How to pass the keycloak generated token in get request to rest api?

Question

I am using keycloak for authenticating users. I have used

KeycloakInstalled keycloak = new KeycloakInstalled(config);

in 1st application, I am able to authenticate a user and generate a token.

Now in the next step, I want to use this token to authenticate my rest api in 2nd application (both applications are running on same server , just different ports). For that , in my 2nd application, I have added role '*' in constraint mapping.

ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS | org.eclipse.jetty.servlet.ServletContextHandler.SECURITY );

ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
context.setSecurityHandler(securityHandler);
securityHandler.addRole("*");
ConstraintMapping constraintMapping = new ConstraintMapping();
constraintMapping.setPathSpec("/*");
Constraint constraint = new Constraint();

constraint.setAuthenticate(true);
constraint.setRoles(new String[]{"*"});
constraintMapping.setConstraint(constraint);
securityHandler.addConstraintMapping(constraintMapping);

KeycloakJettyAuthenticator keyCloakAuthenticator = new KeycloakJettyAuthenticator();
AdapterConfig keyCloakConfig = new org.keycloak.representations.adapters.config.AdapterConfig();

keyCloakConfig.setRealm("myRealm");
keyCloakConfig.setAuthServerUrl("http://172.23.49.9:8180/auth");
keyCloakConfig.setSslRequired("none");
keyCloakConfig.setResource("my_resource");
Map<String,Object> credentials = new HashMap<String,Object>();
credentials.put("secret", "xxxxx-xxxxx-xx-877b-ssefssss");
keyCloakConfig.setCredentials(credentials);

keyCloakAuthenticator.setAdapterConfig(keyCloakConfig);

context.getSecurityHandler().setAuthenticator(keyCloakAuthenticator);

When I am trying to use the token generated by first application to access a secured resource in my application through browser like this:

http://localhost:7100/api/v1/test/code=generated_code

I get the following error:

HTTP ERROR: 403 Problem accessing /api/v1/design/test/code=eyJhbGciOiJSUz (truncated for readability)

Reason:

!role

What are the mistakes that I did?

Is this the right way to pass the generated token: /code=generated_token ?

NOTE: I have ensured the keycloak config in both the application is exactly same.

Answer 1

The correct way to send the token generated by Keycloak is in HTTP Header:

Authorization: Bearer {generated_token}