深度解读-如何用keycloak管理external auth

// src/extensions/google_auth.rs@GoogleAuth::new
// 注册auth server 的授权登录地址，授权时会生成带有相应参数的 auth url
let auth_url =
    AuthUrl::new("https://accounts.google.com/o/oauth2/v2/auth".to_string()).unwrap();
// 注册auth server 的授权登录成功后要跳转到的客户端地址（auth callback url），会携带code
let redirect_url = RedirectUrl::new(config.redirect_url).unwrap();
// 注册auth server 的code换取token的地址
let token_url =
    TokenUrl::new("https://www.googleapis.com/oauth2/v3/token".to_string()).unwrap();

let client = BasicClient::new(
    // 注册google application client credentials, 会有相应权限和客户端限制，如web application类型会有访问地址origin及callback地址的白名单限制
    ClientId::new(config.client_id),
    Some(ClientSecret::new(config.client_secret)),
    auth_url,
    Some(token_url),
)
.set_redirect_uri(redirect_url);

// src/extensions/google_auth.rs@GoogleAuth::auth_url
let (url, csrf_token) = client
    // 参数是用于生成state的函数，这里用csrftoken,可以在auth callback中校验state参数是否合法
    .authorize_url(CsrfToken::new_random)
    // auth请求需要的权限（scope）,一般获取用户信息的话，profile和email就好了
    .add_scope(Scope::new(
        "https://www.googleapis.com/auth/userinfo.profile".to_string(),
    ))
    .add_scope(Scope::new(
        "https://www.googleapis.com/auth/userinfo.email".to_string(),
    ))
    // 需要显示OAuth需要授权的内容给用户来确认是否同意，就是我们常见的google授权确认页面
    .add_extra_param("prompt", "consent")
    // 允许应用程序获得长期有效的访问令牌（accessToken）和刷新令牌(refreshToken)
    .add_extra_param("access_type", "offline")
    .url();

// src/extensions/google_auth.rs@GoogleAuth::get_tokens
// 校验请求，state及pkce, 这里省略展示
// code 换取token
let mut res = client.exchange_code(code);

// 请求发送，axum中不能使用block请求，防止阻塞框架的异步事件循环
let res = res.request_async(async_http_client).await?;

Ok(TokenInfo {
    refresh_token: res.refresh_token().unwrap().secret().to_string(),
    access_token: res.access_token().secret().to_string(),
})

# 这里使用默认的admin-cli配置keycloak
# 也可生成一个专门的client，用clientId+clientSecret的方式
provider "keycloak" {
  client_id = "admin-cli"
  url       = "http://localhost:8080"
  username  = "***"
  password  = "***"
}

# 1. 创建一个realm（领域），并启用, 类似命名空间，代表一个安全的独立区域
resource "keycloak_realm" "realm_axum_koans" {
  realm   = "axum-koans"
  enabled = true
}

# 2. 添加google idp， 这里需要google client credentials

resource "keycloak_oidc_google_identity_provider" "google" {
  realm         = keycloak_realm.realm_axum_koans.id
  # client_id和secret通过环境变量获取
  client_id     = var.google_client_id
  client_secret = var.google_client_secret
  trust_email   = true
  # "*" 则不约束使用此idp的domain
  hosted_domain = "*"
  sync_mode     = "IMPORT"
  provider_id   = "google"

  default_scopes = "openid profile email"
}

# 3. 添加将要用来google auth打交道的client
resource "keycloak_openid_client" "client_axum_koans" {
  realm_id = keycloak_realm.realm_axum_koans.id
  name     = "axum-koans"
  enabled  = true


  client_id             = "axum-koans"
  client_secret         = "***"
  standard_flow_enabled = true

  access_type = "CONFIDENTIAL"
  # 配置auth callback url
  valid_redirect_uris = [
    "http://localhost:8000/keycloak/login-callback"
  ]
  web_origins        = ["*"]
  use_refresh_tokens = true
}

// src/extensions/keycloak_auth.rs@KeycloakAuth::new

// 我们配置生成的issue_url将会是：http://localhost:8080/realms/axum-koans

// 设置token url, auth url 和auth callback url(redirect url)
let token_url = TokenUrl::new(get_url_with_issuer(
    &config.issuer_url,
    "/protocol/openid-connect/token",
))
.unwrap();
let auth_url = AuthUrl::new(get_url_with_issuer(
    &config.issuer_url,
    "/protocol/openid-connect/auth",
))
.unwrap();
let redirect_url = RedirectUrl::new(config.redirect_url).unwrap();
let client = BasicClient::new(client_id, Some(client_secret), auth_url, Some(token_url))
    .set_redirect_uri(redirect_url);

// src/extensions/keycloak_auth.rs@KeycloakAuth::auth_url
client.add_extra_param("kc_idp_hint", "google")

// 启用idp获取refresh token
resource "keycloak_oidc_google_identity_provider" "google" {
  ...
  # for token exchange to get google access token
  request_refresh_token = true
}

// 启用 idp token exchange permission, 并用policy关联对应的client
resource "keycloak_identity_provider_token_exchange_scope_permission" "oidc_idp_permission" {
  realm_id       = keycloak_realm.realm_axum_koans.id
  provider_alias = keycloak_oidc_google_identity_provider.google.alias
  policy_type    = "client"
  clients = [
    keycloak_openid_client.client_axum_koans.id
  ]
}

let token_url =
   format!( "{}/protocol/openid-connect/token",&self.config.issuer_url);
let response = Client::new()
    .post(token_url)
    .form(&[
        // token exchange type
        (
            "grant_type",
            "urn:ietf:params:oauth:grant-type:token-exchange",
        ),
        // 传入keycloak access token
        ("subject_token", &access_token),
        ("client_id", &self.config.client_id),
        ("client_secret", &self.config.client_secret),
        // 请求换取google access token
        (
            "requested_token_type",
            "urn:ietf:params:oauth:token-type:access_token",
        ),
        // 要换取的external idp: google
        ("requested_issuer", "google"),
    ])
    .send()
    .await?;
// json deserialized as access token
Ok(from_str(&response.text().await?)?)

resource "keycloak_oidc_google_identity_provider" "google" {
  ...
  # for retrieve idp token (with refresh token)
  // 存储idp token
  store_token                   = true
  // 用户生成是添加broker read token 权限
  add_read_token_role_on_create = true
}

// src/extensions/keycloak_auth.rs@KeycloakAuth::get_idp_token
let token_url = format!( "{}/broker/google/token",&self.config.issuer_url);
let response = Client::new()
    .get(token_url)
    .bearer_auth(access_token)
    .header(CONTENT_TYPE, HeaderValue::from_static("application/json"))
    .send()
    .await?;
let res = response.text().await?;
Ok(from_str(&res)?)