<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">It is working as you describe. I can either get access or ID token.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">In either case - </span>response_type=id_token and response_type=id_token%20token – the method call is the same.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas">
</span><span style="font-size:10.0pt;font-family:Consolas;color:#6A3E3E">KeycloakPrincipal</span><span style="font-size:10.0pt;font-family:Consolas">.getKeycloakSecurityContext().getToken().</span><span style="font-size:10.0pt;font-family:Consolas;color:windowtext"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas"> getRealmAccess().getRoles().stream().forEach(
</span><span style="font-size:10.0pt;font-family:Consolas;color:#6A3E3E">f</span><span style="font-size:10.0pt;font-family:Consolas"> -> System.</span><b><i><span style="font-size:10.0pt;font-family:Consolas;color:#0000C0">out</span></i></b><span style="font-size:10.0pt;font-family:Consolas">.println(
</span><span style="font-size:10.0pt;font-family:Consolas;color:#6A3E3E">f</span><span style="font-size:10.0pt;font-family:Consolas"> ));</span><span style="font-size:10.0pt;font-family:Consolas;color:windowtext"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">It works like that.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">So here keycloak.json is used by the filter to validate the ID token by contacting the the IDP and then also requesting for the access token. Right ?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The doubt I still have is my other thread(<a href="http://lists.jboss.org/pipermail/keycloak-user/2016-July/007064.html">http://lists.jboss.org/pipermail/keycloak-user/2016-July/007064.html</a>)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<pre><span style="font-family:"Calibri",sans-serif;color:#1F497D">The answer there mentions that </span> when a request comes into the website the application, the session ID is used to establish who you are.<o:p></o:p></pre>
<p class="MsoNormal"><span style="color:#1F497D">But that is the ID token. Hope I am mixing two different concerns here.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Mohan<o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> Marek Posolda [mailto:mposolda@redhat.com]
<br>
<b>Sent:</b> Monday, August 01, 2016 10:50 PM<br>
<b>To:</b> Radhakrishnan, Mohan (Cognizant) <Mohan.Radhakrishnan@cognizant.com>; keycloak-user@lists.jboss.org<br>
<b>Subject:</b> Re: [keycloak-user] Access token or ID token<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Not sure exactly about all the details of your setup etc. However from the first look, if you use "response_type=id_token" , then Keycloak will return you just idToken, but not accessToken at all.
<br>
<br>
If you want both idToken and accessToken, you need to use value "id_token token".
<br>
<br>
So encoded parameter will be something like "response_type=id_token%20token"<br>
<br>
Marek<br>
<br>
On 01/08/16 11:41, <a href="mailto:Mohan.Radhakrishnan@cognizant.com">Mohan.Radhakrishnan@cognizant.com</a> wrote:<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"> My ID token flow and OIDC filter are working. But I am still doubtful about my implementation. When I used another IDP(IdentifyServer3) the redirect URL issued from<o:p></o:p></p>
<p class="MsoNormal">AngularJS gave me the access token with the ID token embedded in it directly.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">But now I am using this code.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas"> AccessToken
</span><span style="font-size:10.0pt;font-family:Consolas;color:#6A3E3E">accessToken</span><span style="font-size:10.0pt;font-family:Consolas"> =
</span><span style="font-size:10.0pt;font-family:Consolas;color:#6A3E3E">keycloakPrincipal</span><span style="font-size:10.0pt;font-family:Consolas">.getKeycloakSecurityContext().getToken();</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas">URL is this.</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><u><span style="font-size:12.0pt"><a href="http://localhost:8080/auth/realms/Test/protocol/openid-connect/auth?response_type=id_token&redirect_uri=http://localhost:8000/keycloak/claim/&realm=Test&client_id=Test&scope=user">http://localhost:8080/auth/realms/Test/protocol/openid-connect/auth?response_type=id_token&redirect_uri=http://localhost:8000/keycloak/claim/&realm=Test&client_id=Test&scope=user</a></span></u><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">And <a href="https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/javascript-adapter.html">
https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/javascript-adapter.html</a> mentions that keycloak.json is required to get the access token in AngularJS.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Am I missing something ? Why is there a difference ?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Mohan<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the
intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of
this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
<br>
<br>
<br>
<o:p></o:p></span></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>keycloak-user mailing list<o:p></o:p></pre>
<pre><a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><o:p></o:p></pre>
<pre><a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p> </o:p></span></p>
</div>
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original
message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law,
this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
</body>
</html>