Hi,
This is because resources can have same name but different owners. If the
client is not acting on behalf of the user (user is subject in token) it
won't be able to send permission requests using the resource name. If the
client is acting on behalf of the user, then the server is capable of
matching the correct resources.
Regards.
Pedro Igor
On Tue, Sep 10, 2019 at 11:44 AM Or Harary <or(a)myobligo.com> wrote:
Hey,
When I'm logged in as a user (grant_type=password), and I'm trying to
request a permission ticket for a resource by its name, and I'm using the
token endpoint and grant type
"urn:ietf:params:oauth:grant-type:uma-ticket", everything works well.
But if I'm using a resource server token (from a login using
client_credentials), and i'm trying to request permissions for a resource
in another resource server, by the resource name, it results with the
following error:
{
error: 'invalid_resource',
error_description: 'Resource with id [my-resource-name] does not exist.'
}
When I'm requesting the resource with its ID, everything works as expected.
In version 3.4 it worked well. I now checked it in version 6.0.1 and
version 7.0.0 and it doesn't work and it seems to be because of this line:
https://github.com/keycloak/keycloak/blob/9c2525ec1afb6737dd012d3c744a409...
Is this the expected behaviour or a bug?
Thanks in advance,
Or
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user