[keycloak-user] Requires uma_protection scope

[Julien Deruere]

This is all I see

{
  "jti": "6cfa6dd3-a3dd-4f5b-8560-f91832e7a35f",
  "exp": 1542811409,
  "nbf": 0,
  "iat": 1542811109,
  "iss": "http://my-keycloak:8080/auth/realms/my-realm",
  "sub": "055a376e-d8eb-49cf-9d5f-a83226448131",
  "typ": "Bearer",
  "azp": "my-api-gateway",
  "auth_time": 0,
  "session_state": "10853e1d-ff27-4f4c-b9e1-31339774c5e4",
  "acr": "1",
  "scope": "profile email",
  "clientId": "my-api-gateway",
  "clientHost": "172.19.0.1",
  "email_verified": false,
  "preferred_username": "service-account-my-api-gateway",
  "clientAddress": "172.19.0.1",
  "email": "service-account-my-api-gateway at placeholder.org"
}

Le mer. 21 nov. 2018 à 05:57, Pedro Igor Silva <psilva at redhat.com> a écrit :

> Yes, you should see a claim like this:
>
> "resource_access": {
>     "{client_id}": {
>       "roles": [
>         "{client_role}"
>       ]
>     }
>   }
>
> On Tue, Nov 20, 2018 at 5:22 PM Geoffrey Cleaves <geoff at opticks.io> wrote:
>
>> I understand that the client is supposed to have the role given the Admin
>> Console settings, but does the token show that role when you introspect it?
>>
>> On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com
>> wrote:
>>
>>> That's exactly what I did/checked. That's why I can't figure out why it's
>>> not working :(
>>>
>>> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a
>>> écrit :
>>>
>>> > This role should be a client role. For instance, if you are trying to
>>> > create resources for C1 the service account must be granted with client
>>> > role C1/uma-protection. See screenshot attached.
>>> >
>>> > Regards.
>>> >
>>> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <
>>> deruere.julien at gmail.com>
>>> > wrote:
>>> >
>>> >> In this case I'm using protection API:
>>> >>
>>> >> curl -X POST \
>>> >>     -H "Content-Type: application/x-www-form-urlencoded" \
>>> >>     -d
>>> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
>>> \
>>> >>     "
>>> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
>>> "
>>> >>
>>> >>
>>> >> I'm asking a token as a client, not as a user. And I checked, my
>>> client
>>> >> has the uma_protection role in Service Account Role.
>>> >>
>>> >> I don't know where I'm wrong?
>>> >>
>>> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a
>>> >> écrit :
>>> >>
>>> >>> Hi,
>>> >>>
>>> >>> You need to grant uma_protection client scope (it should be
>>> available as
>>> >>> one of the roles associated with your resource server) to the user
>>> to which
>>> >>> you are issuing tokens for.
>>> >>>
>>> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
>>> deruere.julien at gmail.com>
>>> >>> wrote:
>>> >>>
>>> >>>> Any update on this?
>>> >>>> I got the exact same message when using POSTMAN :
>>> >>>>
>>> >>>> I fist do this (with grant_type=client_credentials):
>>> >>>>
>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>> >>>>
>>> >>>> And then this with the token I received:
>>> >>>> GET
>>> >>>>
>>> >>>>
>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>> >>>> Which answer me this:
>>> >>>> {
>>> >>>>     "error": "invalid_scope",
>>> >>>>     "error_description": "Requires uma_protection scope."
>>> >>>> }
>>> >>>>
>>> >>> _______________________________________________
>>> >>>> keycloak-user mailing list
>>> >>>> keycloak-user at lists.jboss.org
>>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> >>>>
>>> >>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>