Le 10 nov. 2017 à 11:33, Pedro Igor Silva <psilva(a)redhat.com&gt; a écrit : Hi, I think you could probably change your application and remove the resources/paths you want to make public from the list of resources protected by the adapter. On Thu, Nov 9, 2017 at 2:06 PM, Corentin Dupont <corentin.dupont(a)gmail.com&gt; wrote: > Another question: how to apply default authorizations? > > I want to protect my API with authorization in Keycloak. However some > resources should be open to the public, accessible without any bearer > token. > My idea was: > - create an "unregistered_user" composite role, containing some basic roles > - create a "guest" user, with the unregistered_user role > - on the API server, if there is no token in the request I will get the > roles of the guest user and user them. If there is a token, I'll use that > user permissions. > What do you think of that process? > > Thanks > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user > _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Le 10 nov. 2017 à 12:12, Pedro Igor Silva <psilva(a)redhat.com&gt; a écrit : @Emilien Bondu, I was looking that thread again and now I'm wondering if you end up with something you can share. On Fri, Nov 10, 2017 at 9:07 AM, Emilien Bondu <dev.ebondu(a)gmail.com <mailto:dev.ebondu@gmail.com>> wrote: Hi, Maybe you should have a look here : http://lists.jboss.org/pipermail/keycloak-user/2017-March/009830.html <http://lists.jboss.org/pipermail/keycloak-user/2017-March/009830.html> > Le 10 nov. 2017 à 11:33, Pedro Igor Silva <psilva(a)redhat.com <mailto:psilva@redhat.com>> a écrit : > > Hi, > > I think you could probably change your application and remove the > resources/paths you want to make public from the list of resources > protected by the adapter. > > On Thu, Nov 9, 2017 at 2:06 PM, Corentin Dupont <corentin.dupont(a)gmail.com <mailto:corentin.dupont@gmail.com>> > wrote: > >> Another question: how to apply default authorizations? >> >> I want to protect my API with authorization in Keycloak. However some >> resources should be open to the public, accessible without any bearer >> token. >> My idea was: >> - create an "unregistered_user" composite role, containing some basic roles >> - create a "guest" user, with the unregistered_user role >> - on the API server, if there is no token in the request I will get the >> roles of the guest user and user them. If there is a token, I'll use that >> user permissions. >> What do you think of that process? >> >> Thanks >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> >> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user> >> > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>

Le 10 nov. 2017 à 15:02, Pedro Igor Silva <psilva(a)redhat.com&gt; a écrit : I'm glad to take a look on it and see how it could fit in our adapters. Could you create a JIRA and give some link to your code so we can discuss from there ? Thanks. On Fri, Nov 10, 2017 at 10:51 AM, Emilien Bondu <dev.ebondu(a)gmail.com <mailto:dev.ebondu@gmail.com>> wrote: To achieve this, I implemented a KeycloakAnonymousActionsFilter filter to handle requests, associated to an AnonymousActionsHandler (extending the official AuthenticatedActionsHandler) and an AnonymousPolicyEnforcer (extending the official AbstractPolicyEnforcer). Do you think this code should be added to the official spring-adapter ? > Le 10 nov. 2017 à 12:12, Pedro Igor Silva <psilva(a)redhat.com <mailto:psilva@redhat.com>> a écrit : > > @Emilien Bondu, I was looking that thread again and now I'm wondering if you end up with something you can share. > > On Fri, Nov 10, 2017 at 9:07 AM, Emilien Bondu <dev.ebondu(a)gmail.com <mailto:dev.ebondu@gmail.com>> wrote: > Hi, > > Maybe you should have a look here : > > http://lists.jboss.org/pipermail/keycloak-user/2017-March/009830.html <http://lists.jboss.org/pipermail/keycloak-user/2017-March/009830.html> > > >> Le 10 nov. 2017 à 11:33, Pedro Igor Silva <psilva(a)redhat.com <mailto:psilva@redhat.com>> a écrit : >> >> Hi, >> >> I think you could probably change your application and remove the >> resources/paths you want to make public from the list of resources >> protected by the adapter. >> >> On Thu, Nov 9, 2017 at 2:06 PM, Corentin Dupont <corentin.dupont(a)gmail.com <mailto:corentin.dupont@gmail.com>> >> wrote: >> >>> Another question: how to apply default authorizations? >>> >>> I want to protect my API with authorization in Keycloak. However some >>> resources should be open to the public, accessible without any bearer >>> token. >>> My idea was: >>> - create an "unregistered_user" composite role, containing some basic roles >>> - create a "guest" user, with the unregistered_user role >>> - on the API server, if there is no token in the request I will get the >>> roles of the guest user and user them. If there is a token, I'll use that >>> user permissions. >>> What do you think of that process? >>> >>> Thanks >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user> >>> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> >> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user> > >

Hi, As a first draft of an « unauthenticated » authz, you can have a look here : https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/> Interesting classes are : keycloak <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839>/adapters <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/adapters>/oidc < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/adapters/oidc>/a... <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core>/src <https://github.com/ebondu/ keycloak/tree/KEYCLOAK-5839/adapters/oidc/adapter-core/src>/main < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main>/java <https://github.com/ebondu/ keycloak/tree/KEYCLOAK-5839/adapters/oidc/adapter-core/src/main/java>/org <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main/java/org>/keycloak < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main/java/org/keycloak>/adapters < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters>/ UnauthenticatedActionsHandler.java keycloak <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839>/adapters <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/adapters>/oidc < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/adapters/oidc>/a... <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core>/src <https://github.com/ebondu/ keycloak/tree/KEYCLOAK-5839/adapters/oidc/adapter-core/src>/main < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main>/java <https://github.com/ebondu/ keycloak/tree/KEYCLOAK-5839/adapters/oidc/adapter-core/src/main/java>/org <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main/java/org>/keycloak < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main/java/org/keycloak>/adapters < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters>/authorization <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/adapter-core/src/main/java/org/keycloak/ adapters/authorization>/UnauthenticatedPolicyEnforcer.java keycloak <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839>/adapters <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/adapters>/oidc < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/adapters/oidc>/s... <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/spring-security>/src <https://github.com/ebondu/ keycloak/tree/KEYCLOAK-5839/adapters/oidc/spring-security/src>/main < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/spring-security/src/main>/java <https://github.com/ebondu/ keycloak/tree/KEYCLOAK-5839/adapters/oidc/spring-security/src/main/java>/org <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/spring-security/src/main/java/org>/keycloak < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/spring-security/src/main/java/org/keycloak>/adapters < https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/spring-security/src/main/java/org/keycloak/adapters>/springsecurity <https://github.com/ebondu/keycloak/tree/KEYCLOAK-5839/ adapters/oidc/spring-security/src/main/java/org/keycloak/ adapters/springsecurity>/filter <https://github.com/ebondu/ keycloak/tree/KEYCLOAK-5839/adapters/oidc/spring-security/ src/main/java/org/keycloak/adapters/springsecurity/filter>/ KeycloakUnauthenticatedActionsFilter.java Here a corresponding conf in spring to use it : <beans:bean id="keycloakScopeProcessingFilter" class="org.keycloak.adapters.springsecurity.filter. KeycloakUnauthenticatedActionsFilter"/> <http auto-config='false' pattern="/v1/public/**" entry-point-ref="authenticationEntryPoint" create-session="stateless" use-expressions="true"> ... <custom-filter ref="keycloakScopeProcessingFilter" before="FORM_LOGIN_FILTER" /> ... </http> Emilien > Le 10 nov. 2017 à 15:02, Pedro Igor Silva <psilva(a)redhat.com&gt; a écrit : > > I'm glad to take a look on it and see how it could fit in our adapters. > Could you create a JIRA and give some link to your code so we can discuss > from there ? > > Thanks. > > On Fri, Nov 10, 2017 at 10:51 AM, Emilien Bondu <dev.ebondu(a)gmail.com&gt; > wrote: > >> To achieve this, I implemented a KeycloakAnonymousActionsFilter filter to >> handle requests, associated to an AnonymousActionsHandler (extending the >> official AuthenticatedActionsHandler) and an AnonymousPolicyEnforcer (extending >> the official AbstractPolicyEnforcer). Do you think this code should be >> added to the official spring-adapter ? >> >> >> Le 10 nov. 2017 à 12:12, Pedro Igor Silva <psilva(a)redhat.com&gt; a écrit : >> >> @Emilien Bondu, I was looking that thread again and now I'm wondering if >> you end up with something you can share. >> >> On Fri, Nov 10, 2017 at 9:07 AM, Emilien Bondu <dev.ebondu(a)gmail.com&gt; >> wrote: >> >>> Hi, >>> >>> Maybe you should have a look here : >>> >>> http://lists.jboss.org/pipermail/keycloak-user/2017-March/009830.html >>> >>> >>> Le 10 nov. 2017 à 11:33, Pedro Igor Silva <psilva(a)redhat.com&gt; a écrit : >>> >>> Hi, >>> >>> I think you could probably change your application and remove the >>> resources/paths you want to make public from the list of resources >>> protected by the adapter. >>> >>> On Thu, Nov 9, 2017 at 2:06 PM, Corentin Dupont < >>> corentin.dupont(a)gmail.com&gt; >>> wrote: >>> >>> Another question: how to apply default authorizations? >>> >>> I want to protect my API with authorization in Keycloak. However some >>> resources should be open to the public, accessible without any bearer >>> token. >>> My idea was: >>> - create an "unregistered_user" composite role, containing some basic >>> roles >>> - create a "guest" user, with the unregistered_user role >>> - on the API server, if there is no token in the request I will get the >>> roles of the guest user and user them. If there is a token, I'll use that >>> user permissions. >>> What do you think of that process? >>> >>> Thanks >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >>> >>> >> >> > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Hi, I think you could probably change your application and remove the resources/paths you want to make public from the list of resources protected by the adapter. On Thu, Nov 9, 2017 at 2:06 PM, Corentin Dupont <corentin.dupont(a)gmail.com > wrote: > Another question: how to apply default authorizations? > > I want to protect my API with authorization in Keycloak. However some > resources should be open to the public, accessible without any bearer > token. > My idea was: > - create an "unregistered_user" composite role, containing some basic > roles > - create a "guest" user, with the unregistered_user role > - on the API server, if there is no token in the request I will get the > roles of the guest user and user them. If there is a token, I'll use that > user permissions. > What do you think of that process? > > Thanks > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

I see. We don't have anything like that, sorry. But a option to statically DISABLE policy enforcement for a specific path in keycloak.json (policy-enforcer settings). Also, in order to achieve what you want you probably need to ignore bearer token authentication for these paths you want to make public (although they are intercepted by the adapter). Could you fill a JIRA describing your use case and requirements ? On Sun, Nov 12, 2017 at 6:50 PM, Corentin Dupont < corentin.dupont(a)gmail.com&gt; wrote: > Hi Pedro, > I don't really have public/private paths in the API. > Some resources under those paths can be either public or private, however. > For instance, a URL would be like that: > > www.example.com/api/v1/cities/rome/houses > > I would like that some cities be accessible by everybody without token, > while some others will be private and require auth token and specific roles > to be accessed. > > Thanks! > > > On Fri, Nov 10, 2017 at 11:33 AM, Pedro Igor Silva <psilva(a)redhat.com&gt; > wrote: > >> Hi, >> >> I think you could probably change your application and remove the >> resources/paths you want to make public from the list of resources >> protected by the adapter. >> >> On Thu, Nov 9, 2017 at 2:06 PM, Corentin Dupont < >> corentin.dupont(a)gmail.com&gt; wrote: >> >>> Another question: how to apply default authorizations? >>> >>> I want to protect my API with authorization in Keycloak. However some >>> resources should be open to the public, accessible without any bearer >>> token. >>> My idea was: >>> - create an "unregistered_user" composite role, containing some basic >>> roles >>> - create a "guest" user, with the unregistered_user role >>> - on the API server, if there is no token in the request I will get the >>> roles of the guest user and user them. If there is a token, I'll use >>> that >>> user permissions. >>> What do you think of that process? >>> >>> Thanks >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >> >> >