<div dir="ltr">Hey Stian, thanks for the link, that's exactly what I was looking for!</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jan 29, 2014 at 5:53 PM, Stian Thorgersen <span dir="ltr"><<a href="mailto:stian@redhat.com" target="_blank">stian@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Have a look at:<br>
<br>
<a href="https://github.com/keycloak/keycloak/blob/master/testsuite/integration/src/test/java/org/keycloak/testsuite/OAuthClient.java#L146" target="_blank">https://github.com/keycloak/keycloak/blob/master/testsuite/integration/src/test/java/org/keycloak/testsuite/OAuthClient.java#L146</a><br>
<div class="HOEnZb"><div class="h5"><br>
----- Original Message -----<br>
> From: "Bill Burke" <<a href="mailto:bburke@redhat.com">bburke@redhat.com</a>><br>
> To: <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> Sent: Wednesday, 29 January, 2014 4:05:58 PM<br>
> Subject: Re: [keycloak-user] Verifying Bearer Tokens in Vert.x<br>
><br>
><br>
><br>
> On 1/29/2014 10:58 AM, Nils Preusker wrote:<br>
> > Hi everybody,<br>
> ><br>
> > we are developing an application that consists of several REST<br>
> > web-applications written with different application frameworks (Java EE<br>
> > 6/ JBoss AS and Vert.x). So far we are<br>
> > using org.jboss.resteasy.skeleton.key.as7.OAuthAuthenticationServerValve<br>
> > from the skelton-key-as7 template (which as far as I can see, keycloak<br>
> > is based on?) as an OAuth provider and just add bearer tokens to the<br>
> > authentication headers of the HTTP requests between the modules.<br>
> ><br>
> > One of the really nice features for us is that the role mapping of users<br>
> > is included in the tokens (which is also described in the keycloak docs<br>
> > with a reference to JSON Web Tokens).<br>
> ><br>
> > Now the modules that are deployed to JBoss AS transparently verify the<br>
> > bearer tokens and RESTEasy even takes care of adding the username and<br>
> > the user roles to the HttpServletRequest which also allows us to use<br>
> > @RolesAllowed (very convenient!).<br>
> ><br>
> > What I'm wondering now is whether there is an easy way of adding<br>
> > validation and decoding of bearer tokens to Vert.x modules. Ideally, I<br>
> > would like to be able to add a jar dependency that provides me with a<br>
> > few methods to validate the token (make sure it is a real token, hasn't<br>
> > been modified and didn't expire...) and extract the user and roles from<br>
> > it. Since a private key is needed, I guess I would add a json config<br>
> > file or even just pass the required values to the API directly.<br>
> ><br>
><br>
> Don't know anything about vert.x, but if you use the keycloak-core<br>
> module, it has all the code needed to unmarshal and verify the token.<br>
><br>
> --<br>
> Bill Burke<br>
> JBoss, a division of Red Hat<br>
> <a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</div></div></blockquote></div><br></div>