<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>The code is the same as the AdminClient you pointed me to. However, I just try something based on what you said. In the admin-client oauth client, I went to Scope Mappings and added user role (which is the security role for the rest services). Now it works. Does this sound right to you? Seems magical...</div><br><div><div>On Jul 15, 2014, at 3:48 PM, Bill Burke <<a href="mailto:bburke@redhat.com">bburke@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Please elaborate on your code to obtain a token. Your client (not user) may not have the scope you need and the token may not be getting set with the desired role mappings.<br><br>On 7/15/2014 3:15 PM, Christina Lau wrote:<br><blockquote type="cite">Hi Bill, further to last comment, i.e. although I can get the token,<br>when I use it to call the same Rest service, I am getting 403 instead.<br><br>I don’t know if this helps or not, but I have also noticed that the<br>console produced different output:<br><br>*Using non-keycloak client (Did not work - get 403)*<br><br>15:05:28,228 INFO [org.keycloak.services.resources.TokenService]<br>(default task-1) no authorization header<br>15:05:28,345 INFO [org.keycloak.audit] (default task-1) event=LOGIN,<br>realmId=ab9527ff-1dbe-4ce1-934c-ee2e1057d8b7, clientId=admin-client,<br>userId=58cfb6e9-9ff8-45a8-98bb-3a26b341b783, ipAddress=127.0.0.1,<br><a href="mailto:username=roger@mailinator.com">username=roger@mailinator.com</a><span class="Apple-converted-space"> </span><<a href="mailto:username=roger@mailinator.com">mailto:username=roger@mailinator.com</a>>,<br>response_type=token, auth_method=oauth_credentials,<br>refresh_token_id=3730424f-a718-4be8-a9fc-a090e5932564,<br>token_id=dd1bfeaa-54b1-4824-a6fe-d14eb1ae6f97<br>15:05:28,547 INFO [org.keycloak.adapters.RequestAuthenticator] (default<br>task-2) --> authenticate()<br>15:05:28,548 INFO [org.keycloak.adapters.RequestAuthenticator] (default<br>task-2) try bearer<br>15:05:28,566 INFO<br> [org.keycloak.adapters.RefreshableKeycloakSecurityContext] (default<br>task-2) checking whether to refresh.<br>15:05:28,566 INFO<br> [org.keycloak.adapters.undertow.KeycloakUndertowAccount] (default<br>task-2) use realm role mappings<br>15:05:28,571 INFO<br> [org.keycloak.adapters.wildfly.WildflyRequestAuthenticator] (default<br>task-2) propagate security context to wildfly<br>15:05:28,571 INFO [org.keycloak.adapters.RequestAuthenticator] (default<br>task-2) Bearer AUTHENTICATED<br><br><br>*Using keycloak app (similar to customer-cli sample) Work*<br><br>15:06:30,254 INFO [org.keycloak.services.resources.TokenService]<br>(default task-1) createLogin() now...<br>15:06:39,965 INFO [org.keycloak.audit] (default task-2) event=LOGIN,<br>realmId=ab9527ff-1dbe-4ce1-934c-ee2e1057d8b7, clientId=hellokeycloak,<br>userId=58cfb6e9-9ff8-45a8-98bb-3a26b341b783, ipAddress=127.0.0.1,<br><a href="mailto:username=roger@mailinator.com">username=roger@mailinator.com</a><span class="Apple-converted-space"> </span><<a href="mailto:username=roger@mailinator.com">mailto:username=roger@mailinator.com</a>>,<br>response_type=code, redirect_uri=<a href="http://localhost:59999">http://localhost:59999</a>,<br>auth_method=form, code_id=bd10d4cc-9f99-42df-b984-b92093f5a6af1405451199946<br>15:06:39,966 INFO<br> [org.keycloak.services.managers.AuthenticationManager] (default<br>task-2) createLoginCookie<br>15:06:39,966 INFO<br> [org.keycloak.services.managers.AuthenticationManager] (default<br>task-2) createIdentityToken<br>15:06:40,092 INFO [org.keycloak.services.resources.TokenService]<br>(default task-3) no authorization header<br>15:06:40,119 INFO [org.keycloak.audit] (default task-3)<br>event=CODE_TO_TOKEN, realmId=ab9527ff-1dbe-4ce1-934c-ee2e1057d8b7,<br>clientId=hellokeycloak, userId=58cfb6e9-9ff8-45a8-98bb-3a26b341b783,<br>ipAddress=127.0.0.1,<br>refresh_token_id=476b2f86-3df4-4cf6-8d51-55aa70264346,<br>code_id=bd10d4cc-9f99-42df-b984-b92093f5a6af1405451199946,<br>token_id=be0358ab-2c28-4bdc-a95c-681b63095217<br>15:06:46,567 INFO [org.keycloak.adapters.RequestAuthenticator] (default<br>task-4) --> authenticate()<br>15:06:46,568 INFO [org.keycloak.adapters.RequestAuthenticator] (default<br>task-4) try bearer<br>15:06:46,584 INFO<br> [org.keycloak.adapters.RefreshableKeycloakSecurityContext] (default<br>task-4) checking whether to refresh.<br>15:06:46,584 INFO<br> [org.keycloak.adapters.undertow.KeycloakUndertowAccount] (default<br>task-4) use realm role mappings<br>15:06:46,589 INFO<br> [org.keycloak.adapters.wildfly.WildflyRequestAuthenticator] (default<br>task-4) propagate security context to wildfly<br>15:06:46,590 INFO [org.keycloak.adapters.RequestAuthenticator] (default<br>task-4) Bearer AUTHENTICATED<br><br></blockquote><br>--<span class="Apple-converted-space"> </span><br>Bill Burke<br>JBoss, a division of Red Hat<br><a href="http://bill.burkecentral.com/">http://bill.burkecentral.com</a></div></blockquote></div><br></body></html>