<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">So in your example, the AngularJS app would be a Keycloak public client. It’s able to do interactive authentication with a user and Keycloak.<div class=""><br class=""></div><div class="">With the Keycloak Java adapters, your app should be a confidential client letting the adapter handle the Authorization Code Flow. You can introspect the claims by getting an instance of the KeycloakSecurityContext and calling getIdToken() or getToken() - returns the access token - and using the getters on those tokens to read claims.</div><div class=""><div class=""><br class=""></div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Scott Rossillo</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Smartling | Senior Software Engineer</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:srossillo@smartling.com" class="">srossillo@smartling.com</a></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
</div>
</div></div><br class=""><div><blockquote type="cite" class=""><div class="">On Jul 30, 2016, at 10:28 AM, <a href="mailto:Mohan.Radhakrishnan@cognizant.com" class="">Mohan.Radhakrishnan@cognizant.com</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; direction: ltr; font-family: Tahoma; font-size: 10pt;" class="">Earlier we weren't using sessions because our application on Azure had to scale out. So all the requests had to contain an access token so that which node handles those was immaterial. But stateful ecommerce sites may not work with this approach. I think that is what you mean. But this is Rest with sessions ? We had GUID generators to identify the user which was part of the claim.<div class=""><br class=""></div><div class="">I used the Implicit flow with an access token issued with an ID token. The client was AngularJS. What is the equivalent configuration for this ?<br class=""><div class=""><br class=""></div><div class="">Now I use this. The response type should be access token ? But that type is not accepted. So I am doing something wrong.</div><div class=""><br class=""></div><div class=""><a href="http://localhost:8080/auth/realms/Pearson/protocol/openid-connect/auth?response_type=id_token&redirect_uri=http://localhost:8000/keycloak/claim/&realm=Pearson&client_id=Pearson&scope=user" class="">http://localhost:8080/auth/realms/Pearson/protocol/openid-connect/auth?response_type=id_token&redirect_uri=http://localhost:8000/keycloak/claim/&realm=Pearson&client_id=Pearson&scope=user</a></div><div class=""><br class=""></div><div class="">Moreover the filter validates by contacting the server but I need to introspect and get the claims for the business process.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Mohan<br class=""><div style="font-family: 'Times New Roman'; font-size: 16px;" class=""><hr tabindex="-1" class=""><div id="divRpF592043" style="direction: ltr;" class=""><font face="Tahoma" size="2" class=""><b class="">From:</b><span class="Apple-converted-space"> </span>Scott Rossillo [<a href="mailto:srossillo@smartling.com" class="">srossillo@smartling.com</a>]<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Saturday, July 30, 2016 2:27 AM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Radhakrishnan, Mohan (Cognizant)<br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:keycloak-user@lists.jboss.org" class="">keycloak-user@lists.jboss.org</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [keycloak-user] OIDCFilterSessionStore<br class=""></font><br class=""></div><div class=""></div><div class="">For your first question, with OIDC there are three types of clients: confidential, public and bearer-only. For simplicity, let’s consider confidential, public as applications that you log into, for example, an e-commerce website. These applications have a session which stores the access token, ID token, and refresh token. When a request comes into the website the application, the session ID is used to establish who you are. This could mean making your OIDC tokens accessible to server side code.<div class=""><br class=""></div><div class="">A bearer-only application does not use sessions. It expects the OIDC access token to be sent in the authorization HTTP header on every request. It is a stateless application. Continuing your example, let’s say your e-commerce website needs to call a service that provides up to date inventory information when a user adds an item to cart. This can be a stateless service but wants to know what user is requesting inventory. The e-commerce website could retrieve the access token from the session and query the bearer-only application.</div><div class=""><br class=""></div><div class="">This is just one example, and a bit of an oversimplification of the things a confidential and public client can do. However, the point I’m trying to make is that by defining a client as bearer-only you are essentially saying it’s a stateless service that requires an OIDC access token on every request.</div><div class=""><div class=""><div class=""><br class=""><div class=""><div class="" style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; word-wrap: break-word;"><div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;">Scott Rossillo</div><div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;">Smartling | Senior Software Engineer</div><div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;"><a href="x-msg://4/redir.aspx?REF=j6dPT32YTAtd3OSXUceWIesC4Z0rWEwRl4cn2OAlq5GtXKWOgbjTCAFtYWlsdG86c3Jvc3NpbGxvQHNtYXJ0bGluZy5jb20." class="" target="_blank">srossillo@smartling.com</a></div><div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;"></div></div></div><br class=""><div class=""><blockquote type="cite" class=""><div class="">On Jul 29, 2016, at 9:18 AM,<span class="Apple-converted-space"> </span><a href="x-msg://4/redir.aspx?REF=-W95hPM06aEOGa4PPERHiMKHbaBCpuH6Gz8eh78BrhUQvqeOgbjTCAFtYWlsdG86TW9oYW4uUmFkaGFrcmlzaG5hbkBjb2duaXphbnQuY29t" class="" target="_blank">Mohan.Radhakrishnan@cognizant.com</a><span class="Apple-converted-space"> </span>wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;"><div class="" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Hi,</div><div class="" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> I have some doubts. I am using spring boot. The servlet filter adapter actually uses sessions. Is that right ? I was thinking the token will be required for every Rest endpoint access. But unless I clear jsessionid it is not required. Have I understood this correctly ?</div><div class="" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> </div><div class="" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">How do I get the claims from my implicit token ? Do I need the spring boot adapter ? Can I see an example combining implicit token and boot adapter ?</div><div class="" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> </div><div class="" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks,</div><div class="" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Mohan</div></div><span class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; float: none; display: inline !important;">This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored. _______________________________________________</span><br class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;"><span class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; float: none; display: inline !important;">keycloak-user mailing list</span><br class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;"><a href="x-msg://4/redir.aspx?REF=xgJMBDOPiq-hT1VvSfc8rzmjnTzdMdM4kXz3U-Ezg_8QvqeOgbjTCAFtYWlsdG86a2V5Y2xvYWstdXNlckBsaXN0cy5qYm9zcy5vcmc." class="" target="_blank" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;">keycloak-user@lists.jboss.org</a><br class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;"><a href="x-msg://4/redir.aspx?REF=Xdevq_aDvjYGmmY07NtoNVPhlBs9rx9A1gFtEibGMwQQvqeOgbjTCAFodHRwczovL2xpc3RzLmpib3NzLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2tleWNsb2FrLXVzZXI." class="" target="_blank" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></div></blockquote></div><br class=""></div></div></div></div></div></div></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.</span></div></blockquote></div><br class=""></div></div></body></html>