Re: [keycloak-user] Validating keycloak access tokens

Hi, I would like to ask what is the recommended way for validating a token I received from a keycloak server. Specifically, I have the following. 1. A keycloak server running v. 1.0.4Final. 2. A javascript client using the js adapter provided for 1.0.4Final 3. REST services on a wildfly server using 1.4.0 adapter for wildfly 9. I use the JS adapter to receive a token from keycloak server. The token seems to be a JWT, but when it is included in the Authorization header for the REST request I make to the REST service that is on wildfly I get back an 'invalid signature' response. I also fail to verify the token if I enter the relevant info on jwt.io (token and public key). So my question is 1. Does the 1.0.4Final version sign the tokens? 2. What is the recommended way for the REST service to validate the token present on the Authorization/Bearer header of a REST request? Thanks in advance for any answers -- Nikos _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user