由于網(wǎng)上博客大部分都只有登陸沒有退出，自己花了一些時間研究了一下，這里將相關內(nèi)容進行記錄，基于Keyclaok 20的版本，實現(xiàn)springboot服務單點登錄與退出

一、依賴

<!-- 在父工程中 -->
<dependencyManagement><dependencies><!-- 導入依賴 --><dependency><groupId>org.keycloak.bom</groupId><artifactId>keycloak-adapter-bom</artifactId><version>22.0.1</version><type>pom</type><scope>import</scope></dependency></dependencies>
</dependencyManagement><!-- 在子工程中 -->
<dependencies><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId></dependency><dependency><groupId>org.keycloak</groupId><artifactId>keycloak-spring-boot-starter</artifactId></dependency><dependency><groupId>org.keycloak</groupId><artifactId>keycloak-spring-security-adapter</artifactId></dependency>
</dependencies>

二、keycloak配置

這個是主要的，用設置攔截器實現(xiàn)登陸與退出

package com.example.basic.conf;import org.keycloak.KeycloakPrincipal;
import org.keycloak.KeycloakSecurityContext;
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springsecurity.KeycloakConfiguration;
import org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;@KeycloakConfiguration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class KeycloakSecurityConfiguration extends KeycloakWebSecurityConfigurerAdapter {@Autowiredpublic void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());auth.authenticationProvider(keycloakAuthenticationProvider);}@Bean@Overrideprotected SessionAuthenticationStrategy sessionAuthenticationStrategy() {return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());}@Beanpublic org.keycloak.adapters.KeycloakConfigResolver KeycloakConfigResolver() {return new KeycloakSpringBootConfigResolver();}@Overrideprotected void configure(HttpSecurity http) throws Exception {super.configure(http);http.logout()//攔截logout請求.logoutRequestMatcher(new AntPathRequestMatcher("/logout")).addLogoutHandler(keycloakLogoutHandler()).logoutSuccessHandler(logoutSuccessHandler()).deleteCookies("JSESSIONID").and()//設置哪些可以忽略掉授權.authorizeRequests().antMatchers("/user/login", "/token/generate","/access/**", "/js/**","/css/**","/fonts/**", "/index.html", "/error").permitAll()//除了上面忽略掉授權請求，剩下所有必須經(jīng)過授權才可以訪問.antMatchers("/**").authenticated().and().cors().and().csrf().disable();}//處理logout自動跳轉請求private LogoutSuccessHandler logoutSuccessHandler() {return new LogoutSuccessHandler() {@Overridepublic void onLogoutSuccess(HttpServletRequest httpServletRequest,HttpServletResponse httpServletResponse, Authentication authentication)throws IOException, ServletException {KeycloakAuthenticationToken keycloakAuthenticationToken = (KeycloakAuthenticationToken)authentication;KeycloakSecurityContext keycloakSecurityContext =keycloakAuthenticationToken.getAccount().getKeycloakSecurityContext();String idTokenHint = keycloakSecurityContext.getIdTokenString();String issuer = keycloakSecurityContext.getIdToken().getIssuer();String keycloakBaseUrl = issuer + "/protocol/openid-connect/logout";String postLogoutRedirectUri = httpServletRequest.getScheme() + "://" + httpServletRequest.getHeader("host");String logoutUrl = keycloakBaseUrl + "?post_logout_redirect_uri=" + postLogoutRedirectUri + "&id_token_hint=" + idTokenHint;// Do logout by redirecting to Keycloak logouthttpServletResponse.sendRedirect(logoutUrl);}};}
}