10:01 a.m.
Hi, we are trying to integrate keycloak in our system, and in order to
check the genreate access token, we need a realm public key. We would like
to avoid configuring crednetila on all endpoint needing to check a JWT
token, so it would be great to be able to get keycloak key without any
credentials.
i did found the endpoint
http://localhost:8080/auth/realms/{realm}
<http://%7b%7bkchost%7d%7d:8080/auth/realms/ISEP/>
which give the following json,without auth:
{"realm":{realm},"public_key":"xx","token-service":"http://localhost:8080/auth/realms/{realm}/protocol/openid-connect","account-service":"http://localhost:8080/auth/realms/{realm}/account","tokens-not-before":0}
Unfortunately, here there is no key id, so i can't handle several JWT
provider or even a single keycloak with key rotation.
Now, i found a more detailed key interface under
http://localhost:8080/auth/admin/realms/{realms}/keys, returning for
each key the status, type (algorithm), an the keyid.
But i need credentials to access this interface, even though its only
public data (HMAC & AES keys are NOT provided).
I accessed it with the keycloak master admin, i do not want to spread
his credentials everywhere, but i would be ok if i could create a
user with limited rights to access only that
Any suggestions on how to proceed ? Is there another endpoint to get
this fulll info ?
The doc doesnt clearly states the roles needed to access
auth/admin/realms/{realms}/keys
Thank you
JB
10:40 a.m.
/auth/realms/{my_realm}/.well-known/openid-configuration will give you a
list of openId endpoints, there you can find `jwks_uri` and looks like it
is what you are looking for ,
http://localhost:8080/auth/realms/{my_realm}/protocol/openid-connect/certs
On Tue, Jun 19, 2018 at 5:01 PM, Jean-Baptiste Fouet <jbf.nospam(a)gmail.com>
wrote:
Hi, we are trying to integrate keycloak in our system, and in order
to
check the genreate access token, we need a realm public key. We would like
to avoid configuring crednetila on all endpoint needing to check a JWT
token, so it would be great to be able to get keycloak key without any
credentials.
i did found the endpoint
http://localhost:8080/auth/realms/{realm}
<http://%7b%7bkchost%7d%7d:8080/auth/realms/ISEP/>
which give the following json,without auth:
{"realm":{realm},"public_key":"xx","token-service":"http://
localhost:8080/auth/realms/{realm}/protocol/openid-connect
","account-service":"http://localhost:8080/auth/realms/{realm}/account
","tokens-not-before":0}
Unfortunately, here there is no key id, so i can't handle several JWT
provider or even a single keycloak with key rotation.
Now, i found a more detailed key interface under
http://localhost:8080/auth/admin/realms/{realms}/keys, returning for
each key the status, type (algorithm), an the keyid.
But i need credentials to access this interface, even though its only
public data (HMAC & AES keys are NOT provided).
I accessed it with the keycloak master admin, i do not want to spread
his credentials everywhere, but i would be ok if i could create a
user with limited rights to access only that
Any suggestions on how to proceed ? Is there another endpoint to get
this fulll info ?
The doc doesnt clearly states the roles needed to access
auth/admin/realms/{realms}/keys
Thank you
JB
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
2:36 a.m.
Thanks, thats what i was looking for
JB
2018-06-19 17:40 GMT+02:00 Sebastien Blanc <sblanc(a)redhat.com>:
/auth/realms/{my_realm}/.well-known/openid-configuration will give
you a
list of openId endpoints, there you can find `jwks_uri` and looks like it
is what you are looking for , http://localhost:8080/auth/
realms/{my_realm}/protocol/openid-connect/certs
On Tue, Jun 19, 2018 at 5:01 PM, Jean-Baptiste Fouet <jbf.nospam(a)gmail.com
> wrote:
> Hi, we are trying to integrate keycloak in our system, and in order to
> check the genreate access token, we need a realm public key. We would like
> to avoid configuring crednetila on all endpoint needing to check a JWT
> token, so it would be great to be able to get keycloak key without any
> credentials.
>
> i did found the endpoint
>
> http://localhost:8080/auth/realms/{realm}
> <http://%7b%7bkchost%7d%7d:8080/auth/realms/ISEP/>
>
> which give the following json,without auth:
>
>
{"realm":{realm},"public_key":"xx","token-service":"http://l
> ocalhost:8080/auth/realms/{realm}/protocol/openid-connect","
> account-service":"http://localhost:8080/auth/realms/{realm}/account
> ","tokens-not-before":0}
>
> Unfortunately, here there is no key id, so i can't handle several JWT
> provider or even a single keycloak with key rotation.
>
> Now, i found a more detailed key interface under
>
> http://localhost:8080/auth/admin/realms/{realms}/keys, returning for
> each key the status, type (algorithm), an the keyid.
>
> But i need credentials to access this interface, even though its only
> public data (HMAC & AES keys are NOT provided).
>
> I accessed it with the keycloak master admin, i do not want to spread
> his credentials everywhere, but i would be ok if i could create a
> user with limited rights to access only that
>
> Any suggestions on how to proceed ? Is there another endpoint to get
> this fulll info ?
> The doc doesnt clearly states the roles needed to access
>
> auth/admin/realms/{realms}/keys
>
> Thank you
>
> JB
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
2173
days inactive
2174
days old
2 comments
2 participants
participants (2)
-
Jean-Baptiste Fouet -
Sebastien Blanc