Hy @ll,
For my current project I
use Docker and run each service in a own container, and
spread the services over multiple servers. All connected via
REST.
For the security I found
Keycloak, and I think it’s a really cool tool. But I never
was the best friend of security… JASS/Spring Security…
My problem is, I try to
use the cors example
(https://github.com/keycloak/keycloak/tree/master/examples/cors).
I also use AngularJS for the frontend that consumes multiple
REST Services.
But I don’t get it to
work. I always get the following error:
XMLHttpRequest cannot load
http://162.244.28.89:8080/BrandService/resources/brands/.
No 'Access-Control-Allow-Origin' header is present on the
requested resource. Origin 'http://162.244.28.89' is
therefore not allowed access. The response had HTTP status
code 403.
Google Chrome give me
the following output for the http request:
Remote
Address:162.244.28.89:8080
Request
URL:http://162.244.28.89:8080/BrandService/resources/brands/
Request
Method:GET
Status
Code:403 Forbidden
Request Headersview source
Accept:application/json,
text/plain, */*
Accept-Encoding:gzip,
deflate, sdch
Accept-Language:de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4
Authorization:Bearer
eyJhbGciOiJSUzI1NiJ9….ay2Sr-GP0CYfSDV7O2Q8sNyx91RgHdhy2S600NYEHUFG2VoF5cRCDBJpkuPbcXVtz2liMy-80S3KY9lfII
Connection:keep-alive
Host:162.244.28.89:8080
Origin:http://162.244.28.89
Referer:http://162.244.28.89/
User-Agent:Mozilla/5.0
(Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/39.0.2171.99 Safari/537.36
Response Headersview source
Cache-Control:no-cache,
no-store, must-revalidate
Connection:keep-alive
Content-Length:68
Content-Type:text/html;charset=UTF-8
Date:Fri,
23 Jan 2015 19:23:33 GMT
Expires:0
Pragma:no-cache
Server:WildFly/8
X-Powered-By:Undertow/1
ConsoleSearchEmulationRendering
What I don’t get is the
response header. Shouldn’t there be the following header
settings:
Access-Control-Allow-Credentials:true
Access-Control-Allow-Headers:origin,accept,content-type
Access-Control-Allow-Methods:GET,
POST, PUT, DELETE, OPTIONS, HEAD
Access-Control-Allow-Origin:*
Access-Control-Max-Age:151200
Allow:HEAD,
POST, GET, OPTIONS, PUT
My keycloak.json looks
like that:
{
"realm": "openPixx",
"realm-public-key": "…bmwCckE..gWjLQIDAQAB",
"ssl-required": "external",
"resource": "BrandService",
"bearer-only": true,
"cors-max-age" : 1000,
"enable-cors": true,
"cors-allowed-methods" : "POST, PUT, DELETE, GET"
}
In Keycloak I’ve defined
the BrandFrontend:
Enabled:
true
Client
Protocol: openid-connect
Access
Type: public
Redirect
URL:
http://162.244.28.89/*
Web
Origin:
http://162.244.28.89
For the AngularJS part
I’ve used the
authinterceptor from the example.
If you have read until
here.
Thank you very much and
sorry for my bad English
J
Greets
Rob