")
.authorities(AUTHORITY_ACTUATOR, AUTHORITY_ACCESS_MONITORING, AUTHORITY_ACCESS_INTERNAL_API).build()
val monitoringUser = User
.withUsername(monitoringProperties.username)
.password("{noop}${monitoringProperties.password}")
.authorities(AUTHORITY_ACCESS_MONITORING)
.build()
return MapReactiveUserDetailsService(actuatorUser, monitoringUser)
}
#Bean
fun corsWebFilter(): CorsWebFilter {
return CorsWebFilter(UrlBasedCorsConfigurationSource().apply {
registerCorsConfiguration(
"/${graphQLConfigurationProperties.endpoint}",
CorsConfiguration().apply {
allowCredentials = true
allowedOrigins = listOf("*")
allowedHeaders = listOf("*")
allowedMethods = listOf("*")
}
)
registerCorsConfiguration(
"/${graphQLConfigurationProperties.subscriptions.endpoint}",
CorsConfiguration().apply {
allowCredentials = true
allowedOrigins = listOf("*")
allowedHeaders = listOf("*")
allowedMethods = listOf("*")
}
)
registerCorsConfiguration(
"/web/*",
CorsConfiguration().apply {
allowCredentials = true
allowedOrigins = listOf("*")
allowedHeaders = listOf("*")
allowedMethods = listOf("*")
}
)
})
}
#Bean
fun securityWebFilterChain(
http: ServerHttpSecurity
): SecurityWebFilterChain {
return http {
httpBasic { }
configureKeycloakAuth()
csrf { disable() }
authorizeExchange {
// actuator and monitoring
authorize(EndpointRequest.to("health", "info"), permitAll)
authorize(EndpointRequest.to(PrometheusScrapeEndpoint::class.java), hasAnyAuthority(AUTHORITY_ACCESS_MONITORING))
authorize(EndpointRequest.toAnyEndpoint(), hasAuthority(AUTHORITY_ACTUATOR))
authorizeGraphQL()
// rest
authorize(anyExchange, denyAll)
}
requestCache { disable() }
}
}
private fun ServerHttpSecurityDsl.configureKeycloakAuth() {
oauth2ResourceServer {
bearerTokenConverter = ServerBearerTokenAuthenticationConverter().apply { setAllowUriQueryParameter(true) }
jwt { jwtAuthenticationConverter = KeycloakJwtAuthenticationConverter() }
}
}
private fun AuthorizeExchangeDsl.authorizeGraphQL() {
authorize(ServerWebExchangeMatchers.pathMatchers(HttpMethod.OPTIONS, "/${graphQLConfigurationProperties.endpoint}"), permitAll)
authorize(antPattern = "/${graphQLConfigurationProperties.endpoint}", access = hasAnyAuthority("ADMIN", "USER"))
authorize(antPattern = "/${graphQLConfigurationProperties.subscriptions.endpoint}", access = hasAnyAuthority("ADMIN"))
authorize(antPattern = "/web/*", access = permitAll)
if (graphQLConfigurationProperties.playground.enabled) {
authorize(antPattern = "/${graphQLConfigurationProperties.playground.endpoint}", access = permitAll)
}
if (graphQLConfigurationProperties.sdl.enabled) {
authorize(antPattern = "/${graphQLConfigurationProperties.sdl.endpoint}", access = permitAll)
}
}
}
class KeycloakJwtAuthenticationConverter : Converter<Jwt, Mono<AbstractAuthenticationToken>> {
private val delegate = JwtAuthenticationConverter()
override fun convert(jwt: Jwt): Mono<AbstractAuthenticationToken> {
return Mono.just(jwt)
.map { source: Jwt -> delegate.convert(source) }
.map { auth ->
when (auth) {
is JwtAuthenticationToken -> try {
KeycloakToken.fromOauth2Token(auth)
} catch (e: Exception) {
auth
}
else -> auth
}
}
}
}
class KeycloakToken(authorities: Collection<out GrantedAuthority>, private val principal: AuthenticatedUser, private val credentials: Any) :
AbstractAuthenticationToken(authorities) {
companion object {
fun fromOauth2Token(oauth2Token: JwtAuthenticationToken): KeycloakToken {
val id = UUID.fromString(oauth2Token.name)
val jwt = oauth2Token.principal as Jwt
val email = jwt.claims["email"] as? String
val firstName = jwt.claims["given_name"] as? String
val lastName = jwt.claims["family_name"] as? String
val fullName = jwt.claims["name"] as? String
if (email == null || firstName == null || lastName == null || fullName == null) {
throw RuntimeException("User Details incomplete - name not set of user with id $id: email: $email, first name: $firstName, last name: $lastName, full name: $fullName")
}
val realmAccess = jwt.claims["realm_access"] as Map<*, *>
val roles = (realmAccess["roles"] as List<*>).map { it.toString() }
val authorities = oauth2Token.authorities.toMutableList()
authorities.addAll(roles.map { SimpleGrantedAuthority(it) })
return KeycloakToken(
authorities = authorities,
principal = AuthenticatedUser(
id = id,
email = email,
firstName = firstName,
lastName = lastName,
fullName = fullName,
roles = roles.toList()
),
credentials = oauth2Token.credentials
)
.apply {
details = oauth2Token
isAuthenticated = true
}
}
}
override fun getPrincipal() = principal
override fun getCredentials() = credentials
}