网站建设 >

查看其它板块

SpringBoot/Angular整合Keycloak实现单点登录

本文介绍了Keycloak基础知识、ADFS和Salesforce IDP配置、Spring Boot和Angular集成Keycloak实现单点登录的方法。

在龙沙等地区，都构建了全面的区域性战略布局，加强发展的系统性、市场前瞻性、产品创新能力，以专注、极致的服务理念，为客户提供成都网站设计、成都做网站网站设计制作按需求定制制作,公司网站建设,企业网站建设,高端网站设计,全网整合营销推广,成都外贸网站建设公司,龙沙网站建设费用合理。

本文代码以Angular 8集成Spring Boot 2详解为基础，删除了原JWT、用户、权限、登录等代码。Angular代码使用了keycloak-angular，稍做修改。GitHub源码地址：heroes-api 、heroes-web 。

软件环境：
Keycloak 8.0.1
Spring Boot 2.2.2
Angular 8.2
ADFS 2016
Salesforce Cloud

Keycloak

Keycloak为现代应用和服务提供开源的认证和访问管理，即通常所说的认证和授权。Keycloak支持OpenID、OAuth 2.0和SAML 2.0协议；支持用户注册、用户管理、权限管理；支持OTP，支持代理OpenID、SAML 2.0 IDP，支持GitHub、LinkedIn等第三方登录，支持整合LDAP和Active Directory；支持自定义认证流程、自定义用户界面，支持国际化。

Keycloak支持Java、C#、Python、Android、iOS、JavaScript、Nodejs等平台或语言，提供简单易用的Adapter，仅需少量配置和代码即可实现SSO。

Keycloak新的发行版命名为Quarkus，专为GraalVM和OpenJDK HotSpot量身定制的一个Kurbernetes Native Java框架，计划2019年底正式发布。

安装

Keycloak构建在WildFly application server之上，从官网下载Standalone server distribution解压后运行bin/standalone.sh即可启动。默认使用h3数据库，可以修改配置使用其它数据库。Standalone Clustered Mode、Domain Clustered Mode启动模式和更多配置请参阅官方文档。
默认，本地网址为http://localhost:8080/auth ，首次登录时必须创建admin用户：
Spring Boot/Angular整合Keycloak实现单点登录
直接登录Admin Console http://localhost:8080/auth/admin/ ：

Realm

Spring Boot/Angular整合Keycloak实现单点登录
为保护不同的应用，通常创建不同的Realm，各Realm间的数据和配置是独立的。初始创建的Realm为Master，Master是最高级别的Realm。Master Realm内的admin用户（授予admin角色的用户）拥有查看和管理任何其它realm的权限。因此，不推荐使用master realm管理用户和应用，而应仅供超级管理员来创建和管理realm。
每个realm有专用的管理控制台，可以设置自已的管理员账号，比如接下来我们创建的heroes realm，控制台网址为http://localhost:8080/auth/admin/heroes/console 。
创建Heroes realm
点击左上角下拉菜单 -> Add realm：
Spring Boot/Angular整合Keycloak实现单点登录

Login Tab中有多个可配置选项：用户注册、编辑用户名、忘记密码、记住我、验证email、使用email登录、需要SSL。

其中，Require SSL有三个选项：all requests、external requests、none，默认为external requests，在生产环境中应配置为all requests。

all requests 所有请求都需通过HTTPS访问
external requests localhost和私有IP不需通过HTTPS访问
none 任何客户端都不需HTTPS

Themes Tab可以配置界面主题、启用国际化：
Spring Boot/Angular整合Keycloak实现单点登录
Tokens Tab可以配置token签名算法、过期时间等。

Client

Client是realm中受信任的应用。
Spring Boot/Angular整合Keycloak实现单点登录
创建realm后自动创建以下client：

account 账户管理

Spring Boot/Angular整合Keycloak实现单点登录
如Realm配置中启用了User-Managed Access则可以管理自己的Resource：

admin-cli
broker
realm-management 预置了realm管理角色，创建realm管理员时需要分配这些角色
security-admin-console realm管理控制台

创建heroes client
点击Clients右上方的Create：
Spring Boot/Angular整合Keycloak实现单点登录

Client Protocol使用默认值openid-connect。Access Type有三个选项confidential、public、bearer-only，保持默认值public。confidential需要client secret，但我们将在web应用中使用此client，web无法以安全的方式传输secret，因此必须使用public client。只要严格使用HTTPS，可以保证安全。Valid Redirect URIs输入 http://localhost:4200/* 。

认证流程：

Standard Flow 即OAuth 2.0规范中的Authorization Code Flow，推荐使用的认证流程，安全性高。keycloak验证用户后附带一次性、临时的Authorization Code重定向到浏览器，浏览器凭此Code与keycloak交换token（identity、access和refresh token）
Implicit Flow keycloak验证用户后直接返回identity和access token
Direct Access Grants REST client获取token的方式，使用HTTP Post请求，响应结果包含access和refresh token

调用示例，POST请求地址：http://localhost:8080/auth/realms/heroes/protocol/openid-connect/token ：
Spring Boot/Angular整合Keycloak实现单点登录
OIDC URI Endpoints
查询网址：http://localhost:8080/auth/realms/heroes/.well-known/openid-configuration ，这些Endpoint是非常有用的，比如REST调用。

Client Scope

Client Scope定义了协议映射关系，keycloak预定义了一些Scope，每个client会自动继承，这样就不必在client内重复定义mapper了。Client Scope分为default和optional两种， default scope会自动生效，optional scope指定使用时才生效。
Spring Boot/Angular整合Keycloak实现单点登录
启用optional scope需要使用scope参数：

启用相应scope或配置mapper后，才能在token或userinfo中显示相应的属性。比如，上图中我们启用了phone scope，其mapper中定义了phone number：

如果用户属性中定义了phoneNumber，在token中则会显示phone_number，可以在heroes client -> Client Scopes -> Evaluate查看效果：
Spring Boot/Angular整合Keycloak实现单点登录

Role、Group、User

Role
Role分为两种级别：Realm、Client，默认Realm Role：offline_access、uma_authorization。

offline access
OpenID规范中定义了offline access，用户登录获得offline token，当用户退出后offline token仍可使用。在很多场景中是非常有用的，比如每日离线备份数据。要获得offline token除需offline_access角色外，还需指定offline_access Scope。默认，offline token不会过期，但需每30天刷新一次。offline token可以撤销：
uma_authorization
uma是User-Managed Access的缩写，Keycloak是符合UMA 2.0功能的授权服务器。

Role、Group和User的关系
User可以属于一个或多个Group，Role可以授予User和Group。
创建Realm管理用户
添加用户：
Spring Boot/Angular整合Keycloak实现单点登录
授予realm-management权限：

Authentication

Keycloak预定义了Browser、Direct Grant、Registration、Reset Credentials等认证流程，用户也可自定义流程。以Brower流程为例：
Spring Boot/Angular整合Keycloak实现单点登录
Required是必须执行的，Alternative至少须执行一个，Optional则由用户决定是否启用。Browser流程中Cookie（Session Cookie）、Identity Provider Redirector、Forms均为Alternative，因此只有前者没有验证成功才会执行后者。其中Identity Provider可以配置默认IDP；当执行Form认证时，用户名/密码是必须的，OTP为可选的。
用户启用OTP的方法，登录Account Console，点击认证方，根据说明操作即可：
Spring Boot/Angular整合Keycloak实现单点登录

Identity Provider

支持代理OpenID、SAML 2.0 IDP，支持社交登录。无论您采用什么认证方式，token都由keycloak签发，完全与外部IDP解耦，客户端不需知道keycloak与IDP使用的协议，简化了认证和授权管理。
Identity Broker Flow:
Spring Boot/Angular整合Keycloak实现单点登录
解释一下第7、8步：
IDP认证成功后，重定向到keycloak，通常返回的响应中包含一个security token。Keycloak检查response是否有效，如果有效将在keycloak创建一个新用户（如果用户已存在则跳过此步，如果IDP更新了用户信息则会同步信息），之后keycloak颁发自己的token。

Keycloak支持配置默认IDP，客户端也可以请求指定的IDP。

若要配置IDP，Keycloak需要启用SSL/HTTPS。在生产环境一般使用reverse proxy或load balancer启用HTTPS。为了演示，我们在keycloak server中配置。

创建自签名证书和Java Keystore

$ keytool -genkey -alias sso.itrunner.org -keyalg RSA -keystore keycloak.jks -validity 10950
Enter keystore password:
Re-enter new password:
What is your first and last name?
  [Unknown]:  sso.itrunner.org
What is the name of your organizational unit?
  [Unknown]:  itrunner
What is the name of your organization?
  [Unknown]:  itrunner
What is the name of your City or Locality?
  [Unknown]:  Beijing
What is the name of your State or Province?
  [Unknown]:  Beijing
What is the two-letter country code for this unit?
  [Unknown]:  CN
Is CN=sso.itrunner.org, OU=itrunner, O=itrunner, L=Beijing, ST=Beijing, C=CN correct?
  [no]:  yes

Enter key password for 
        (RETURN if same as keystore password):
Re-enter new password:

配置keycloak使用Keystore

将keycloak.jks拷贝到configuration/目录，连接Jboss CLI后执行以下命令创建新的security-realm：

$ /core-service=management/security-realm=UndertowRealm:add()

$ /core-service=management/security-realm=UndertowRealm/server-identity=ssl:add(keystore-path=keycloak.jks, keystore-relative-to=jboss.server.config.dir, keystore-password=secret)

修改https-listener使用新创建的realm：

$ /subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=security-realm, value=UndertowRealm)

下面介绍如何配置SAML 2.0协议的ADFS和Salesforce IDP。

ADFS

配置Keycloak Identity Provider
Identity Providers -> Add provider -> SAML v2.0：
Spring Boot/Angular整合Keycloak实现单点登录
填入Alias、Display Name后滚动到底部，导入ADFS FederationMetadata：

ADFS FederationMetadata地址为：https://adfs.domain.name/FederationMetadata/2007-06/FederationMetadata.xml ，也可以保存后从文件导入。
导入成功后，NameID Policy Format选择Email，启用Want AuthnRequests Signed和Validate Signature，SAML Signature Key Name选择CERT_SUBJECT。
Spring Boot/Angular整合Keycloak实现单点登录
保存后配置映射关系email、firstName、lastName，使ADFS和Keycloak的用户信息相对应：

Mapper Type选择Attribute Importer，Attribute Name分别为：
email -> http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
firstName -> http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
lastName -> http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
配置ADFS
先从IDP获取SAML descriptor：https://sso.itrunner.org:8443/auth/realms/heroes/broker/adfs/endpoint/descriptor ，也可以从Identity Provider -> Export下载。

配置Relying Party

进入AD FS管理控制台，右击Relying Party Trusts -> Add Relying Party Trust：
Spring Boot/Angular整合Keycloak实现单点登录
选择Claims aware -> Start：

导入之前的descriptor XML文件。

输入Display Name，接下来的设置保持默认值。

配置Claim映射

我们需要配置两个Rule：Name ID和User属性。在弹出的Edit Claim Issuance Policy窗口中点击Add Rule：
Name ID的rule template选择Transform an incoming claim：
Spring Boot/Angular整合Keycloak实现单点登录

User属性的rule template选择Send LDAP attributes as Claims，然后添加以下属性：
Spring Boot/Angular整合Keycloak实现单点登录

说明：如果ADFS为自签名证书，需要将证书导入Java truststore

Salesforce

前提，Salesforce已启用Identity Provider并分配了域名。如果未启用，依次进入 Setup -> Setttins -> Identity -> Identity Provider -> Enable。启用后点击Download Metadata下载Metadata。
配置Keycloak Identity Provider
Identity Providers -> Add provider -> SAML v2.0：
Spring Boot/Angular整合Keycloak实现单点登录
填入Alias、Display Name后滚动到底部，导入Salesforce Metadata：

导入成功后，NameID Policy Format选择Persistent，启用Want AuthnRequests Signed和Validate Signature，SAML Signature Key Name选择KEYI_ID。

保存后配置映射关系email、firstName、lastName：
Spring Boot/Angular整合Keycloak实现单点登录
配置Salesforce Connected App
在Salesforce Identity Provider页面，点击底部Service Providers的链接"Click here"，创建新的Connected App：

接下来配置SAML，同样先从IDP获取SAML descriptor：https://sso.itrunner.org:8443/auth/realms/heroes/broker/salesforce/endpoint/descriptor ，其中包含了下面需要的内容：
Spring Boot/Angular整合Keycloak实现单点登录
保存，然后点击页面顶部的Manage，配置Profiles和Permission Sets：

最后定义Custom Attributes：firstName、lastName：

Spring Boot

采用Keycloak结合Spring security的方式。

POM Dependency


    ...
    
        org.keycloak
        keycloak-spring-boot-starter
    
    ...



    
        
            org.keycloak.bom
            keycloak-adapter-bom
            8.0.1
            pom
            import

Keycloak配置

application.yml：

keycloak:
  cors: true
  cors-allowed-methods: GET,POST,DELETE,PUT,OPTIONS
  cors-allowed-headers: Accept,Accept-Encoding,Accept-Language,Authorization,Connection,Content-Type,Host,Origin,Referer,User-Agent,X-Requested-With

application-dev.yml

keycloak:
  enabled: true
  auth-server-url: http://localhost:8090/auth
  realm: heroes
  resource: heroes
  public-client: true
  bearer-only: true

application-prod.yml

keycloak:
  enabled: true
  auth-server-url: https://sso.itrunner.org/auth
  realm: heroes
  resource: heroes
  public-client: true
  ssl-required: all
  disable-trust-manager: true
  bearer-only: true

WebSecurityConfig

Keycloak提供了便利的基类KeycloakWebSecurityConfigurerAdapter来创建WebSecurityConfigurer。

package org.itrunner.heroes.config;

import org.keycloak.adapters.springsecurity.KeycloakSecurityComponents;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.client.KeycloakClientRequestFactory;
import org.keycloak.adapters.springsecurity.client.KeycloakRestTemplate;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticatedActionsFilter;
import org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter;
import org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter;
import org.keycloak.adapters.springsecurity.filter.KeycloakSecurityContextRequestFilter;
import org.keycloak.adapters.springsecurity.management.HttpSessionManager;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.beans.factory.config.ConfigurableBeanFactory;
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Scope;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;

@EnableWebSecurity
@ComponentScan(basePackageClasses = KeycloakSecurityComponents.class)
public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
    private static final String ROLE_ADMIN = "ADMIN";

    @Value("${security.ignore-paths}")
    private String[] ignorePaths;

    @Value("${management.endpoints.web.exposure.include}")
    private String[] actuatorExposures;

    public final KeycloakClientRequestFactory keycloakClientRequestFactory;

    public WebSecurityConfig(KeycloakClientRequestFactory keycloakClientRequestFactory) {
        this.keycloakClientRequestFactory = keycloakClientRequestFactory;
    }

    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers(ignorePaths);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        SimpleAuthorityMapper grantedAuthoritiesMapper = new SimpleAuthorityMapper();
        grantedAuthoritiesMapper.setConvertToUpperCase(true);
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(grantedAuthoritiesMapper);
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.csrf().disable().authorizeRequests().requestMatchers(EndpointRequest.to(actuatorExposures)).permitAll().anyRequest().hasRole(ROLE_ADMIN);
    }

    @Bean
    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new NullAuthenticatedSessionStrategy();
    }

    @Bean
    @Scope(ConfigurableBeanFactory.SCOPE_PROTOTYPE)
    public KeycloakRestTemplate keycloakRestTemplate() {
        return new KeycloakRestTemplate(keycloakClientRequestFactory);
    }

    @Bean
    public FilterRegistrationBean keycloakAuthenticationProcessingFilterRegistrationBean(KeycloakAuthenticationProcessingFilter filter) {
        FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
        registrationBean.setEnabled(false);
        return registrationBean;
    }

    @Bean
    public FilterRegistrationBean keycloakPreAuthActionsFilterRegistrationBean(KeycloakPreAuthActionsFilter filter) {
        FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
        registrationBean.setEnabled(false);
        return registrationBean;
    }

    @Bean
    public FilterRegistrationBean keycloakAuthenticatedActionsFilterBean(KeycloakAuthenticatedActionsFilter filter) {
        FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
        registrationBean.setEnabled(false);
        return registrationBean;
    }

    @Bean
    public FilterRegistrationBean keycloakSecurityContextRequestFilterBean(KeycloakSecurityContextRequestFilter filter) {
        FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
        registrationBean.setEnabled(false);
        return registrationBean;
    }

    @Bean
    @Override
    @ConditionalOnMissingBean(HttpSessionManager.class)
    protected HttpSessionManager httpSessionManager() {
        return new HttpSessionManager();
    }
}

说明：

Spring Security默认的角色前缀是 “ROLE_”，为保持一致性，将KeycloakAuthenticationProvider的grantedAuthoritiesMapper设置为SimpleAuthorityMapper
Session策略设置为NullAuthenticatedSessionStrategy，无状态REST不需Session
添加FilterRegistrationBean防止重复注册filter bean
Spring Boot 2默认禁用spring.main.allow-bean-definition-overriding，给httpSessionManager方法添加@ConditionalOnMissingBean注解，否则会抛出BeanDefinitionOverrideException
KeycloakRestTemplate扩展了RestTemplate，在受Keycloak保护的应用间调用时会自动验证，为启用这一功能必须添加KeycloakRestTemplate bean，KeycloakRestTemplate用法如下：

KeycloakRestTemplate

@Service
public class RemoteProductService {

    @Autowired
    private KeycloakRestTemplate template;

    private String endpoint;

    public List getProducts() {
        ResponseEntity response = template.getForEntity(endpoint, String[].class);
        return Arrays.asList(response.getBody());
    }
}

SpringBootApplication

默认，Keycloak Spring Security Adapter将查找keycloak.json配置文件，为确保使用Keycloak Spring Boot Adapter的配置增加KeycloakSpringBootConfigResolver：

@SpringBootApplication
@EnableJpaRepositories(basePackages = {"org.itrunner.heroes.repository"})
@EntityScan(basePackages = {"org.itrunner.heroes.domain"})
@EnableJpaAuditing
public class HeroesApplication {
    public static void main(String[] args) {
        SpringApplication.run(HeroesApplication.class, args);
    }

    @Bean
    public KeycloakSpringBootConfigResolver KeycloakConfigResolver() {
        return new KeycloakSpringBootConfigResolver();
    }
}

SecurityContext

工具类，从SecurityContext Authentication中获取登录用户的信息。

package org.itrunner.heroes.util;

import org.keycloak.KeycloakSecurityContext;
import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken;
import org.keycloak.representations.AccessToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;

import java.util.Optional;

import static java.util.Optional.empty;
import static java.util.Optional.of;

public final class KeycloakContext {
    private KeycloakContext() {
    }

    public static Optional getAccessToken() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        if (authentication == null || !(authentication instanceof KeycloakAuthenticationToken) || !authentication.isAuthenticated()) {
            return empty();
        }
        KeycloakSecurityContext credentials = (KeycloakSecurityContext) authentication.getCredentials();
        return of(credentials.getToken());
    }

    public static Optional getUsername() {
        Optional accessToken = getAccessToken();
        return accessToken.map(AccessToken::getPreferredUsername);
    }

    public static Optional getEmail() {
        Optional accessToken = getAccessToken();
        return accessToken.map(AccessToken::getEmail);
    }

}

TestRestTemplate测试

调用Keycloak token endpoint获取access token，然后添加到BearerAuth Header。

package org.itrunner.heroes;

import org.itrunner.heroes.domain.Hero;
import org.itrunner.heroes.exception.ErrorMessage;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
import org.springframework.boot.test.web.client.TestRestTemplate;
import org.springframework.http.*;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;

import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import static org.assertj.core.api.Assertions.assertThat;

@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
class HeroesApplicationTests {

    @Autowired
    private TestRestTemplate restTemplate;

    @BeforeEach
    void setup() {
        HttpHeaders requestHeaders = new HttpHeaders();
        requestHeaders.setContentType(MediaType.APPLICATION_FORM_URLENCODED);

        MultiValueMap map = new LinkedMultiValueMap<>();
        map.add("grant_type", "password");
        map.add("client_id", "heroes");
        map.add("username", "admin");
        map.add("password", "admin");

        HttpEntity> requestEntity = new HttpEntity<>(map, requestHeaders);

        Map response = restTemplate.postForObject("http://localhost:8090/auth/realms/heroes/protocol/openid-connect/token", requestEntity, Map.class);
        String token = response.get("access_token");

        restTemplate.getRestTemplate().setInterceptors(
                Collections.singletonList((request, body, execution) -> {
                    HttpHeaders headers = request.getHeaders();
                    headers.setBearerAuth(token);
                    return execution.execute(request, body);
                }));
    }

    @Test
    void crudSuccess() {
        Hero hero = new Hero();
        hero.setName("Jack");

        // add hero
        hero = restTemplate.postForObject("/api/heroes", hero, Hero.class);
        assertThat(hero.getId()).isNotNull();

        // update hero
        hero.setName("Jacky");
        HttpEntity requestEntity = new HttpEntity<>(hero);
        hero = restTemplate.exchange("/api/heroes", HttpMethod.PUT, requestEntity, Hero.class).getBody();
        assertThat(hero.getName()).isEqualTo("Jacky");

        // find heroes by name
        Map urlVariables = new HashMap<>();
        urlVariables.put("name", "m");
        List heroes = restTemplate.getForObject("/api/heroes/?name={name}", List.class, urlVariables);
        assertThat(heroes.size()).isEqualTo(5);

        // get hero by id
        hero = restTemplate.getForObject("/api/heroes/" + hero.getId(), Hero.class);
        assertThat(hero.getName()).isEqualTo("Jacky");

        // delete hero successfully
        ResponseEntity response = restTemplate.exchange("/api/heroes/" + hero.getId(), HttpMethod.DELETE, null, String.class);
        assertThat(response.getStatusCodeValue()).isEqualTo(200);

        // delete hero
        response = restTemplate.exchange("/api/heroes/9999", HttpMethod.DELETE, null, String.class);
        assertThat(response.getStatusCodeValue()).isEqualTo(400);
    }

    ...
}

MockMvc测试

为了mock KeycloakSecurityContext，定义WithMockKeycloakUser注解和实现类WithMockCustomUserSecurityContextFactory：
WithMockKeycloakUser

package org.itrunner.heroes.base;

import org.springframework.security.test.context.support.WithSecurityContext;

import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;

@Retention(RetentionPolicy.RUNTIME)
@WithSecurityContext(factory = WithMockCustomUserSecurityContextFactory.class)
public @interface WithMockKeycloakUser {
    String username() default "admin";

    String email() default "admin@itrunner.org";

    String[] roles() default {"USER", "ADMIN"};
}

WithMockCustomUserSecurityContextFactory

package org.itrunner.heroes.base;

import org.keycloak.KeycloakPrincipal;
import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
import org.keycloak.adapters.spi.KeycloakAccount;
import org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount;
import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken;
import org.keycloak.representations.AccessToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.test.context.support.WithSecurityContextFactory;

import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;

public class WithMockCustomUserSecurityContextFactory implements WithSecurityContextFactory {
    @Override
    public SecurityContext createSecurityContext(WithMockKeycloakUser keycloakUser) {
        AccessToken accessToken = new AccessToken();
        accessToken.setPreferredUsername(keycloakUser.username());
        accessToken.setEmail(keycloakUser.email());
        accessToken.expiration(Integer.MAX_VALUE);
        accessToken.setScope("openid profile email");
        accessToken.type("Bearer");

        RefreshableKeycloakSecurityContext keycloakSecurityContext = new RefreshableKeycloakSecurityContext(null, null, "access-token-string", accessToken, null, null, null);
        KeycloakPrincipal principal = new KeycloakPrincipal<>("user-id", keycloakSecurityContext);

        HashSet roles = new HashSet<>();
        List grantedAuthorities = new ArrayList<>();
        for (String role : keycloakUser.roles()) {
            roles.add(role);
            grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_" + role));
        }
        KeycloakAccount account = new SimpleKeycloakAccount(principal, roles, keycloakSecurityContext);
        Authentication auth = new KeycloakAuthenticationToken(account, false, grantedAuthorities);

        SecurityContext context = SecurityContextHolder.createEmptyContext();
        context.setAuthentication(auth);
        return context;
    }
}

注意，WebSecurityConfig中我们使用了SimpleAuthorityMapper，这里要使用SimpleGrantedAuthority。
测试示例

package org.itrunner.heroes.controller;

import org.itrunner.heroes.base.WithMockKeycloakUser;
import org.itrunner.heroes.domain.Hero;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.http.MediaType;
import org.springframework.test.web.servlet.MockMvc;

import static org.itrunner.heroes.util.JsonUtils.asJson;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@SpringBootTest
@AutoConfigureMockMvc
class HeroControllerTest {
    @Autowired
    private MockMvc mvc;

    @Test
    @WithMockKeycloakUser
    public void crudSuccess() throws Exception {
        Hero hero = new Hero();
        hero.setName("Jack");

        // add hero
        mvc.perform(post("/api/heroes").content(asJson(hero)).contentType(MediaType.APPLICATION_JSON).accept(MediaType.APPLICATION_JSON))
                .andExpect(status().isOk()).andExpect(content().json("{'id':11, 'name':'Jack', 'createBy':'admin'}"));

        // update hero
        hero.setId(11l);
        hero.setName("Jacky");
        mvc.perform(put("/api/heroes").content(asJson(hero)).contentType(MediaType.APPLICATION_JSON).accept(MediaType.APPLICATION_JSON))
                .andExpect(status().isOk()).andExpect(content().json("{'name':'Jacky'}"));

        // find heroes by name
        mvc.perform(get("/api/heroes/?name=m").accept(MediaType.APPLICATION_JSON))
                .andExpect(status().isOk());

        // get hero by id
        mvc.perform(get("/api/heroes/11").accept(MediaType.APPLICATION_JSON))
                .andExpect(status().isOk()).andExpect(content().json("{'name':'Jacky'}"));

        // delete hero successfully
        mvc.perform(delete("/api/heroes/11").accept(MediaType.APPLICATION_JSON))
                .andExpect(status().isOk());

        // delete hero
        mvc.perform(delete("/api/heroes/9999")).andExpect(status().is4xxClientError());
    }

    @Test
    @WithMockKeycloakUser
    void addHeroValidationFailed() throws Exception {
        Hero hero = new Hero();
        mvc.perform(post("/api/heroes").content(asJson(hero)).contentType(MediaType.APPLICATION_JSON))
                .andExpect(status().is(400));
    }
}

Angular

package.json

引入keycloak-js，版本要与Keycloak Server一致。

...
"keycloak-js": "8.0.1",
...

KeycloakService

KeycloakService创建Keycloak实例，提供与Keycloak交互的基本方法。

import {Injectable} from '@angular/core';
import {HttpHeaders} from '@angular/common/http';
import {Observable} from 'rxjs';
import {ExcludedUrl, ExcludedUrlRegex, KeycloakOptions} from './keycloak-options';
import * as Keycloak from 'keycloak-js';

@Injectable({providedIn: 'root'})
export class KeycloakService {
  private keycloak: Keycloak.KeycloakInstance;
  private userProfile: Keycloak.KeycloakProfile;
  private loadUserProfileAtStartUp: boolean;
  private _enableBearerInterceptor: boolean;
  private _excludedUrls: ExcludedUrlRegex[];

  /**
   * Keycloak initialization. It should be called to initialize the adapter.
   * Options is a object with 2 main parameters: config and initOptions. The first one will be used to create the Keycloak instance.
   * The second one are options to initialize the keycloak instance.
   *
   * @param options
   * Config: may be a string representing the keycloak URI or an object with the following content:
   * - url: Keycloak json URL
   * - realm: realm name
   * - clientId: client id
   *
   * initOptions:
   * - onLoad: Specifies an action to do on load. Supported values are 'login-required' or 'check-sso'.
   * - token: Set an initial value for the token.
   * - refreshToken: Set an initial value for the refresh token.
   * - idToken: Set an initial value for the id token (only together with token or refreshToken).
   * - timeSkew: Set an initial value for skew between local time and Keycloak server in seconds(only together with token or refreshToken).
   * - checkLoginIframe: Set to enable/disable monitoring login state (default is true).
   * - checkLoginIframeInterval: Set the interval to check login state (default is 5 seconds).
   * - responseMode: Set the OpenID Connect response mode send to Keycloak server at login request.
   * Valid values are query or fragment . Default value is fragment, which means that after successful authentication will Keycloak redirect to
   * javascript application with OpenID Connect parameters added in URL fragment. This is generally safer and recommended over query.
   * - flow: Set the OpenID Connect flow. Valid values are standard, implicit or hybrid.
   *
   * enableBearerInterceptor: Flag to indicate if the bearer will added to the authorization header.
   *
   * loadUserProfileInStartUp: Indicates that the user profile should be loaded at the keycloak initialization, just after the login.
   *
   * bearerExcludedUrls: String Array to exclude the urls that should not have the Authorization Header automatically added.
   *
   * @returns A Promise with a boolean indicating if the initialization was successful.
   */
  init(options: KeycloakOptions = {}): Promise {
    return new Promise((resolve, reject) => {
      this.initServiceValues(options);

      const {config, initOptions} = options;

      this.keycloak = Keycloak(config);

      this.keycloak.init(initOptions)
        .success(async authenticated => {
          if (authenticated && this.loadUserProfileAtStartUp) {
            await this.loadUserProfile();
          }
          resolve(authenticated);
        })
        .error((kcError) => {
          let msg = 'An error happened during Keycloak initialization.';
          if (kcError) {
            msg = msg.concat(`\nAdapter error details:\nError: ${kcError.error}\nDescription: ${kcError.error_description}`
            );
          }
          reject(msg);
        });
    });
  }

  /**
   * Loads all bearerExcludedUrl content in a uniform type: ExcludedUrl,
   * so it becomes easier to handle.
   *
   * @param bearerExcludedUrls array of strings or ExcludedUrl that includes
   * the url and HttpMethod.
   */
  private loadExcludedUrls(bearerExcludedUrls: (string | ExcludedUrl)[]): ExcludedUrlRegex[] {
    const excludedUrls: ExcludedUrlRegex[] = [];
    for (const item of bearerExcludedUrls) {
      let excludedUrl: ExcludedUrlRegex;
      if (typeof item === 'string') {
        excludedUrl = {urlPattern: new RegExp(item, 'i'), httpMethods: []};
      } else {
        excludedUrl = {
          urlPattern: new RegExp(item.url, 'i'),
          httpMethods: item.httpMethods
        };
      }
      excludedUrls.push(excludedUrl);
    }
    return excludedUrls;
  }

  /**
   * Handles the class values initialization.
   */
  private initServiceValues({enableBearerInterceptor = true, loadUserProfileAtStartUp = true, bearerExcludedUrls = []}): void {
    this._enableBearerInterceptor = enableBearerInterceptor;
    this.loadUserProfileAtStartUp = loadUserProfileAtStartUp;
    this._excludedUrls = this.loadExcludedUrls(bearerExcludedUrls);
  }

  /**
   * Redirects to login form
   */
  login(options: Keycloak.KeycloakLoginOptions = {}): Promise {
    return new Promise((resolve, reject) => {
      this.keycloak.login(options)
        .success(async () => {
          if (this.loadUserProfileAtStartUp) {
            await this.loadUserProfile();
          }
          resolve();
        })
        .error(() => reject(`An error happened during the login.`));
    });
  }

  /**
   * Redirects to logout.
   *
   * @param redirectUri Specifies the uri to redirect to after logout.
   * @returns A void Promise if the logout was successful, cleaning also the userProfile.
   */
  logout(redirectUri?: string): Promise {
    return new Promise((resolve, reject) => {
      const options: any = {redirectUri};

      this.keycloak.logout(options)
        .success(() => {
          this.userProfile = undefined;
          resolve();
        })
        .error(() => reject('An error happened during logout.'));
    });
  }

  /**
   * Redirects to the Account Management Console
   */
  account() {
    this.keycloak.accountManagement();
  }

  /**
   * Check if the user has access to the specified role.
   *
   * @param role role name
   * @param resource resource name If not specified, `clientId` is used
   * @returns A boolean meaning if the user has the specified Role.
   */
  hasRole(role: string, resource?: string): boolean {
    let hasRole: boolean;

    hasRole = this.keycloak.hasResourceRole(role, resource);
    if (!hasRole) {
      hasRole = this.keycloak.hasRealmRole(role);
    }
    return hasRole;
  }

  /**
   * Check if user is logged in.
   *
   * @returns A boolean that indicates if the user is logged in.
   */
  async isLoggedIn(): Promise {
    try {
      if (!this.keycloak.authenticated) {
        return false;
      }
      await this.updateToken(20);
      return true;
    } catch (error) {
      return false;
    }
  }

  /**
   * Returns true if the token has less than minValidity seconds left before it expires.
   *
   * @param minValidity Seconds left. (minValidity) is optional. Default value is 0.
   * @returns Boolean indicating if the token is expired.
   */
  isTokenExpired(minValidity: number = 0): boolean {
    return this.keycloak.isTokenExpired(minValidity);
  }

  /**
   * If the token expires within minValidity seconds the token is refreshed. If the
   * session status iframe is enabled, the session status is also checked.
   * Returns a promise telling if the token was refreshed or not. If the session is not active
   * anymore, the promise is rejected.
   *
   * @param minValidity Seconds left. (minValidity is optional, if not specified 5 is used)
   * @returns Promise with a boolean indicating if the token was successfully updated.
   */
  updateToken(minValidity: number = 5): Promise {
    return new Promise(async (resolve, reject) => {
      if (!this.keycloak) {
        reject('Keycloak Angular library is not initialized.');
        return;
      }

      this.keycloak.updateToken(minValidity)
        .success(refreshed => {
          resolve(refreshed);
        })
        .error(() => reject('Failed to refresh the token, or the session is expired'));
    });
  }

  /**
   * Returns the authenticated token, calling updateToken to get a refreshed one if
   * necessary. If the session is expired this method calls the login method for a new login.
   *
   * @returns Promise with the generated token.
   */
  getToken(): Promise {
    return new Promise(async (resolve) => {
      try {
        await this.updateToken(10);
        resolve(this.keycloak.token);
      } catch (error) {
        this.login();
      }
    });
  }

  /**
   * Loads the user profile.
   * Returns promise to set functions to be invoked if the profile was loaded
   * successfully, or if the profile could not be loaded.
   *
   * @param forceReload
   * If true will force the loadUserProfile even if its already loaded.
   * @returns
   * A promise with the KeycloakProfile data loaded.
   */
  loadUserProfile(forceReload: boolean = false): Promise {
    return new Promise(async (resolve, reject) => {
      if (this.userProfile && !forceReload) {
        resolve(this.userProfile);
        return;
      }

      if (!this.keycloak.authenticated) {
        reject('The user profile was not loaded as the user is not logged in.');
        return;
      }

      this.keycloak.loadUserProfile()
        .success(result => {
          this.userProfile = result as Keycloak.KeycloakProfile;
          resolve(this.userProfile);
        })
        .error(() => reject('The user profile could not be loaded.'));
    });
  }

  /**
   * Returns the logged username.
   */
  getUsername(): string {
    if (!this.userProfile) {
      throw new Error('User not logged in or user profile was not loaded.');
    }

    return this.userProfile.username;
  }

  /**
   * Returns email of the logged user
   */
  getUserEmail(): string {
    if (!this.userProfile) {
      throw new Error('User not logged in or user profile was not loaded.');
    }

    return this.userProfile.email;
  }

  /**
   * Clear authentication state, including tokens. This can be useful if application
   * has detected the session was expired, for example if updating token fails.
   * Invoking this results in onAuthLogout callback listener being invoked.
   */
  clearToken(): void {
    this.keycloak.clearToken();
  }

  /**
   * Adds a valid token in header. The key & value format is: Authorization Bearer .
   * If the headers param is undefined it will create the Angular headers object.
   *
   * @param headers Updated header with Authorization and Keycloak token.
   * @returns An observable with the HTTP Authorization header and the current token.
   */
  addTokenToHeader(headers: HttpHeaders = new HttpHeaders()): Observable {
    return new Observable((observer) => {
      this.getToken().then(token => {
        headers = headers.set('Authorization', 'bearer ' + token);
        observer.next(headers);
        observer.complete();
      }).catch(error => {
        observer.error(error);
      });
    });
  }

  get enableBearerInterceptor(): boolean {
    return this._enableBearerInterceptor;
  }

  get excludedUrls(): ExcludedUrlRegex[] {
    return this._excludedUrls;
  }
}

Keycloak配置

创建Keycloak实例时若未提供config参数，则将使用keycloak.json。为适用不同的环境，我们在environment中配置Keycloak参数。
environment.ts

export const environment = {
  production: false,
  apiUrl: 'http://localhost:8080',
  keycloak: {
    config: {
      url: 'http://localhost:8090/auth',
      realm: 'heroes',
      clientId: 'heroes'
    },
    initOptions: {
      onLoad: 'login-required',
      checkLoginIframe: false
    },
    enableBearerInterceptor: true,
    loadUserProfileAtStartUp: true,
    bearerExcludedUrls: ['/assets']
  }
};

environment.prod.ts

export const environment = {
  production: true,
  apiUrl: 'http://heroes-api.apps.itrunner.org',
  keycloak: {
    config: {
      url: 'https://sso.itrunner.org/auth',
      realm: 'heroes',
      clientId: 'heroes'
    },
    initOptions: {
      onLoad: 'login-required',
      checkLoginIframe: false
    },
    enableBearerInterceptor: true,
    loadUserProfileAtStartUp: true,
    bearerExcludedUrls: ['/assets']
  }
};

参数说明：

onLoad 可选值为login-required' 和 'check-sso'，login-required将验证客户端，如果用户未登录则显示Keycloak登录页面；check-sso仅验证是否登录。如不需验证可以删除onLoad。
checkLoginIframe 是否启用login监控，若启用，默认间隔时间checkLoginIframeInterval为5秒
flow 可选值standard、implicit、hybrid，默认为standard

KeycloakBearerInterceptor

为HTTP请求添加bearer token。

import {Injectable} from '@angular/core';
import {HttpEvent, HttpHandler, HttpInterceptor, HttpRequest} from '@angular/common/http';
import {Observable} from 'rxjs';
import {KeycloakService} from './keycloak.service';
import {mergeMap} from 'rxjs/operators';
import {ExcludedUrlRegex} from './keycloak-options';

@Injectable()
export class KeycloakBearerInterceptor implements HttpInterceptor {
  constructor(private keycloakService: KeycloakService) {
  }

  intercept(req: HttpRequest, next: HttpHandler): Observable> {
    const {enableBearerInterceptor, excludedUrls} = this.keycloakService;
    if (!enableBearerInterceptor) {
      return next.handle(req);
    }

    const shallPass: boolean = excludedUrls.findIndex(item => this.isUrlExcluded(req, item)) > -1;
    if (shallPass) {
      return next.handle(req);
    }

    return this.keycloakService.addTokenToHeader(req.headers).pipe(
      mergeMap(headersWithBearer => {
        const kcReq = req.clone({headers: headersWithBearer});
        return next.handle(kcReq);
      })
    );
  }

  /**
   * Checks if the url is excluded from having the Bearer Authorization header added.
   *
   * @param req http request from @angular http module.
   * @param excludedUrlRegex contains the url pattern and the http methods,
   * excluded from adding the bearer at the Http Request.
   */
  private isUrlExcluded({method, url}: HttpRequest, {urlPattern, httpMethods}: ExcludedUrlRegex): boolean {
    const httpTest = httpMethods.length === 0 || httpMethods.join().indexOf(method.toUpperCase()) > -1;
    const urlTest = urlPattern.test(url);

    return httpTest && urlTest;
  }
}

CanActivateAuthGuard

import {Injectable} from '@angular/core';
import {ActivatedRouteSnapshot, CanActivate, Router, RouterStateSnapshot} from '@angular/router';
import {KeycloakService} from './keycloak.service';

@Injectable({providedIn: 'root'})
export class CanActivateAuthGuard implements CanActivate {

  constructor(private router: Router, private keycloakService: KeycloakService) {
  }

  canActivate(route: ActivatedRouteSnapshot, state: RouterStateSnapshot): Promise {
    return new Promise(async (resolve) => {
      const authenticated = await this.keycloakService.isLoggedIn();
      if (authenticated) {
        resolve(true);
      } else {
        this.keycloakService.login();
        resolve(false);
      }
    });
  }
}

初始化KeycloakService

为提高性能，在app.module.ts中初始化KeycloakService。

...
export function initKeycloak(keycloak: KeycloakService): () => Promise {
  return (): Promise => {
    return new Promise(async (resolve, reject) => {
      try {
        // @ts-ignore
        await keycloak.init(environment.keycloak);
        resolve();
      } catch (error) {
        reject(error);
      }
    });
  };
}
...

  providers: [
    [
      {provide: APP_INITIALIZER, useFactory: initKeycloak, deps: [KeycloakService], multi: true},
      {provide: HTTP_INTERCEPTORS, useClass: KeycloakBearerInterceptor, multi: true},
      ...
    ]
  ],
  ...

指定IDP

Angular与Keycloak集成完毕，启动服务后访问页面会自动跳转到Keycloak登录界面：
Spring Boot/Angular整合Keycloak实现单点登录
用户可以直接输入用户名/密码、可以选择IDP登录。
配置Keycloak IDP时可以控制是否在登录界面显示，认证流程中可以设置默认IDP，客户端调用时可以指定IDP，多种方式灵活组合可以满足不同需求。
指定IDP，Angular调用时仅需指定idpHint参数，其值为IDP的alias：

keycloakService.login({idpHint: 'adfs'});

附录

Apache配置

keycloak.conf

ServerTokens Prod
Header always set Strict-Transport-Security "max-age=8640000; includeSubDomains; preload"
Header always append X-Frame-Options SAMEORIGIN


    ServerName   sso.itrunner.org
    ServerAlias  sso.itrunner.org
    ErrorLog     logs/keycloak_error_log
    TransferLog  logs/keycloak_access_log
    LogLevel warn

    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA
    SSLCertificateFile /etc/pki/tls/certs/ca.crt
    SSLCertificateKeyFile /etc/pki/tls/private/ca.key

    RewriteEngine On
    RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} -f [OR]
    RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} -d
    RewriteRule ^ - [L]

    ProxyPreserveHost on
    ProxyPass /auth http://127.0.0.1:8080/auth timeout=600
    ProxyPa***everse /auth http://127.0.0.1:8080/auth

参考文档

Keycloak
AD FS Docs
Salesforce Identity Providers and Service Providers
A Quick Guide to Using Keycloak with Spring Boot
How to Setup MS AD FS 3.0 as Brokered Identity Provider in Keycloak

网站栏目：SpringBoot/Angular整合Keycloak实现单点登录
转载来源：http://cdkjz.cn/article/iisoge.html

返回首页了解更多建站资讯

多年建站经验

多一份参考，总有益处

联系快上网，免费获得专属《策划方案》及报价

咨询相关问题或预约面谈，可以通过以下方式与我们联系

大客户专线成都：13518219792 座机：028-86922220

在线咨询提交需求

友情链接交换友情链接

古巴雪茄成都未宇聚全网营销网站推广创新互联重庆一元广告瑞杰管理成都网站安全运维手机网站制作四川柴油发电机乐山电信机房

成都网站建设公司地址：成都市青羊区太升南路288号锦天国际A座10层建设咨询028-86922220

专家团队为您提供成都网站建设,成都网站设计,成都品牌网站设计,成都营销型网站制作等服务,成都建网站就找快上网！ | 成都网站建设哪家好？ | 网站建设地图

网络推广

Network promotion

网站方案

Solution

电商网站开发

E-commerce & System

我们

About Us

联系

Contact Us

精准传达 • 有效沟通

查看其它板块

SpringBoot/Angular整合Keycloak实现单点登录

Keycloak

安装

Realm

Client

Client Scope

Role、Group、User

Authentication

Identity Provider

ADFS

Salesforce

Spring Boot

POM Dependency

Keycloak配置

WebSecurityConfig

SpringBootApplication

SecurityContext

TestRestTemplate测试

MockMvc测试

Angular

package.json

KeycloakService

Keycloak配置

KeycloakBearerInterceptor

CanActivateAuthGuard

初始化KeycloakService

指定IDP

附录

Apache配置

参考文档

相关资讯

如何在Java中导入Oracle数据库

PHP如何将Redis封装为单例模式

如何使用todolist入门全局组件和局部组件

javascript与html之间有哪些区别

基于vue实现图片验证码倒计时60s功能的示例分析

Python中pyqt5如何设置窗体图标

C++中不要去做编译器的工作有哪些

微信小程序开发如何实现定位到当前城市的方法

多一份参考，总有益处

联系快上网，免费获得专属《策划方案》及报价

大客户专线 成都：13518219792 座机：028-86922220

友情链接 交换友情链接

大客户专线成都：13518219792 座机：028-86922220

友情链接交换友情链接