<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On 8 March 2016 at 15:00, John Dennis <span dir="ltr"><<a href="mailto:jdennis@redhat.com" target="_blank">jdennis@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 03/08/2016 12:51 AM, Stian Thorgersen wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Client registration service can only be invoked by a user from the realm<br>
you are creating a client in, so users in the master realm can only<br>
create clients in the master realm.<br>
<br>
IMO you should use the client registration services, supported initial<br>
access tokens and leave realm creation to another process. Creating a<br>
realm is part of installing the Keycloak server, not installing the client.<br>
</blockquote>
<br></span>
I'm not asking about realm creation. Rather I'm following up on your suggestion from a couple of days ago where you said instead of using an an initial access token:<br>
<br>
> You can also invoke it with the same access token (<a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/client-registration.html#d4e1458" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/client-registration.html#d4e1458</a>)<br>
<br>
This why I referenced Chapter 9.1.1 where it says a bearer token can be used to register the client. So my question is how does one do that?<br>
<br>
Here are the reasons why I'm pursuing this approach:<br>
<br>
* A process which creates a client in a realm should only have privileges in the realm, anything that requires super admin privileges on the master realm compromises the security of other realms hosted on the Keycloak instance (principle of least privilege).<br>
<br>
* Initial access tokens make automated provisioning difficult. But more to the point far as I can tell using an initial access token still requires super admin privileges at some point in the process. Either a super admin (human) has to logon to the web UI and copy the initial access token into a file for later use (and possibly exposing) or a process with super admin privileges has to create an initial access token via the REST interface.<br>
<br>
Remember the goal here is automated stand-alone provisioning (e.g. via ansible or puppet) of realm specific clients *without* super admin privileges that could compromise other realms (principle of least privilege). This suggests there should be a realm specific admin who can register a client (this is the fundamental question at hand).<br>
<br>
Thus what I was trying to resolve was how to have a realm specific admin who can only administer the realm. Initially I tried to create a user in the realm and grant them the necessary administration roles but I was unable to get a bearer token for that user using the realm token endpoint and passing their credentials. Then I went back re-read the documentation on administration privileges (cited below) which states realm administrators must be users in the master realm hence a realm administrator cannot use their bearer token to register a client because cross realm tokens are prohibited.<br>
<br>
Does this now make more sense?<br></blockquote><div><br></div><div>Yep, I wrongly made the assumption that you wanted to use the same token to create a realm and to create the client.</div><div><br></div><div>We need to figure out a way to provision initial access tokens or another way to permit usage of client registration services, as using a user or service account for it doesn't make to much sense.</div><div><br></div><div>In the mean time I'd use a service account rather than a regular user. Then use the client credentials grant to obtain the token. The service account only needs a role mapping on the create-client role from the realm-management client. That way it'll only be able to create clients for a specific realm and nothing else.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
<br>
On 8 March 2016 at 01:14, John Dennis <<a href="mailto:jdennis@redhat.com" target="_blank">jdennis@redhat.com</a><br></span><div><div class="h5">
<mailto:<a href="mailto:jdennis@redhat.com" target="_blank">jdennis@redhat.com</a>>> wrote:<br>
<br>
Chapter 9.1.1 of the Keycloak Reference Guide<br>
(<a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/index.html" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/index.html</a>)<br>
says that a bearer token can be used to register a client provided the<br>
user has the create-client or manage-client role on the realm.<br>
<br>
Chapter 6 discusses how to create a user in the master realm who can<br>
administer a specific realm. I followed those instructions and created<br>
a user and assigned them the create-client role in the desired realm.<br>
<br>
I then obtained a token for that user by posting to<br>
auth/realms/master/protocol/openid-connect/token with the username and<br>
password for the realm administrator I created along with the<br>
client-id of "admin-cli" (not sure if this is the right client id for<br>
this purpose, can someone explain selecting the proper client id?).<br>
<br>
I received back a token and then used this as an authorization bearer<br>
token when POSTing to the<br>
auth/realms/{realm}/clients/saml2-entity-descriptor to create a SAML<br>
SP client in the realm. However this fails with an 403 Forbidden<br>
response and the message "Invalid signature".<br>
<br>
This error seems to be generated by the ClientRegistrationTokenUtils<br>
class in the method parseToken() which is called in the init() method<br>
of the ClientRegistrationAuth class. As far as I can tell the<br>
parseToken() method is using the public key for the realm. But the<br>
token is not from the realm, the token is from the master realm where<br>
the realm's admin is located.<br>
<br>
For the bearer token to work when registering a client it would seem<br>
the token would have belong to a user in the realm, not the master<br>
realm as discussed in Chapter 6.<br>
<br>
How is client creation supposed to work with a bearer token instead of<br>
using an initial access token?<br>
<br>
--<br>
John<br>
_______________________________________________<br>
keycloak-dev mailing list<br></div></div>
<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a>><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
<br>
<br><span class="HOEnZb"><font color="#888888">
</font></span></blockquote><span class="HOEnZb"><font color="#888888">
<br>
<br>
-- <br>
John<br>
</font></span></blockquote></div><br></div></div>