Keycloak with Spring boot - How to apply resource scopes - spring

Question

I'm using Keycloak 7.0.1 with Spring Boot 1.5.16.RELEASE securing endpoint by specifying resources, role based polices and permissions - and that's works as expected.
The tricky things is to secure only POST and allow GET requests to one some particular URIs. What have I done in application.yml:
policy-enforcer-config:
enforcement-mode: ENFORCING
paths[0]:
name: all
path: /*
paths[1]:
name: test post
path: /my/url
methods[0]:
method: GET
scopes[0]: view
methods[1]:
method: POST
scopes[0]: edit
In keyclaok I've created edit and view scopes, /my/url resource, policy with role and negative decision (if user has that role - deny access), permission contains resource, scope and policy. Evaluation works as expected, but my spring application always receive 403 error.
Could you provide me with an example of resource scope usage or advice what else shout be done to make that working?

Answer 1

Could be multiple problems, but first of all, check your SecurityConfig.
This is what we have in place:
#Configuration
#EnableWebSecurity
#KeycloakConfiguration
#EnableGlobalMethodSecurity(prePostEnabled = true)
#EnableConfigurationProperties(KeycloakSpringBootProperties.class)
#RequiredArgsConstructor
public class SecurityConfig extends WebSecurityConfigurerAdapter {
bla-bla..
#Override
public void configure(WebSecurity web) throws Exception {
web
.ignoring()
.antMatchers(HttpMethod.POST, "/auth/**")
.antMatchers(HttpMethod.OPTIONS,"/**")
// allow anonymous resource requests
.and()
.ignoring()
.antMatchers(
HttpMethod.GET,
"/",
"/*.html",
"/favicon.ico",
"/**/*.html",
"/**/*.css",
"/**/*.js",
"/actuator/**"
)
;
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http
// we don't need CSRF because our token is invulnerable
.csrf().disable()
.exceptionHandling()
.defaultAuthenticationEntryPointFor(
getRestAuthenticationEntryPoint(),
new AntPathRequestMatcher("/**")
)
.authenticationEntryPoint(unauthorizedHandler).and()
// don't create session
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
// system state endpoint
.antMatchers("/ping").permitAll()
.antMatchers(HttpMethod.GET, "/whatever/you/need/to/open/to/public/one", "/whatever/you/need/to/open/to/public/two").permitAll()
// User authentication actions
.antMatchers("/auth/**").permitAll()
.antMatchers("/**/*.css").permitAll()
.anyRequest().authenticated()
;
http
.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
;
// disable page caching
http
.headers()
.frameOptions().sameOrigin()
.cacheControl();
}
If you want to restrict REST API endpoints with role, add #PreAuthorize("hasRole('your.role.from.keycloak')") for your controller method