4

At my company, we need to extract the roles of the logged in user from the REST API that Keycloak provides. We have looked through the Keycloak documentation but can't find the answers we are looking for. Let me explain the flow we want to implement: A user logs in to a client defined in Keycloak and receives a JWT which is stored in the applications web client. The user is not an admin in Keycloak. When the web client makes a request to the backend server, the backend server queries Keycloak for the user's roles. And, this is the point where we have trouble. We can't figure out the correct URL for the REST API or which token to add to the authentication header. To summarize: we need help with the URL which is needed to query for user roles and what token to send to authorize against the API. I'm aware that the roles can be retrieved from the JWT, but we are afraid that the payload will become to big over time. A user may have multiple roles in different departments.

Pål
  • 81
  • 2

1 Answers1

2

The roles should be in the JWT payload, this should be configured in the keycloak service. The flow should be something like this:

  1. User is authenticated by the front end and the JWT token returned by keycloak is stored
  2. The front end hits the back end including the token in the request header
  3. The back end takes the token, validates it using the public key (the public key is provided by keycloak), if the token is valid, the roles are taken from the token payload and the authorization process is executed
Gilberto J Requena
  • 91
  • 5
  • 3
    Thank you for your answer. I understand that the flow you describes is the "normal" one. In our case, a user may have many roles (the user can have multiple roles in different departments), and we are afraid that over time this may lead to a too big payload in the JWT. That is the reason we want to extract the roles from the keycloak server. – Pål Mar 18 '19 at 10:13
  • 1
    Oh I see, then I suggest you to have a look on this https://www.keycloak.org/docs/latest/authorization_services/index.html#_resource_server_enable_authorization, I have never used it, but looks like it is what you are looking for. – Gilberto J Requena Mar 18 '19 at 16:47