Re: [keycloak-user] Client secret not provided in request

URL from configuration is the one from the keycloak.json : "auth-server-url" , looks like you forgot an /auth On Wed, Dec 14, 2016 at 12:02 PM, Charles Moulliard <cmoullia(a)redhat.com&gt; wrote: > The curl request works now but I'm getting this error when the token > received will be checked by the SpringBoot Tomcat Adapter > > Request > > curl -sk -X POST https://secure-sso-sso.e8ca.en > gint.openshiftapps.com/auth/realms/master/protocol/openid-connect/token > -d grant_type=password -d username=admin -d client_secret=MYSECRET -d > password=admin -d client_id=demoapp > > What "URL from configuration" refers to ? > > 2016-12-14 10:49:29.273 ERROR 1 --- [nio-8080-exec-6] > o.k.a.BearerTokenRequestAuthenticator : Failed to verify token > > org.keycloak.common.VerificationException: Token audience doesn't match > domain. Token issuer is https://secure-sso-sso.e8ca.en > gint.openshiftapps.com/auth/realms/master, but URL from configuration is > https://secure-sso-sso.e8ca.engint.openshiftapps.com/realms/master > at org.keycloak.RSATokenVerifier.verifyToken(RSATokenVerifier.java:49) > ~[keycloak-core-1.9.8.Final.jar!/:1.9.8.Final] > at org.keycloak.RSATokenVerifier.verifyToken(RSATokenVerifier.java:35) > ~[keycloak-core-1.9.8.Final.jar!/:1.9.8.Final] > at org.keycloak.adapters.BearerTokenRequestAuthenticator. > authenticateToken(BearerTokenRequestAuthenticator.java:87) > ~[keycloak-adapter-core-1.9.8.Final.jar!/:1.9.8.Final] > at org.keycloak.adapters.BearerTokenRequestAuthenticator. > authenticate(BearerTokenRequestAuthenticator.java:82) > ~[keycloak-adapter-core-1.9.8.Final.jar!/:1.9.8.Final] > at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:65) > ~[keycloak-adapter-core-1.9.8.Final.jar!/:1.9.8.Final] > at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorVa > lve.authenticateInternal(AbstractKeycloakAuthenticatorValve.java:206) > ~[keycloak-tomcat-core-adapter-1.9.8.Final.jar!/:1.9.8.Final] > at org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve.auth > enticate(KeycloakAuthenticatorValve.java:48) > ~[keycloak-tomcat8-adapter-1.9.8.Final.jar!/:1.9.8.Final] > at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:577) > [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorVa > lve.invoke(AbstractKeycloakAuthenticatorValve.java:187) > ~[keycloak-tomcat-core-adapter-1.9.8.Final.jar!/:1.9.8.Final] > at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) > [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) > [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) > [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:528) > [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at org.apache.coyote.http11.AbstractHttp11Processor.process(Abs > tractHttp11Processor.java:1100) [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler > .process(AbstractProtocol.java:687) [tomcat-embed-core-8.0.36.jar! > /:8.0.36] > at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1520) > [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1476) > [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > [na:1.8.0_101] > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > [na:1.8.0_101] > at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) > [tomcat-embed-core-8.0.36.jar!/:8.0.36] > at java.lang.Thread.run(Thread.java:745) [na:1.8.0_101] > > Charles Moulliard > Sr. Pr. Software Engineer @redhat > cmoulliard(a)redhat.com | work: +31 205 65 12 84 <+31%2020%20565%201284> | > mobile: +32 473 60 40 14 <+32%20473%2060%2040%2014> > Twitter: @cmoulliard <http://twitter.com/cmoulliard> | blog: > cmoulliard.github.io > committer: apache camel, karaf, servicemix, hawtio, fabric8, drools, > jbpm, deltaspike > > On Wed, Dec 14, 2016 at 8:56 AM, Stian Thorgersen <sthorger(a)redhat.com&gt; > wrote: > >> Your guess is correct. Or you can also use the much more complicated way >> of using basic auth header for client id and secret, but let's not get into >> that ;) >> >> On 14 December 2016 at 08:54, Sebastien Blanc <sblanc(a)redhat.com&gt; wrote: >> >>> I guess "-d client_secret=my_secret" ? ;) >>> >>> On Wed, Dec 14, 2016 at 8:48 AM, Charles Moulliard <cmoullia(a)redhat.com >>> > wrote: >>> >>>> How do I provide the client secret within the curl request ? An example >>>> would be great ;-) >>>> >>>> On Wed, Dec 14, 2016 at 8:27 AM, Stian Thorgersen <sthorger(a)redhat.com >>>> > >>>> wrote: >>>> >>>> > Error message is pretty self explanatory here - you're missing the >>>> client >>>> > secret >>>> > >>>> > On 14 December 2016 at 08:17, Charles Moulliard <cmoullia(a)redhat.com >>>> > >>>> > wrote: >>>> > >>>> >> Hi, >>>> >> >>>> >> Why do I get this error when I issue tthis curl request to get a >>>> token >>>> >> >>>> >> curl -sk -X POST >>>> >> https://secure-sso-sso.e8ca.engint.openshiftapps.com/auth/re >>>> >> alms/master/protocol/openid-connect/token >>>> >> -d >>>> >> <https://secure-sso-sso.e8ca.engint.openshiftapps.com/auth/r >>>> ealms/master/protocol/openid-connect/token-d> >>>> >> grant_type=password -d username=admin -d password=admin -d >>>> >> client_id=demoapp >>>> >> >>>> >> {"error_description":"Client secret not provided in >>>> >> request","error":"unauthorized_client"} >>>> >> >>>> >> Keycloak Version : 1.9.8 >>>> >> client_id: demoapp >>>> >> >>>> >> Do I have to set another filed instead of username/password & >>>> >> grant_type=password ? >>>> >> >>>> >> Regards, >>>> >> >>>> >> Charles >>>> >> _______________________________________________ >>>> >> keycloak-user mailing list >>>> >> keycloak-user(a)lists.jboss.org >>>> >> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >> >>>> > >>>> > >>>> _______________________________________________ >>>> keycloak-user mailing list >>>> keycloak-user(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>> >>> >> >