0

I have keycloak on docker (v20.0.2) and as you know some versions change some or good part of the UI, so is hard to follow tutorials around the web...

I am trying to follow this particular tuto

https://developers.redhat.com/blog/2020/11/24/authentication-and-authorization-using-the-keycloak-rest-api#keycloak_sso_demo

that seems the more updated. My keycloak is actually behind traeffic and thomseddon/traeffic-fordward-auth with a docker-compose file (but the connection through traeffic is good and I have acces to admin UI)

So on step 10 of the tutorial things change for me, I have to look for that particular view inside:

  • Click on lateral menu Client Scope
  • Click on button Create client scope
  • Give a name to the scope, and click on Tab Mapper
  • All mappers are predefined... so there is no "New mapper" don't understand this bit
  • then just follow the tuto

With that series of steps I get an error when retriving the token...

https://keycloak:8443/realms/education/protocol/openid-connect/token

enter image description here

(this are fake local data from the realm I created for testing)

that responds with a or something similar I have also tried to change the grant_type to password, and the same happens can not query the token....

{
    "error": "invalid_client",
    "error_description": "Invalid client or Invalid client credentials"
}

But if I do not link a user with an scope/role as in the tuto suggest then I get the token, but of course I want to use the role or scope to limit who can see which endpoint and who can not

Any step that I'm missing from this update, do you have the same error? Thank you in advance

I have tried to run it with different combinations of options to see if there is a toggle that actually allows me to fetch the token

Also with different types of grant_type

I will build an API in Python (I don't know Java and prefer Json instead of XML) that connect to this keycloak to allow users or not based on their scope/role/permission or something

I need to be able to block user so if user Student try to access an url from another Student he get blocked that url. So is based on the role or scope or I don't know which is prefered or easer to accomplish, the mission is to block users or not based on a factor that could be used for this in keycloak.

Luis Tena
  • 1
  • 2

0 Answers0