<div dir="ltr">It is defined under the application itself, so I it&#39;s under the scope. This should be working right?</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jul 29, 2014 at 11:59 AM, Bill Burke <span dir="ltr">&lt;<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">What kind of role is it?  Is the new role defined under the<br>
&quot;database-service&quot; application?  If not, then you must add this role to<br>
the &quot;database-service&quot;&#39;s scope in the admin console.<br>
<div class=""><br>
On 7/29/2014 10:51 AM, Rodrigo Sasaki wrote:<br>
&gt; Hi,<br>
&gt;<br>
&gt; I&#39;m trying to secure a bearer-only application with keycloak, to access<br>
&gt; it with access tokens, but I think I&#39;m missing something.<br>
&gt;<br>
&gt; I tried it with the database-service of the unconfigured demo.<br>
&gt;<br>
&gt; 1. I created the user role in the application.<br>
&gt; 2. I assigned that role to my user<br>
&gt; 3. I copied the contents of the installation json to<br>
</div>&gt; *webapp/META-INF/keycloak.json*<br>
<div class="">&gt;<br>
&gt; {<br>
&gt;      &quot;realm&quot;: &quot;demo&quot;,<br>
&gt;      &quot;realm-public-key&quot;:<br>
&gt; &quot;MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwRayjzh7W+EfPaeSdyXWLyXof7c3fwD7vb0AEtG+ogLHtMkYiTdX9y/JXOmXwWDzGhx7NM3Q6vkCG0F3lZqOVsSlYH56c5+Ev4QmSGK/+6e+WcZMcgmscoz1OoXKom4+pzqMey42hqdwwMhkvCq/jxJSmUGnZJQuqEKVH00NZ1wIDAQAB&quot;,<br>

&gt;      &quot;bearer-only&quot;: true,<br>
&gt;      &quot;ssl-not-required&quot;: true,<br>
&gt;      &quot;resource&quot;: &quot;database-service&quot;,<br>
&gt;      &quot;use-resource-role-mappings&quot;: true<br>
&gt; }<br>
&gt;<br>
</div>&gt; 4. Set the auth-method to *KEYCLOAK* on web.xml<br>
&gt; 5. Started the server deploying the *database-service*<br>
&gt; 6. Generated a token using *security-admin-console* client_id and my user<br>
&gt; 7. Submitted a GET request to /localhost:8080/database/customers/<br>
<div class="">&gt;<br>
&gt; After these steps I get a 403 error, saying that I&#39;m not authorized to<br>
&gt; access the resource, wasn&#39;t this supposed to work?<br>
&gt;<br>
&gt; --<br>
&gt; Rodrigo Sasaki<br>
&gt;<br>
&gt;<br>
</div>&gt; _______________________________________________<br>
&gt; keycloak-user mailing list<br>
&gt; <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
&gt; <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
&gt;<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><font face="Times New Roman">Rodrigo Sasaki</font><div></div></div>
</div>