4:49 p.m.
Dear All,
I am trying to test Keycloak-gatekeeper, have read the docs I could find (keaycloak-proxy
as well) but I still have a few questions:
1- I am trying to secure a number of REST APIs, configured behind bearer-only clients. I
think I need to first get a access token trough a confidential client using a
'grant-type=password' request and then do a second request to the REST client
resource. Is this the right approach, how would I implement this using
Keycloak-Gatekeeper?.
2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access. Is there
a way to use Keycloak's authorization settings to manage access to a client's
resource (i.e. policies, permissions, uma-ticket, etc.)?
3- How do I set up multiple clients, do I have to run and configure separate instances of
Keycloak-Gatekeeper?
Thanks in advance for your time and help.
Regards,
4:32 a.m.
Hi Eric,
I'm a beginner like you so please consider my responses accordingly.
1. Often your scenario is similar to a front end app accessing the REST
API. You can find an example of how to do this here:
https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript....
First the user logs in to the front end app, which gets the token and uses
it for calls to the backend. IMPORTANT: You need to include the backend's
client id in the front end's aud claim:
https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md
Another hurdle you might find using Gatekeeper in this AJAX setup is CORS.
I believe Gatekeeper has a bug and isn't sending the correct headers:
https://issues.jboss.org/browse/KEYCLOAK-8722
2. I have the same question as you. After reading the docs, I think the
answer is NO. If your back end stack does not have a Keycloak adapter (are
you using PHP like me?) then you would have to do all the UMA calls
"manually". There are UMA2 specifications out there which would guide us,
but I think it's a lot of work. There's also the Gluu oxd
<https://gluu.org/docs/oxd/> project which seems similar to Keycloak
Gatekeeper, but I doubt oxd is interoperable with Keycloak.
3. I think that normally a REST service should work with a bearer only
client, which expects the token and does not do authentication redirection.
You could instruct your API consumers to get the token directly from
Keycloak (using a confidential client?) before hitting your Gatekeeper
endpoint. Once again, keep in mind that by default the token retrieved from
one client won't work to hit a different client unless you set up the aud
claim properly.
Hopefully an expert will join and correct me.
Regards,
Geoffrey Cleaves
On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <eric.ramirez.sv(a)gmail.com>
wrote:
Dear All,
I am trying to test Keycloak-gatekeeper, have read the docs I could find
(keaycloak-proxy as well) but I still have a few questions:
1- I am trying to secure a number of REST APIs, configured behind
bearer-only clients. I think I need to first get a access token trough a
confidential client using a 'grant-type=password' request and then do a
second request to the REST client resource. Is this the right approach, how
would I implement this using Keycloak-Gatekeeper?.
2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access.
Is there a way to use Keycloak's authorization settings to manage access to
a client's resource (i.e. policies, permissions, uma-ticket, etc.)?
3- How do I set up multiple clients, do I have to run and configure
separate instances of Keycloak-Gatekeeper?
Thanks in advance for your time and help.
Regards,
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
10:12 a.m.
Hi Geoffrey,
On Fri, Nov 2, 2018 at 6:34 AM Geoffrey Cleaves <geoff(a)opticks.io> wrote:
Hi Eric,
I'm a beginner like you so please consider my responses accordingly.
1. Often your scenario is similar to a front end app accessing the REST
API. You can find an example of how to do this here:
https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript....
First the user logs in to the front end app, which gets the token and uses
it for calls to the backend. IMPORTANT: You need to include the backend's
client id in the front end's aud claim:
https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md
Another hurdle you might find using Gatekeeper in this AJAX setup is CORS.
I believe Gatekeeper has a bug and isn't sending the correct headers:
https://issues.jboss.org/browse/KEYCLOAK-8722
2. I have the same question as you. After reading the docs, I think the
answer is NO. If your back end stack does not have a Keycloak adapter (are
you using PHP like me?) then you would have to do all the UMA calls
"manually". There are UMA2 specifications out there which would guide us,
but I think it's a lot of work. There's also the Gluu oxd
<https://gluu.org/docs/oxd/> project which seems similar to Keycloak
Gatekeeper, but I doubt oxd is interoperable with Keycloak.
You are correct about this. It's a lot of work :) But nothing stops us
from planning an capture it on Jiras.
Feel free to do this if possible.
3. I think that normally a REST service should work with a bearer only
client, which expects the token and does not do authentication redirection.
You could instruct your API consumers to get the token directly from
Keycloak (using a confidential client?) before hitting your Gatekeeper
endpoint. Once again, keep in mind that by default the token retrieved from
one client won't work to hit a different client unless you set up the aud
claim properly.
Like I mentioned to Eric, the scope of gatekeeper is to act more as
sidecar, instead of a proxy. So you pretty
much need to deploy one gatekeeper per client.
Hopefully an expert will join and correct me.
Regards,
Geoffrey Cleaves
On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <eric.ramirez.sv(a)gmail.com>
wrote:
> Dear All,
> I am trying to test Keycloak-gatekeeper, have read the docs I could find
> (keaycloak-proxy as well) but I still have a few questions:
>
> 1- I am trying to secure a number of REST APIs, configured behind
> bearer-only clients. I think I need to first get a access token trough a
> confidential client using a 'grant-type=password' request and then do a
> second request to the REST client resource. Is this the right approach, how
> would I implement this using Keycloak-Gatekeeper?.
>
> 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access.
> Is there a way to use Keycloak's authorization settings to manage access to
> a client's resource (i.e. policies, permissions, uma-ticket, etc.)?
>
> 3- How do I set up multiple clients, do I have to run and configure
> separate instances of Keycloak-Gatekeeper?
>
> Thanks in advance for your time and help.
>
> Regards,
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
- abstractj
10:27 a.m.
On Fri, Nov 2, 2018 at 6:36 AM Geoffrey Cleaves <geoff(a)opticks.io> wrote:
Hi Eric,
I'm a beginner like you so please consider my responses accordingly.
1. Often your scenario is similar to a front end app accessing the REST
API. You can find an example of how to do this here:
https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript...
.
First the user logs in to the front end app, which gets the token and uses
it for calls to the backend. IMPORTANT: You need to include the backend's
client id in the front end's aud claim:
https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md
Another hurdle you might find using Gatekeeper in this AJAX setup is CORS.
I believe Gatekeeper has a bug and isn't sending the correct headers:
https://issues.jboss.org/browse/KEYCLOAK-8722
2. I have the same question as you. After reading the docs, I think the
answer is NO. If your back end stack does not have a Keycloak adapter (are
you using PHP like me?) then you would have to do all the UMA calls
"manually". There are UMA2 specifications out there which would guide us,
but I think it's a lot of work. There's also the Gluu oxd
<https://gluu.org/docs/oxd/> project which seems similar to Keycloak
Gatekeeper, but I doubt oxd is interoperable with Keycloak.
Yes, it is. We did recently a collaborative work with Gluu team to check
interoperability. In fact, they used oxd to check that both Gluu and
Keycloak ASs could be used to support UMA.
3. I think that normally a REST service should work with a bearer only
client, which expects the token and does not do authentication redirection.
You could instruct your API consumers to get the token directly from
Keycloak (using a confidential client?) before hitting your Gatekeeper
endpoint. Once again, keep in mind that by default the token retrieved from
one client won't work to hit a different client unless you set up the aud
claim properly.
Hopefully an expert will join and correct me.
Regards,
Geoffrey Cleaves
On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <eric.ramirez.sv(a)gmail.com
>
wrote:
> Dear All,
> I am trying to test Keycloak-gatekeeper, have read the docs I could find
> (keaycloak-proxy as well) but I still have a few questions:
>
> 1- I am trying to secure a number of REST APIs, configured behind
> bearer-only clients. I think I need to first get a access token trough a
> confidential client using a 'grant-type=password' request and then do a
> second request to the REST client resource. Is this the right approach,
how
> would I implement this using Keycloak-Gatekeeper?.
>
> 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource
access.
> Is there a way to use Keycloak's authorization settings to manage access
to
> a client's resource (i.e. policies, permissions, uma-ticket, etc.)?
>
> 3- How do I set up multiple clients, do I have to run and configure
> separate instances of Keycloak-Gatekeeper?
>
> Thanks in advance for your time and help.
>
> Regards,
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
10:54 a.m.
"Yes, it is. We did recently a collaborative work with Gluu team to check
interoperability. In fact, they used oxd to check that both Gluu and
Keycloak ASs could be used to support UMA."
That's very interesting, Pedro. oxd does appear have PHP adapters. In your
opinion, is it viable to use oxd as the missing Keycloak PHP adapter?
On Fri, 2 Nov 2018 at 16:27, Pedro Igor Silva <psilva(a)redhat.com> wrote:
>
>
Yes, it is. We did recently a collaborative work with Gluu team to check
interoperability. In fact, they used oxd to check that both Gluu and
Keycloak ASs could be used to support UMA.
>
> 3. I think that normally a REST service should work with a bearer only
> client, which expects the token and does not do authentication
> redirection.
> You could instruct your API consumers to get the token directly from
> Keycloak (using a confidential client?) before hitting your Gatekeeper
> endpoint. Once again, keep in mind that by default the token retrieved
> from
> one client won't work to hit a different client unless you set up the aud
> claim properly.
>
> Hopefully an expert will join and correct me.
>
> Regards,
> Geoffrey Cleaves
>
>
>
>
>
>
>
> On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <
> eric.ramirez.sv(a)gmail.com>
> wrote:
>
> > Dear All,
> > I am trying to test Keycloak-gatekeeper, have read the docs I could find
> > (keaycloak-proxy as well) but I still have a few questions:
> >
> > 1- I am trying to secure a number of REST APIs, configured behind
> > bearer-only clients. I think I need to first get a access token trough a
> > confidential client using a 'grant-type=password' request and then do a
> > second request to the REST client resource. Is this the right approach,
> how
> > would I implement this using Keycloak-Gatekeeper?.
> >
> > 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource
> access.
> > Is there a way to use Keycloak's authorization settings to manage
> access to
> > a client's resource (i.e. policies, permissions, uma-ticket, etc.)?
> >
> > 3- How do I set up multiple clients, do I have to run and configure
> > separate instances of Keycloak-Gatekeeper?
> >
> > Thanks in advance for your time and help.
> >
> > Regards,
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
12:23 p.m.
Thanks everyone for your replies, it definitely cleared things up for me. It seems that as
a ‘generic’ adapter Keycloak-Gatekeeper has limited functionality, its a matter of
finding the right use case to take advantage of this tool.
Regards,
On Nov 2, 2018, at 9:27 AM, Pedro Igor Silva
<psilva(a)redhat.com> wrote:
On Fri, Nov 2, 2018 at 6:36 AM Geoffrey Cleaves <geoff(a)opticks.io
<mailto:geoff@opticks.io>> wrote:
Hi Eric,
I'm a beginner like you so please consider my responses accordingly.
1. Often your scenario is similar to a front end app accessing the REST
API. You can find an example of how to do this here:
https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript...
<https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript...;.
First the user logs in to the front end app, which gets the token and uses
it for calls to the backend. IMPORTANT: You need to include the backend's
client id in the front end's aud claim:
https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md
<https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md...
Another hurdle you might find using Gatekeeper in this AJAX setup is CORS.
I believe Gatekeeper has a bug and isn't sending the correct headers:
https://issues.jboss.org/browse/KEYCLOAK-8722
<https://issues.jboss.org/browse/KEYCLOAK-8722>
2. I have the same question as you. After reading the docs, I think the
answer is NO. If your back end stack does not have a Keycloak adapter (are
you using PHP like me?) then you would have to do all the UMA calls
"manually". There are UMA2 specifications out there which would guide us,
but I think it's a lot of work. There's also the Gluu oxd
<https://gluu.org/docs/oxd/ <https://gluu.org/docs/oxd/>> project which seems
similar to Keycloak
Gatekeeper, but I doubt oxd is interoperable with Keycloak.
Yes, it is. We did recently a collaborative work with Gluu team to check
interoperability. In fact, they used oxd to check that both Gluu and Keycloak ASs could be
used to support UMA.
3. I think that normally a REST service should work with a bearer only
client, which expects the token and does not do authentication redirection.
You could instruct your API consumers to get the token directly from
Keycloak (using a confidential client?) before hitting your Gatekeeper
endpoint. Once again, keep in mind that by default the token retrieved from
one client won't work to hit a different client unless you set up the aud
claim properly.
Hopefully an expert will join and correct me.
Regards,
Geoffrey Cleaves
On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <eric.ramirez.sv(a)gmail.com
<mailto:eric.ramirez.sv@gmail.com>>
wrote:
> Dear All,
> I am trying to test Keycloak-gatekeeper, have read the docs I could find
> (keaycloak-proxy as well) but I still have a few questions:
>
> 1- I am trying to secure a number of REST APIs, configured behind
> bearer-only clients. I think I need to first get a access token trough a
> confidential client using a 'grant-type=password' request and then do a
> second request to the REST client resource. Is this the right approach, how
> would I implement this using Keycloak-Gatekeeper?.
>
> 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access.
> Is there a way to use Keycloak's authorization settings to manage access to
> a client's resource (i.e. policies, permissions, uma-ticket, etc.)?
>
> 3- How do I set up multiple clients, do I have to run and configure
> separate instances of Keycloak-Gatekeeper?
>
> Thanks in advance for your time and help.
>
> Regards,
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
10:05 a.m.
Hi Eric, we're still polishing the docs and fixing some high priority
issues. The README files and the docs will change in the next release.
Few answers inline.
On Wed, Oct 31, 2018 at 6:57 PM Eric Boyd Ramirez
<eric.ramirez.sv(a)gmail.com> wrote:
Dear All,
I am trying to test Keycloak-gatekeeper, have read the docs I could find (keaycloak-proxy
as well) but I still have a few questions:
1- I am trying to secure a number of REST APIs, configured behind bearer-only clients. I
think I need to first get a access token trough a confidential client using a
'grant-type=password' request and then do a second request to the REST client
resource. Is this the right approach, how would I implement this using
Keycloak-Gatekeeper?.
I believe Geoffrey answered already. But I hope to include your
scenario to the quickstarts too.
2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access. Is there
a way to use Keycloak's authorization settings to manage access to a client's
resource (i.e. policies, permissions, uma-ticket, etc.)?
Not at the moment, as far as I can tell. But I would appreciate if you
file a feature request. In this way we don't miss this.
3- How do I set up multiple clients, do I have to run and configure separate instances of
Keycloak-Gatekeeper?
Yes, you have to configure and run multiple instances. Gatekeeper is
more like a sidecar, instead of a proxy.
Thanks in advance for your time and help.
Regards,
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
- abstractj
2769
days inactive
2771
days old
6 comments
4 participants
participants (4)
-
Bruno Oliveira -
Eric Boyd Ramirez -
Geoffrey Cleaves -
Pedro Igor Silva