<div dir="ltr">We do not currently support scope param and this is something we plan to add in the future. We do have protocol mappers that you can use to add any additional claims to the token for a client.</div><div class="gmail_extra"><br><div class="gmail_quote">On 5 October 2015 at 21:49, Tomas Cerny <span dir="ltr"><<a href="mailto:tom.cerny@gmail.com" target="_blank">tom.cerny@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">Hi all,</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">I am trying to use the scope param with keycloak, which is part of the open id</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><a href="http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims" rel="nofollow" style="color:rgb(53,84,145);text-decoration:none;line-height:inherit;margin:0px;padding:0px calc(12px + 0.35ex) 0px 0px;border:0px;font-style:inherit;vertical-align:baseline" target="_blank"><font face="arial, helvetica, sans-serif">http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims</font></a></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">Here is an sample URL (from <a href="https://openid.net/specs/openid-connect-basic-1_0.html#AuthenticationRequest" rel="nofollow" style="color:rgb(53,84,145);text-decoration:none;line-height:inherit;margin:0px;padding:0px calc(12px + 0.35ex) 0px 0px;border:0px;font-style:inherit;vertical-align:baseline" target="_blank">https://openid.net/specs/openid-connect-basic-1_0.html#AuthenticationRequest</a> )</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">Which is</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif"><a href="https://server.example.com/authorize" rel="nofollow" style="color:rgb(53,84,145);text-decoration:none;line-height:inherit;margin:0px;padding:0px calc(12px + 0.35ex) 0px 0px;border:0px;font-style:inherit;vertical-align:baseline" target="_blank">https://server.example.com/authorize</a><span style="margin:0px;padding:0px;border:0px;font-style:inherit;vertical-align:baseline">?</span></font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif"> response_type=code</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif"> &client_id=s6BhdRkqt3</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif"> &redirect_uri=https%3A%2F%<a href="http://2Fclient.example.org" target="_blank">2Fclient.example.org</a>%2Fcb</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif"> &scope=openid%20profile</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif"> &state=af0ifjsldkj</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">note the state param there</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">with keycloak this is my auth URL: <span style="margin:0px;padding:0px;border:0px;font-style:inherit;vertical-align:baseline;color:rgb(34,34,34)"></span><a href="http://127.0.0.1:8080/auth/realms/example/protocol/openid-connect/auth?client_id=js-console&redirect_uri=http://127.0.0.1:8080/js-console/&state=4bb976a4-ad5f-4af5-955d-1b2bdfb738df&response_type=code" rel="nofollow" style="color:rgb(53,84,145);text-decoration:none;line-height:inherit;margin:0px;padding:0px calc(12px + 0.35ex) 0px 0px;border:0px;font-style:inherit;vertical-align:baseline" target="_blank">http://127.0.0.1:8080/auth/realms/example/protocol/openid-connect/auth?client_id=js-console&redirect_uri=http://127.0.0.1:8080/js-console/&state=4bb976a4-ad5f-4af5-955d-1b2bdfb738df&response_type=code</a></font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">When I pass scope param, then it is ignored.</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">Does keycloak support scope param? Can I intercept it to make a custom handler? (e.g. lookup DB data)</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">Sample Use Case: Keycloak has my custom UserFederation provides where I issue user lookup to my SQL DB, and determine access, next basing on the scope I like to post back to the app roles relevant to the scope param.</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">I know keycloak has static roles, but I need it contextual, such as - user is master in scope = A, but reader in scope = B. Since the range of scopes is dynamic and large, the use of client-ids is not sufficient.</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">I assume the scope can help me solving situation such as am I owned of an object?</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">I did days of debugging keycloak code and cannot find much even thought there is OAuth2Constants.Scope but may be that is something different?</font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">and I seem some dead sample here: <a href="https://source.jboss.org/changelog/Keycloak?cs=d309fab8251d95f50f94c77e4d08e6e8c2977994" rel="nofollow" style="color:rgb(53,84,145);text-decoration:none;line-height:inherit;margin:0px;padding:0px calc(12px + 0.35ex) 0px 0px;border:0px;font-style:inherit;vertical-align:baseline" target="_blank">FishEye: changeset d309fab8251d95f50f94c77e4d08e6e8c2977994</a></font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">The alternative OpenAM supports scope param it - <a href="http://openam.forgerock.org/" rel="nofollow" style="color:rgb(53,84,145);text-decoration:none;line-height:inherit;margin:0px;padding:0px calc(12px + 0.35ex) 0px 0px;border:0px;font-style:inherit;vertical-align:baseline" target="_blank">OpenAM Project - About OpenAM</a></font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61);min-height:8pt"><font face="arial, helvetica, sans-serif"> </font></p><p style="margin:0px;padding:0px;line-height:19.5px;border:0px;vertical-align:baseline;color:rgb(61,61,61)"><font face="arial, helvetica, sans-serif">Thanks, Tom</font></p></div><div><br></div><div>Here a forum public users.</div><div><a href="https://developer.jboss.org/message/934762#934762" target="_blank">https://developer.jboss.org/message/934762#934762</a><br></div></div>
<br>_______________________________________________<br>
keycloak-dev mailing list<br>
<a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br></blockquote></div><br></div>