Make kid optional in SignedJWT
by Kostka Artur (BCI/ESW25)
Hi,
I have a question according .NET, Keycloak and Signed JWT (https://www.keycloak.org/docs/latest/securing_apps/index.html#_client_aut...)
Right now we want to create a Signed JWT from .NET in order to retrieve our access token. There is no library available and OWIN is deprecated, so we decided to implement the required JWT by ourselves.
This is not a big deal, but we are struggling, because the native .NET returns a different value compared to the Keycloak implementation (JWTClientCredentialsProvider.java - createSignedRequestToken(...)<https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co...>), when calculating the kid for the token header.
The .NET calculated kid causes Keycloak to return an error message, it is obviously different from the one calculated with the Keycloak adapter. We could figure out that the .NET and the Keycloak adapter are calculating the kid differently.
As we investigated further https://tools.ietf.org/html/rfc7515#section-4.1.4 specifies that this kid parameter is optional and just a hint for the authorization server.
Are there any plans to change this behavior according RFC7515 and make the kid optional?
Cheers,
Artur
Best regards / Mit freundlichen Grüßen / Üdvözlettel / 致以诚挚的问候
Mr. Artur Kostka
Bosch Connected Industry – BCI/ESW25
Bosch Software Innovations GmbH | Ziegelei 7 | 88090 Immenstaad | GERMANY | www.bosch-si.com<http://www.bosch-si.com>
Phone +49 7545 202-256 | Fax +49 7545 202-301 | Artur.Kostka(a)bosch-si.com
Sitz: Berlin, Register court: Amtsgericht Charlottenburg; HRB 148411 B
Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn
6 years, 8 months
role-mappings.
by Vaclav Havlik
Hello,
can I ask you again?
I would like do assign some specific roles (view-realm, manage-users) on the
client realm-management to a user .
Via REST API, I cannot, however, even display the role-mappings by doing
HTTP GET on
/auth/admin/realms/xxx/users/4c0f445a-53e9-45c2-a9c9-a8ac69bb5b48/role-
mappings/clients/realm-management
(Gives HTTP 404, xxx is my realm).
But, if I take my own client, whose name is web_app, then the request
/auth/admin/realms/xxx/users/4c0f445a-53e9-45c2-a9c9-a8ac69bb5b48/role-
mappings/clients/web_app
works (HTTP 200), giving empty array.
When doing this, I follow instructions on
https://www.keycloak.org/docs-api/4.0/rest-api/index.html#_client_role_
mappings_resource
Can you tell me, what the problem is?
Thank you, Venca.
6 years, 8 months
Logging in with admin REST API as user with OTP
by Lukasz Lech
Hello,
Is it possible to log in as a user with OTP using Admin Rest API?
I haven't found any hint and I don't see appropriate fields in org.keycloak.admin.client.KeycloakBuilder that could allow that. After activating OTP my code fails (which is expected, otherwise it will undermine the purpose of OTP).
Best regards,
Lukasz Lech
6 years, 8 months
