keycloak~巧用client-scope实现token字段和userinfo接口的授权

技术分享 14小时前 0 999+

keycloak中的client-scope允许你为每个客户端分配scope，而scope就是授权范围，它直接影响了token中的内容，及userinfo端点可以获取到的用户信息，这块我们可以通过自定义scope/mapper，来实现粒度的控制，并且这个mapper可以控制添加到token，或者添加到userinfo端点，这两块配置也是独立的，下面我们通过一个登录IP地址的mapper，来实现将登录ip添加到token和userinfo端点。

添加Mapper对象

public class ExtensionLoginIpMapper         extends AbstractOIDCProtocolMapper         implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper {     public static final String CONFIG_NAME = "ExtensionLoginIp";//配置里的名称     public static final String PROVIDER_ID = "oidc-extension-login-ip-mapper";     private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();     private static final String LOGIN_IP = "loginIp";      static {         configProperties.add(createConfigProperty(CONFIG_NAME, "Token申请名", "在jwt中的属性名称，默认loginIp"));         OIDCAttributeMapperHelper.addIncludeInTokensConfig(configProperties, ExtensionLoginIpMapper.class);     }      protected static ProviderConfigProperty createConfigProperty(String claimName, String label, String help) {         ProviderConfigProperty property = new ProviderConfigProperty();         property.setName(claimName);         property.setLabel(label);         property.setHelpText(help);         property.setType(ProviderConfigProperty.STRING_TYPE);         return property;     }      @Override     protected void setClaim(IDToken token, ProtocolMapperModel mappingModel, UserSessionModel userSession,                             KeycloakSession keycloakSession, ClientSessionContext clientSessionCtx) {         try {             String key = LOGIN_IP;             if (mappingModel.getConfig().containsKey(CONFIG_NAME)) {                 key = mappingModel.getConfig().get(CONFIG_NAME);             }              if (userSession.getNotes().containsKey(LOGIN_IP)) {                 String val = userSession.getNote(LOGIN_IP);                 token.setOtherClaims(key, val);             }          } catch (Exception e) {             e.printStackTrace();         }     }      public List<ProviderConfigProperty> getConfigProperties() {         return configProperties;     }      @Override     public String getId() {         return PROVIDER_ID;     }      @Override     public String getDisplayType() {         return CONFIG_NAME;     }      @Override     public String getDisplayCategory() {         return TOKEN_MAPPER_CATEGORY;     }      @Override     public String getHelpText() {         return "Maps Extension Login Ip Address.";     } }