mposolda/devconf2019-authz

Keycloak/Authorization SpringBoot example for devconf 2019

devconf2019-authz's Issues

Able to build this project but getting error while running app

I have imported this whole project "devconf2019-authz-master" which has 2 sub-modules like devconf2019-app and devconfapp-service. Build is successful now after I added javax.validation dependency and parent tag in parent project.

Now while running the project, error like below --
Eclipse Console error
Error starting ApplicationContext. To display the conditions report re-run your application with 'debug' enabled.
2019-07-17 16:16:52.169 ERROR 106920 --- [ main] o.s.boot.SpringApplication : Application run failed

org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'carsService': Unsatisfied dependency expressed through field 'db'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'inMemoryCarsDB' defined in file [D:\devconf2019-authz-master\devconf2019-service\target\classes\org\keycloak\quickstarts\devconf2019\service\InMemoryCarsDB.class]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.keycloak.quickstarts.devconf2019.service.InMemoryCarsDB]: Constructor threw exception; nested exception is java.lang.RuntimeException: Error when initializing cars
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:587) ~[spring-beans-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:91) ~[spring-beans-5.0.7.RELEASE.jar:5.0.7.RELEASE]

Eclipse Console error

Let me know if I missing some dependency or need to update any ? Or if nay change to be done at source code. I need to integrate my springboot app with keycloak and I wanted to understand this sample application first.

Using policy enforcer without security constraint

Hi,
I am facing an issue after I have updated keycloak to v10 as previously I was able to user policy-enforcer in application.properties without configuring security constraints, as now if I didn't add security constraint config the AbstractPolicyEnforcer will retrieve null securityContext
KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
& hence it will delegate the authZ to userManagmentAccess which by the way is null so at the end I got 403 if I didn't add

keycloak.securityConstraints[0].authRoles[0]=*
#keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/*