Re: [keycloak-user] Sub-resource authentication (edge case)

Well, my understanding is that when configuring via the subsystem in wildfly, BASIC was the way to go. That said, I don't have a particular preference. But is that detail perhaps beside the point? The /api/* endpoint works exactly as you have described. In standalone.xml I've configured it to enable both bearer token and basic auth. So requests can be sent to /api/* with the Authorization header set (bearer token and basic auth credentials both work fine). The problem comes when sending a request to /gateway/*, which is just a servlet. I can successfully send a request to /gateway/* without an Authorization header. This works (unauthenticated access). However if I send a request to /gateway/* with an Authorization header, then keycloak attempts to authenticate. Even though the web.xml doesn't indicate that /gateway/* should be protected. I was expecting any *unprotected* resources to simply pass through any Authorization information, not attempt to actually process it. Again, this is perhaps an incorrect expectation on my part. -Eric On 12/12/2014 11:33 AM, Marek Posolda wrote: > Hi, > > if you want to use keycloak for authentication you should rather use: > > <auth-method>KEYCLOAK</auth-method> > > Also I don't know how are you sending request to "/api/*" . I guess it > is javascript application or some other servlet application, which is > sending jax-rs requests to api? In this cases, you should add manually > "Authorization" header with either "Authorization: Bearer ..." with > bearer token attached or "Authorization: Basic ...." with keycloak > username/password attached (bearer token is much better, so you can > avoid direct grant and you don't need to share credentials with your > application) > > Marek > > On 12.12.2014 14:06, Eric Wittmann wrote: >> In apiman I have a bit of an edge case that currently isn't working as I >> was hoping (running in wildfly 8.2 - not tested on any other platform). >> >> The issue is that I have a WAR with two sub-contexts: >> >> /api - JAX-RS endpoints to configure the API Gateway >> /gateway - the API Gateway (reverse proxy) >> >> I wanted /api to be protected by keycloak, but for /gateway to be >> unprotected. >> >> My web.xml looks like this: >> >> <security-constraint> >> <web-resource-collection> >> <web-resource-name>apiman-gateway</web-resource-name> >> <url-pattern>/api/*</url-pattern> >> </web-resource-collection> >> <auth-constraint> >> <role-name>apiadmin</role-name> >> </auth-constraint> >> </security-constraint> >> <login-config> >> <auth-method>BASIC</auth-method> >> <realm-name>apiman</realm-name> >> </login-config> >> <security-role> >> <role-name>apiadmin</role-name> >> </security-role> >> >> >> It all works great until I send a request to /gateway/* that includes an >> "Authorization" http header. If I do that, the adapter tries to >> authenticate with those credentials and fails with a 401 if they don't >> match (which they don't). >> >> I realize this is an odd case, but I did expect that if the web.xml >> specified that only /api/* were protected then other paths would simply >> pass through any Authorization headers. That may be an incorrect >> expectation - not sure what the servlet spec requires in this case. >> >> Thoughts? >> >> Currently I'm probably going to work around this by splitting up the API >> and Gateway servlets into separate WARs. >> >> -Eric >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user > _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user