<div dir="ltr">In JEE there's only Principal with a single getName. You can already map whatever you want to that.<div><br></div><div>We could maybe map properties from the token onto attributes in the request. </div></div><div class="gmail_extra"><br><div class="gmail_quote">On 30 October 2015 at 18:34, Christian Hebert <span dir="ltr"><<a href="mailto:christian_hebert@hotmail.com" target="_blank">christian_hebert@hotmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div dir="ltr"><div>How about wrapping <span style="font-size:12pt">your application under a filter (or a valve in JBoss or Tomcat) ? From there you could populate your authenticated subject (or the session?) with whatever information your keycloak token could provide.</span></div><div><span style="font-size:12pt"><br></span></div><div><span style="font-size:12pt">Would that be a good idea ?</span></div><div><span style="font-size:12pt"><br></span></div><div><hr>Date: Wed, 28 Oct 2015 05:01:17 -0700<br>From: <a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a><br>To: <a href="mailto:tdudgeon.ml@gmail.com" target="_blank">tdudgeon.ml@gmail.com</a><br>CC: <a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>Subject: Re: [keycloak-user] Accessing authenticated user's details<div><div class="h5"><br><br><div dir="ltr">Yes, JavaEE currently has no standard way of obtaining a user profile.</div><div><br><div>On 28 October 2015 at 04:17, Tim Dudgeon <span dir="ltr"><<a href="mailto:tdudgeon.ml@gmail.com" target="_blank">tdudgeon.ml@gmail.com</a>></span> wrote:<br><blockquote style="border-left:1px #ccc solid;padding-left:1ex">
<div>
So if I understand correctly the only way to handle multiple
attributes of the user (e.g name and email) is to use the Keycloak
IDToken approach and so be dependent on the Keycloak implementation
(or create my own API that wraps this)?<span><font color="#888888"><br>
<br>
Tim <br></font></span><div><div>
<br>
<div>On 26/10/2015 09:24, Marek Posolda
wrote:<br>
</div>
<blockquote>
<div>If you don't want Keycloak
dependencies, you can use request.getRemoteUser() or
request.getPrincipal().getName() to access just the userId of
authenticated user. If you use "principal-attribute" in
keycloak.json, it will return the configured attribute instead
of userId, so you can receive for example username or email
instead. But that way, you will be able to access just this
single attribute.<br>
<br>
Marek<br>
<br>
On 26/10/15 09:52, Tim Dudgeon wrote:<br>
</div>
<blockquote>
Wondered if anyone had any thoughts on this?<br>
<br>
<div>On 21/10/2015 12:04, Tim Dudgeon
wrote:<br>
</div>
<blockquote>
In the case of a web application (e.g. Tomcat app secured by
the keycloak adapter) the web app might need to access details
of the authenticated user (e.g. full name or email).<br>
I've found that this information is available from the session
like this: <br>
<br>
<small><tt>KeycloakSecurityContext session =
(KeycloakSecurityContext)request.getAttribute(KeycloakSecurityContext.class.getName());</tt><tt><br>
</tt><tt>IDToken idToken = session.getIdToken();</tt><tt><br>
</tt><tt>String email = idToken.getEmail();</tt></small><br>
<br>
One issue with this is that all your web apps are tied to
keycloak.<br>
<br>
Is this the right way to handle this?<br>
Are there alternatives?<br>
<br>
Tim<br>
<br>
</blockquote>
<br>
<br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
keycloak-user mailing list
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</blockquote>
<br>
</div></div></div>
<br>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>
<br>_______________________________________________
keycloak-user mailing list
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></div></div></div> </div></div>
</blockquote></div><br></div>