<div dir="ltr">Bill,<div><br></div><div>Thanks for the reply.</div><div><br></div><div>Yes it works when I have to call REST to another REST service and any number of hops. The problem is calling a full fledged application from a REST service that I have the issue. When it is an application that is both Web App + REST and I add the authorization header (bearer) I get an unauthorized 401 (blackbox in the attachment).</div><div><br></div><div>Thanks</div><div>Sam</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Sep 5, 2014 at 11:42 AM, Bill Burke <span dir="ltr"><<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Should work. You'll have to actually describe what your problem is or I<br>
can't help you. I'll take a guess though:<br>
<br>
Keycloak doesn't propagate the Authorization bearer token header<br>
automatically when you have multiple REST "hops" between multiple<br>
servers You'll have to obtain the access token and set up the HTTP<br>
header manually. The demo customer-portal example in the distro does<br>
exactly this, so take a look at that for more details.<br>
<div><div class="h5"><br>
On 9/5/2014 10:58 AM, Red Samh wrote:<br>
> Hello,<br>
><br>
> We have an application that is protected using Keycloak and a user can<br>
> access this application through a web front. After login the user can<br>
> use the functionality of the application. The application is also<br>
> exposed through REST API's and is protected via keycloak as part of the<br>
> application and accessible only after login into the main application.<br>
><br>
> We have a<br>
><br>
> (Step 1) Javascript application (retrieving data from) -><br>
><br>
> (Step 2) Business Application exposed as REST API (REST API has to make<br>
> calls to backend Application mentioned above) -><br>
><br>
> (Step 3) BackEnd Application Server + REST API.<br>
><br>
> Directly accessing the BackEnd Application Server works fine but when we<br>
> need to call the REST API from another REST service which is<br>
> authenticated via Keycloak we have issues.<br>
><br>
> We used the existing sample to try and do a POC but not sure what is the<br>
> best approach to solve this issue. The part from (Step 1) to (Step 2)<br>
> works and the REST API is protected using BEARER token. The (Step 2) to<br>
> (Step 3) is a problem as in (Step 2) we only have the BEARER token and<br>
> the BackEnd Application is protected using the full keycloak<br>
> configuration. So The BackEnd Application service is not authenticating<br>
> by sending in only the BEARER token in the header which is a full<br>
> keycloak installation (work as only a web service).<br>
><br>
> Thanks<br>
> Sam<br>
><br>
><br>
</div></div>> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</font></span></blockquote></div><br></div>