>>>

I am using keycloak and have assigned some global roles (TOUPPER and REVERSE) to a user. The decoded access token looks like this... { "jti" : "0a0541f2-9b74-4a41-b862-a20a3cbc2bcb", "exp" : 1464097823, "nbf" : 0, "iat" : 1464097523, "iss" : "https://my.keycloak.com/auth/realms/T <https://keycloak.cyberavenue.com.au/auth/realms/Glomex>enantA";, "aud" : "test-client", "sub" : "20974f13-8272-4cd5-a172-5c8de4cdc782", "typ" : "Bearer", "azp" : "test-client", "nonce" : "C_D0xDSCytoFaopJoYZu36BJcb6eMR2Xeg8VGP2nxeQ", "session_state" : "b625d171-e01d-462c-9d01-d159b9b75635", "name" : "", "preferred_username" : "anthony", "client_session" : "80b0ac34-5ee8-41f2-97da-649cf1abbd81", "allowed-origins" : [ ], "realm_access" : { "roles" : [ "TOUPPER", "REVERSE" ] }, "resource_access" : { }, "groups" : [ "tenantA/brandA", "tenantA" ] } I'm now trying to configure mod_auth_openidc authorization on some url paths based on the roles in the "realm_access"."roles" path of the token. I've tried this configuration... <Location /glomex-mds-webapp/api/v1/secure/demo/toupper> AuthType openid-connect #Require valid-user Require claim realm_access.roles:TOUPPER </Location> This doesn't seem to work though. Is it possible to use json path syntax for claim authorization?

Hello group, Just wanted to let you know that I build a small example [0] that demonstrates the usage of Keycloak with mod_auth_oidc [1] with Docker + Apache + PHP. Works like a charm :) Cheers, Thomas [0] https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example [1] https://github.com/pingidentity/mod_auth_openidc _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Don't think there's a built-in option to add roles as a top-level attribute. You can create a JIRA for it. In the mean time you can also create your own custom mapper. On 3 June 2016 at 01:20, Anthony Fryer <anthony.fryer(a)gmail.com&gt; wrote: > Just need to keep in mind if you want to use mod_auth_oidc to secure urls > using keycloak roles, there can be issues. Is it possible to somehow map > keycloak roles to a top level attribute in the access token as a work > around? > > >>>> > > No, it is not possible to use json path syntax, patches would be > welcome... > > Expression can be of limited complexity today: 1-level deep arrays are > supported as are regular expressions. So if you would be able to instruct > your OP to send the roles in a top-level attribute called > "realm_access.roles", then what you currently have configured would work. > > Hans. > > On Tue, May 24, 2016 at 3:50 PM, <anthony.fryer(a)gmail.com&gt; wrote: > >> I am using keycloak and have assigned some global roles (TOUPPER and >> REVERSE) to a user. The decoded access token looks like this... >> >> { >> "jti" : "0a0541f2-9b74-4a41-b862-a20a3cbc2bcb", >> "exp" : 1464097823, >> "nbf" : 0, >> "iat" : 1464097523, >> "iss" : "https://my.keycloak.com/auth/realms/T >> <https://keycloak.cyberavenue.com.au/auth/realms/Glomex>enantA";, >> "aud" : "test-client", >> "sub" : "20974f13-8272-4cd5-a172-5c8de4cdc782", >> "typ" : "Bearer", >> "azp" : "test-client", >> "nonce" : "C_D0xDSCytoFaopJoYZu36BJcb6eMR2Xeg8VGP2nxeQ", >> "session_state" : "b625d171-e01d-462c-9d01-d159b9b75635", >> "name" : "", >> "preferred_username" : "anthony", >> "client_session" : "80b0ac34-5ee8-41f2-97da-649cf1abbd81", >> "allowed-origins" : [ ], >> "realm_access" : { >> "roles" : [ "TOUPPER", "REVERSE" ] >> }, >> "resource_access" : { }, >> "groups" : [ "tenantA/brandA", "tenantA" ] >> } >> >> >> I'm now trying to configure mod_auth_openidc authorization on some url >> paths based on the roles in the "realm_access"."roles" path of the token. >> I've tried this configuration... >> >> <Location /glomex-mds-webapp/api/v1/secure/demo/toupper> >> AuthType openid-connect >> #Require valid-user >> Require claim realm_access.roles:TOUPPER >> </Location> >> >> This doesn't seem to work though. Is it possible to use json path >> syntax for claim authorization? > > > On Fri, Jun 3, 2016 at 7:30 AM, Thomas Darimont < > thomas.darimont(a)googlemail.com&gt; wrote: > >> Hello group, >> >> Just wanted to let you know that I build a small example [0] that >> demonstrates the usage of Keycloak with mod_auth_oidc [1] >> with Docker + Apache + PHP. >> >> Works like a charm :) >> >> Cheers, >> Thomas >> >> [0] https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example >> [1] https://github.com/pingidentity/mod_auth_openidc >> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

Hello Thomas, that's what I'm looking for and it works great also in my test environment :) Thank you. Cheers Am 02.06.2016 um 23:30 schrieb Thomas Darimont: Hello group, Just wanted to let you know that I build a small example [0] that demonstrates the usage of Keycloak with mod_auth_oidc [1] with Docker + Apache + PHP. Works like a charm :) Cheers, Thomas [0] https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example [1] https://github.com/pingidentity/mod_auth_openidc _______________________________________________ keycloak-user mailing listkeycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user

I use the setting in a Ubuntu 14.04 environment and there is Apache 2.4 currently the standard. For me the provided binaries on github don't work and some notes there mention that this releases only work with Apache 2.2. After a clone and compile it works also with Apache 2.4 ./autogen.sh ./configure make sudo make install sudo a2enmod auth_openidc Cheers, Eiko Am 03.06.2016 um 10:36 schrieb Thomas Darimont: Hello Okie, great to hear :) @Stian I already implemented mappers for propagating client and realm role mappings to JWT tokens. If you point me to the JIRA issue I can send a PR for it. Cheers, Thomas 2016-06-03 10:13 GMT+02:00 Okie Oth <okie.othsam(a)gmail.com&gt;: > Hello Thomas, > that's what I'm looking for and it works great also in my test > environment :) > > Thank you. > > Cheers > > > Am 02.06.2016 um 23:30 schrieb Thomas Darimont: > > Hello group, > > Just wanted to let you know that I build a small example [0] that > demonstrates the usage of Keycloak with mod_auth_oidc [1] > with Docker + Apache + PHP. > > Works like a charm :) > > Cheers, > Thomas > > [0] https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example > [1] https://github.com/pingidentity/mod_auth_openidc > > > _______________________________________________ > keycloak-user mailing listkeycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user > > >

Thomas fancy adding a page about using mod_auth_openidc to our new docs? Git repo is here: https://github.com/keycloak/securing_apps_guide Published guide is here: https://keycloak.gitbooks.io/securing-client-applications-guide/content/t... On 3 June 2016 at 13:15, Thomas Darimont <thomas.darimont(a)googlemail.com&gt; wrote: > FYI I created https://issues.jboss.org/browse/KEYCLOAK-3081 > for the "Custom User Role Attribute Protocol Mapper" feature request. > > PR incoming... > > Cheers, > Thomas > > 2016-06-03 11:50 GMT+02:00 Okie Oth <okie.othsam(a)gmail.com&gt;: > >> I use the setting in a Ubuntu 14.04 environment and there is Apache 2.4 >> currently the standard. For me the provided binaries on github don't work >> and some notes there mention that this releases only work with Apache 2.2. >> >> After a clone and compile it works also with Apache 2.4 >> >> ./autogen.sh >> ./configure >> make >> sudo make install >> sudo a2enmod auth_openidc >> >> Cheers, >> Eiko >> >> >> >> Am 03.06.2016 um 10:36 schrieb Thomas Darimont: >> >> Hello Okie, >> >> great to hear :) >> >> @Stian I already implemented mappers for propagating client and realm >> role mappings to JWT tokens. >> If you point me to the JIRA issue I can send a PR for it. >> >> Cheers, >> Thomas >> >> 2016-06-03 10:13 GMT+02:00 Okie Oth <okie.othsam(a)gmail.com&gt;: >> >>> Hello Thomas, >>> that's what I'm looking for and it works great also in my test >>> environment :) >>> >>> Thank you. >>> >>> Cheers >>> >>> >>> Am 02.06.2016 um 23:30 schrieb Thomas Darimont: >>> >>> Hello group, >>> >>> Just wanted to let you know that I build a small example [0] that >>> demonstrates the usage of Keycloak with mod_auth_oidc [1] >>> with Docker + Apache + PHP. >>> >>> Works like a charm :) >>> >>> Cheers, >>> Thomas >>> >>> [0] https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example >>> [1] https://github.com/pingidentity/mod_auth_openidc >>> >>> >>> _______________________________________________ >>> keycloak-user mailing listkeycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user >>> >>> >>> >> >> > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

Hi Thomas, just a comment on your example project, the Apache directive OIDCCryptoPassphrase is (AFAIK) used by the apache module to en/decrypt the state parameter that is sent with the redirect params to the OP. This is a mandatory settings and you will have to make sure its random and secured (otherwise someone can steal your users session). If you run the apache behind a load balancer, this value needs to be the same on all nodes, else the module will return invalid state errors. Cheers, Niels On Fri, Jun 3, 2016 at 7:30 AM, Thomas Darimont < thomas.darimont(a)googlemail.com&gt; wrote: > Hello group, > > Just wanted to let you know that I build a small example [0] that > demonstrates the usage of Keycloak with mod_auth_oidc [1] > with Docker + Apache + PHP. > > Works like a charm :) > > Cheers, > Thomas > > [0] https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example > [1] https://github.com/pingidentity/mod_auth_openidc > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >