<p dir="ltr"><br>
Thanks Bill, much appreciated. Is there something I can do in the interim even if it is a hack?. I was looking at adapter code or even something I can hardcode in the rest service to pull out the user information and make the call to the back end application?</p>
<p dir="ltr">Thanks<br>
Sam</p>
<div class="gmail_quote">On Sep 5, 2014 1:19 PM, "Bill Burke" <<a href="mailto:bburke@redhat.com">bburke@redhat.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">A pure servlet filter is on the roadmap, but it wouldn't be as seemlessly integrated. I'll take a look at your problem.<br>
<br>
On 9/5/2014 11:59 AM, Red Samh wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Eap 6.x, it would be nice if i could generalize to any war deployed to<br>
to tomcat or jetty.<br>
<br>
Thanks<br>
Sam<br>
<br>
On Sep 5, 2014 11:51 AM, "Bill Burke" <<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a><br>
<mailto:<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>>> wrote:<br>
<br>
Wildfly or JBoss EAP 6.x or JBoss AS 7.1?<br>
<br>
<br>
On 9/5/2014 11:49 AM, Red Samh wrote:<br>
<br>
Bill,<br>
<br>
Thanks for the reply.<br>
<br>
Yes it works when I have to call REST to another REST service<br>
and any<br>
number of hops. The problem is calling a full fledged<br>
application from<br>
a REST service that I have the issue. When it is an application<br>
that is<br>
both Web App + REST and I add the authorization header (bearer)<br>
I get an<br>
unauthorized 401 (blackbox in the attachment).<br>
<br>
Thanks<br>
Sam<br>
<br>
<br>
On Fri, Sep 5, 2014 at 11:42 AM, Bill Burke <<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a><br>
<mailto:<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>><br>
<mailto:<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a> <mailto:<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>>>> wrote:<br>
<br>
Should work. You'll have to actually describe what your<br>
problem is or I<br>
can't help you. I'll take a guess though:<br>
<br>
Keycloak doesn't propagate the Authorization bearer token<br>
header<br>
automatically when you have multiple REST "hops" between<br>
multiple<br>
servers You'll have to obtain the access token and set up<br>
the HTTP<br>
header manually. The demo customer-portal example in the<br>
distro does<br>
exactly this, so take a look at that for more details.<br>
<br>
On 9/5/2014 10:58 AM, Red Samh wrote:<br>
> Hello,<br>
><br>
> We have an application that is protected using Keycloak<br>
and a<br>
user can<br>
> access this application through a web front. After login<br>
the user can<br>
> use the functionality of the application. The<br>
application is also<br>
> exposed through REST API's and is protected via keycloak<br>
as part<br>
of the<br>
> application and accessible only after login into the main<br>
application.<br>
><br>
> We have a<br>
><br>
> (Step 1) Javascript application (retrieving data from) -><br>
><br>
> (Step 2) Business Application exposed as REST API (REST<br>
API has<br>
to make<br>
> calls to backend Application mentioned above) -><br>
><br>
> (Step 3) BackEnd Application Server + REST API.<br>
><br>
> Directly accessing the BackEnd Application Server works<br>
fine but<br>
when we<br>
> need to call the REST API from another REST service which is<br>
> authenticated via Keycloak we have issues.<br>
><br>
> We used the existing sample to try and do a POC but not<br>
sure what<br>
is the<br>
> best approach to solve this issue. The part from (Step<br>
1) to (Step 2)<br>
> works and the REST API is protected using BEARER token.<br>
The (Step<br>
2) to<br>
> (Step 3) is a problem as in (Step 2) we only have the BEARER<br>
token and<br>
> the BackEnd Application is protected using the full keycloak<br>
> configuration. So The BackEnd Application service is not<br>
authenticating<br>
> by sending in only the BEARER token in the header which<br>
is a full<br>
> keycloak installation (work as only a web service).<br>
><br>
> Thanks<br>
> Sam<br>
><br>
><br>
> ______________________________<u></u>___________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<mailto:<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.<u></u>jboss.org</a>><br>
<mailto:<a href="mailto:keycloak-user@lists." target="_blank">keycloak-user@lists.</a>__<a href="http://jboss.org" target="_blank"><u></u>jboss.org</a><br>
<mailto:<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.<u></u>jboss.org</a>>><br>
> <a href="https://lists.jboss.org/__mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/__<u></u>mailman/listinfo/keycloak-user</a><br>
<<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/<u></u>mailman/listinfo/keycloak-user</a><u></u>><br>
><br>
<br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
______________________________<u></u>___________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<mailto:<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.<u></u>jboss.org</a>><br>
<mailto:<a href="mailto:keycloak-user@lists." target="_blank">keycloak-user@lists.</a>__<a href="http://jboss.org" target="_blank"><u></u>jboss.org</a><br>
<mailto:<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.<u></u>jboss.org</a>>><br>
<a href="https://lists.jboss.org/__mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/__<u></u>mailman/listinfo/keycloak-user</a><br>
<<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/<u></u>mailman/listinfo/keycloak-user</a><u></u>><br>
<br>
<br>
<br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
<br>
</blockquote>
<br>
-- <br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
</blockquote></div>