<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 27/03/16 20:38, Hristo Stoyanov
wrote:<br>
</div>
<blockquote
cite="mid:CAHiHDeTFQzBpsswx4mDV0ZS48xNx0Ghr-kaSFW3Qm5RKn+g3pw@mail.gmail.com"
type="cite">
<div dir="ltr">Hi all,<br>
I am trying to apply KC for:<br>
1. Authentication. So far KC works well and as expected!<br>
2. Change the authenticated user roles as part of the
application logic- based on external credit card registration
(by an external credit card processor) and paid plan selection
by the user, the web app need to move the authenticated user
from "free" role to "premium" realm role, which correspond to
the paid plan s/he selected.<br>
<br>
Is there an example of how to use KC APIs to change the user's
role from within the app? I could not find anything specific in
the examples or documentation, but I see some things that go in
that direction:
<div><br>
A. </div>
<div>It seems like I have to use the Admin REST API somehow, but
I am not sure which rest calls from the vast REST APIs I need
to use? Is it "Add realm-level role mappings to the user" and
"Delete realm-level role mappings"? What is "id" param then?
Is this the "user id"? Can you please categorize the REST APIs
in groups - "user management", "role CRUDs", etc., to make it
easier to navigate?<br>
There seems to be an example "admin-access-app", but it is
not clear where it gets the app username/password. Are they
just hard-coded "username" and "password"? In the case of
Wildfly adapter, the client secret is configured inside the
standalone.xml configuration file,<br>
so <u>I expect to not have to configure it or read it from
file configurations</u>, but the container should provide
it/inject it for me? Is this correct assumption? Any example
wildfly code?</div>
</div>
</blockquote>
As mentioned in other email, we have admin-client, which provides
calling of REST endpoints as java methods and we have also example
for it. <br>
<blockquote
cite="mid:CAHiHDeTFQzBpsswx4mDV0ZS48xNx0Ghr-kaSFW3Qm5RKn+g3pw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div><br>
B. </div>
<div>It seems like i also need to use a <a
moz-do-not-send="true"
href="http://blog.keycloak.org/2015/08/service-accounts-support-in-keycloak.html">service
account </a>, so that the app can change user roles behind
the scene on its own? Correct? <a moz-do-not-send="true"
href="http://blog.keycloak.org/2015/08/service-accounts-support-in-keycloak.html">This
blog post </a>seems obsolete as there is no more "Service
accounts enabled" switch I could find. I figured, one need
to switch to "confidential" access type instead. Is this
correct? Unfortunately, the corresponding example, "Service
Account Example" does not show how one should proceed when
the client secret is configured in the Wildfly's
standalone.xml file and the developer is not expected to
parse configuration files (either embedded in the WAR or
elsewhere). Any example of how to get configured objects? I
tried to get some clue from the <b>KeycloakDeploymentBuilderTest.java</b>
file, but it is not clear how one can get <b>KeycloakDeployment</b>
injected by the container rather than paring it from files.
Any clue?<br>
</div>
</div>
</div>
</blockquote>
Feel free to create JIRA for the service account documentation and
example update. But actually you don't need service account for call
admin REST endpoints (even the admin-client currently doesn't
support service accounts, which we should improve. See the other
mail I sent to you earlier today). You need to create admin user
account and call admin operations with admin client through this
account. It's using "Direct access grants" rather than service
accounts.<br>
<br>
Marek<br>
<blockquote
cite="mid:CAHiHDeTFQzBpsswx4mDV0ZS48xNx0Ghr-kaSFW3Qm5RKn+g3pw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div><br>
Thank you for the grate product! And thank you for any
guidance you can provide - that would save me a lot of time
and questions!<br>
</div>
</div>
<div><br>
</div>
<div>/Hristo</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>