Re: [keycloak-user] get users from postman

Il 7 dicembre 2018 alle 23.20 Geoffrey Cleaves <geoff(a)opticks.io&gt; ha scritto: Ciao Luca, I don't have a clear answer for you. But I have had some problems in the past creating roles using a similar JSON representation to the one you use. I found that although Keycloak did not complain, it did not actually assign the roles as I had hoped. Could this be happening to you? Instead of importing this JSON, I recommend you use the Admin Console to manually create the users and assign them the roles. Then try again with Postman. When I use Postman to call the users endpoint with a proper token, I do get a list of all my user successfully. It should work. Good luck! On Fri, 7 Dec 2018 at 18:49, Luca Stancapiano <luca.stancapiano(a)vige.it&gt; wrote: > Thanks Geoffrey, if you agree, let me use the query-users role as my > example only needs to query users. I created new groups configurated with > the old roles more query-users role. Here the new configuration: > > { > "realm": "school-domain", > "enabled": true, > "accessTokenLifespan": 60, > "accessCodeLifespan": 60, > "accessCodeLifespanUserAction": 300, > "ssoSessionIdleTimeout": 600, > "ssoSessionMaxLifespan": 36000, > "sslRequired": "external", > "registrationAllowed": true, > "resetPasswordAllowed": true, > "editUsernameAllowed": true, > "loginWithEmailAllowed": false, > "duplicateEmailsAllowed": true, > "privateKey": ......., > "publicKey": ......., > "requiredCredentials": [ > "password" > ], > "users": [ > { > "username": "root", > "enabled": true, > "email": &quot;lsflashboss62(a)gmail.com&quot;, > "credentials": [ > { > "type": "password", > "value": "gtn" > } > ], > "groups": [ > "admin" > ] > }, > { > "username": "hfgfghhgffhgfgh", > "enabled": true, > "email": &quot;luca.stancapiano(a)vige.it&quot;, > "firstName": "Luca", > "lastName": "Stancapiano", > "credentials": [ > { > "type": "password", > "value": "gtn" > } > ], > "groups": [ > "pupil" > ] > } > ], > "groups": [ > { > "name": "admin", > "path": "/admin", > "attributes": { > > }, > "realmRoles": [ > "admin" > ], > "clientRoles": { > "realm-management": [ > "query-users" > ], > "account": [ > "manage-account" > ] > }, > "subGroups": [] > }, > { > "name": "pupil", > "path": "/pupil", > "attributes": { > > }, > "realmRoles": [ > "pupil" > ], > "clientRoles": { > "realm-management": [ > "query-users" > ], > "account": [ > "manage-account" > ] > }, > "subGroups": [] > } > ] > } > > Now, when I connect through postman to the url > http://localhost:8180/auth/admin/realms/school-domain/users using the > 'root' user imported through the configuration, I receive an empty list, > when I espect the two users ('root' and 'hfgfghhgffhgfgh') imported through > the configuration. Where I wrong now? > > > Il 7 dicembre 2018 alle 10.55 Geoffrey Cleaves <geoff(a)opticks.io&gt; ha > scritto: > > > > > > Be sure that the token you are using to list the users has a manage-realm > > role. > > > > On Thu, 6 Dec 2018 at 16:09, Luca Stancapiano <luca.stancapiano(a)vige.it&gt; > > wrote: > > > > > But changing the postman configuration from Oauth 2.0 to Bearer token I > > > see the error is changed. Now I have a 403 Forbidden > > > > > > > Il 6 dicembre 2018 alle 15.08 Joao Paulo Ramos <jramos(a)redhat.com&gt; > ha > > > scritto: > > > > > > > > > > > > Hello Luca, > > > > > > > > In your webapp's Keycloak Client, try putting it as baerer only. > > > > Also, in the the HTTP request that you make, be sure you are setting > the > > > > token in the header of the HTTP request, with the following > parameter: > > > > > > > > {"Authorization" : "bearer " + $TOKEN} > > > > > > > > Thanks, > > > > > > > > JOÃO PAULO RAMOS > > > > > > > > Red Hat Brasil > > > > <https://red.ht/sig> > > > > > > > > > > > > On Thu, Dec 6, 2018 at 11:13 AM Luca Stancapiano < > > > luca.stancapiano(a)vige.it&gt; > > > > wrote: > > > > > > > > > I'm trying to call via REST through POSTMAN the list of users > through > > > the > > > > > get path: > http://localhost:8180/auth/admin/realms/school-domain/users > > > > > > > > > > Here my keycloak configuration where I create 2 users, 4 roles, a > > > 'school' > > > > > client and a 'school-domain' realm: > > > > > > > > > > { > > > > > "realm": "school-domain", > > > > > "enabled": true, > > > > > "accessTokenLifespan": 60, > > > > > "accessCodeLifespan": 60, > > > > > "accessCodeLifespanUserAction": 300, > > > > > "ssoSessionIdleTimeout": 600, > > > > > "ssoSessionMaxLifespan": 36000, > > > > > "sslRequired": "external", > > > > > "registrationAllowed": true, > > > > > "resetPasswordAllowed": true, > > > > > "editUsernameAllowed": true, > > > > > "loginWithEmailAllowed": false, > > > > > "duplicateEmailsAllowed": true, > > > > > "privateKey": > > > > > > > > > "MIICXAIBAAKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABAoGAfmO8gVhyBxdqlxmIuglbz8bcjQbhXJLR2EoS8ngTXmN1bo2L90M0mUKSdc7qF10LgETBzqL8jYlQIbt+e6TH8fcEpKCjUlyq0Mf/vVbfZSNaVycY13nTzo27iPyWQHK5NLuJzn1xvxxrUeXI6A2WFpGEBLbHjwpx5WQG9A+2scECQQDvdn9NE75HPTVPxBqsEd2z10TKkl9CZxu10Qby3iQQmWLEJ9LNmy3acvKrE3gMiYNWb6xHPKiIqOR1as7L24aTAkEAtyvQOlCvr5kAjVqrEKXalj0Tzewjweuxc0pskvArTI2Oo070h65GpoIKLc9jf+UA69cRtquwP93aZKtW06U8dQJAF2Y44ks/mK5+eyDqik3koCI08qaC8HYq2wVl7G2QkJ6sbAaILtcvD92ToOvyGyeE0flvmDZxMYlvaZnaQ0lcSQJBAKZU6umJi3/xeEbkJqMfeLclD27XGEFoPeNrmdx0q10Azp4NfJAY+Z8KRyQCR2BEG+oNitBOZ+YXF9KCpH3cdmECQHEigJhYg+ykOvr1aiZUMFT72HU0jnmQe2FVekuG+LJUt2Tm7GtMjTFoGpf0JwrVuZN39fOYAlo+nTixgeW7X8Y=", > > > > > "publicKey": > > > > > > > > > "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB", > > > > > "requiredCredentials": [ > > > > > "password" > > > > > ], > > > > > "users": [ > > > > > { > > > > > "username": "root", > > > > > "enabled": true, > > > > > "email": &quot;lsflashboss62(a)gmail.com&quot;, > > > > > "credentials": [ > > > > > { > > > > > "type": "password", > > > > > "value": "gtn" > > > > > } > > > > > ], > > > > > "realmRoles": [ > > > > > "admin" > > > > > ], > > > > > "clientRoles": { > > > > > "account": [ > > > > > "manage-account" > > > > > ] > > > > > } > > > > > }, > > > > > { > > > > > "username": "HUHUJJJKJJKN", > > > > > "enabled": true, > > > > > "email": &quot;luca.stancapiano(a)vige.it&quot;, > > > > > "firstName": "Luca", > > > > > "lastName": "Stancapiano", > > > > > "credentials": [ > > > > > { > > > > > "type": "password", > > > > > "value": "gtn" > > > > > } > > > > > ], > > > > > "realmRoles": [ > > > > > "pupil" > > > > > ], > > > > > "clientRoles": { > > > > > "account": [ > > > > > "manage-account" > > > > > ] > > > > > } > > > > > } > > > > > ], > > > > > "clients": [ > > > > > { > > > > > "clientId": "school", > > > > > "rootUrl": "http://localhost:8080/school", > > > > > "enabled": true, > > > > > "redirectUris": [ > > > > > "http://localhost:8080/school/*" > > > > > ], > > > > > "webOrigins": [ > > > > > "http://localhost:8080" > > > > > ], > > > > > "publicClient": false, > > > > > "secret": > > > "bce5816d-98c4-404f-a18d-bcc5cb005c79", > > > > > "serviceAccountsEnabled": true, > > > > > "authorizationServicesEnabled": true, > > > > > "authorizationSettings": { > > > > > "allowRemoteResourceManagement": > true, > > > > > "policyEnforcementMode": > "ENFORCING", > > > > > "resources": [ > > > > > { > > > > > "name": "Default > > > Resource", > > > > > "type": > > > > > "urn:school:resources:default", > > > > > > "ownerManagedAccess": > > > > > false, > > > > > "attributes": { > > > > > > > > > > }, > > > > > "_id": > > > > > "c338b2be-da73-471c-9bb0-77ad52e1f88f", > > > > > "uris": [ > > > > > "/*" > > > > > ] > > > > > } > > > > > ], > > > > > "policies": [ > > > > > { > > > > > "id": > > > > > "edb01393-180e-4d95-afd3-92b3ac5a6d41", > > > > > "name": "Default > > > Policy", > > > > > "description": "A > > > policy > > > > > that grants access only for users within this realm", > > > > > "type": "js", > > > > > "logic": > "POSITIVE", > > > > > "decisionStrategy": > > > > > "AFFIRMATIVE", > > > > > "config": { > > > > > "code": > "// by > > > > > default, grants any permission associated with this > > > > > policy\n$evaluation.grant();\n" > > > > > } > > > > > }, > > > > > { > > > > > "id": > > > > > "1f5dce97-54e3-4dcf-92bd-a2a59120286f", > > > > > "name": "Default > > > > > Permission", > > > > > "description": "A > > > > > permission that applies to the default resource type", > > > > > "type": "resource", > > > > > "logic": > "POSITIVE", > > > > > "decisionStrategy": > > > > > "UNANIMOUS", > > > > > "config": { > > > > > > > > > > "defaultResourceType": "urn:school:resources:default", > > > > > > > > "applyPolicies": > > > > > "[\"Default Policy\"]" > > > > > } > > > > > } > > > > > ], > > > > > "scopes": [] > > > > > } > > > > > } > > > > > ], > > > > > "roles": { > > > > > "realm": [ > > > > > { > > > > > "name": "admin", > > > > > "description": "Administrator > > > privileges" > > > > > }, > > > > > { > > > > > "name": "schooloperator", > > > > > "description": "School Operator > > > privileges" > > > > > }, > > > > > { > > > > > "name": "teacher", > > > > > "description": "Teacher privileges" > > > > > }, > > > > > { > > > > > "name": "pupil", > > > > > "description": "Pupil privileges" > > > > > } > > > > > ] > > > > > } > > > > > } > > > > > > > > > > Keycloak starts on the 8180 port. I configured POSTMAN with OAuth > 2.0. > > > > > Here the Oauth configuration used to receive the token: > > > > > > > > > > Token Name: Token Name > > > > > Grant Type: Authorization Code > > > > > Callback URL: http://localhost:8080/school > > > > > Auth URL: > > > > > > > > > http://localhost:8180/auth/realms/school-domain/protocol/openid-connect/auth > > > > > Access Token URL: > > > > > > > > > http://localhost:8180/auth/realms/school-domain/protocol/openid-connect/t... > > > > > Client ID: school > > > > > Client Secret: bce5816d-98c4-404f-a18d-bcc5cb005c79 > > > > > Client Authentication: Send as Basic Auth header > > > > > > > > > > The Callback URL is an active simple web app starting on the 8080 > port. > > > > > The token creation is ok but when I call the server with the > created > > > token > > > > > I get a 401 Unauthorized error. What I miss? > > > > > _______________________________________________ > > > > > keycloak-user mailing list > > > > > keycloak-user(a)lists.jboss.org > > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > > > > > > > > > > _______________________________________________ > > > keycloak-user mailing list > > > keycloak-user(a)lists.jboss.org > > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > > > > > > > -- > > > > Regards, > > Geoffrey Cleaves > -- Regards, Geoffrey Cleaves