<div dir="ltr"><div><div><div>Keycloak A is the idp using oidc</div></div><div>"testuser" and "testrole" are defined in Keycloak A.</div></div><div><br></div><div><br></div>Keycloak B is the broker, it has Keycloak A as identity provider<div>App B authenticates using the broker, choosing Keycloak A as the provider</div><div><br></div><div>I want Keycloak B to receive (from Keycloak A) a calaim saying something like "roles": "testuser" </div><div><br><div><br><div><br></div><div><br><div><br></div></div><div><br></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-09-30 11:26 GMT-03:00 Bill Burke <span dir="ltr"><<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I am confused on what you want to do. Please talk in terms of Keycloak<br>
A, Keycloak B, App C, App D.<br>
<div><div class="h5"><br>
On 9/30/2015 9:23 AM, Gonzalo López wrote:<br>
> testuser has some roles in host B (testrole in this example), I want to<br>
> put the roles as a claim in the token so when host A receives the token<br>
> it maps the claim to roles in host A<br>
><br>
> I already did the second part (mapping in host A), but I still can't<br>
> find out how to put the roles in a claim.<br>
><br>
><br>
><br>
><br>
><br>
><br>
> On 9/29/2015 3:42 PM, Gonzalo L?pez wrote:<br>
> > I'm trying to test the Identity broker to achieve cross domain<br>
> sso, this<br>
> > is what I have done:<br>
> ><br>
> > 1 - Installed jboss 6.4 eap + keycloak + keycloak eap6 adapter in<br>
> host A<br>
> > 2 - Installed jboss 6.4 eap + keycloak in host B<br>
> > 3 - In host A, I added an oidc Identity Provider (importing host B<br>
> > openid connect configuration).<br>
> > 4 - In host A, I created an application (appa.war) that will try<br>
> to use<br>
> > the broker to authenticate. I added security to the app (only<br>
> user with<br>
> > role "user" will be able to access some parts)<br>
> > 5 - In host B, I added 2 oidc clients (the broker from host A and<br>
> appb,<br>
> > appb (appb.war) is a simple application developed to log in using<br>
> oidc)<br>
> > 6 - In host B, I created a role "testrole" inside appb and a user<br>
> > "testuser", then I added that role to the user.<br>
> ><br>
> > I couldn't find out how to map the role "testrole" to a claim<br>
> that will<br>
> > be sent to the broker once the user has authenticated. Is there a<br>
> way to<br>
> > do that?<br>
> ><br>
> > After I accomplish that I plan to map that claim to the role<br>
> appa.user.<br>
> ><br>
><br>
> OIDC and SAML Identity Providers have mappers. Host A broker will<br>
> receive the token from Host B. You can map the testrole to whatever<br>
> claim you want.<br>
><br>
><br>
> --<br>
> Bill Burke<br>
> JBoss, a division of Red Hat<br>
> <a href="http://bill.burkecentral.com" rel="noreferrer" target="_blank">http://bill.burkecentral.com</a><br>
><br>
><br>
><br>
><br>
</div></div>> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
<span class="">><br>
<br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" rel="noreferrer" target="_blank">http://bill.burkecentral.com</a><br>
</span>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</blockquote></div><br></div>