Search code examples
restjwtkeycloakwildfly

keycloak jwt token : groups missing

I'm trying to make the wildfly quickstart microprofile-jwt work with keycloak 20.0.3 (https://github.com/wildfly/quickstart/tree/main/microprofile-jwt)

Here is my microprofile-config.properties :

mp.jwt.verify.publickey.location=http://localhost:8280/realms/mp_jwt_realm/protocol/openid-connect/certs
mp.jwt.verify.issuer=http://localhost:8280/realms/mp_jwt_realm

In the quickstart README, you can find a generated jwt token : eyJraWQi...ru5Z2NOmc2XPA

If you paste it in https://jwt.io/ you get this payload :

{
  "sub": "testUser",
  "upn": "testUser",
  "iss": "quickstart-jwt-issuer",
  "aud": "jwt-audience",
  "groups": [
    "Echoer",
    "Subscriber"
  ],
  "birthdate": "2017-09-15",
  "jti": "3b89e56f-b8fd-4d5f-a1ed-080b958873f9",
  "iat": 1579886816,
  "exp": 1579901216
}

With keycloak, I'm not able to generate the 'groups' entry. As a consequence, I get "403 Forbidden" response after querying http://localhost:8080/microprofile-jwt/Sample/subscription with the token from a POST request to http://localhost:8280/realms/mp_jwt_realm/protocol/openid-connect/token

Note : with the same token, the query http://localhost:8080/microprofile-jwt/Sample/helloworld response is "Hello testuser".

Here is the payload of my token :

{
  "exp": 1676989618,
  "iat": 1676989318,
  "jti": "41e1e5c9-7c96-455f-9655-e0c1424850aa",
  "iss": "http://localhost:8280/realms/mp_jwt_realm",
  "aud": "account",
  "sub": "2e263ca7-ab78-4bca-863b-4d2241b3e69c",
  "typ": "Bearer",
  "azp": "microprofile-jwt",
  "session_state": "f9e6396e-3c08-440e-9567-811cd83a7fc9",
  "acr": "1",
  "allowed-origins": [
    "http://localhost:8080"
  ],
  "realm_access": {
    "roles": [
      "default-roles-mp_jwt_realm",
      "Subscriber",
      "offline_access",
      "uma_authorization"
    ]
  },
  "resource_access": {
    "microprofile-jwt": {
      "roles": [
        "Subscriber"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "email profile",
  "sid": "f9e6396e-3c08-440e-9567-811cd83a7fc9",
  "email_verified": false,
  "birthdate": "1974-01-12",
  "preferred_username": "testuser",
  "given_name": "",
  "family_name": ""
}

What shall I do in keycloak to make the quickstart work ?

Solution

  • Well it looks that the UI in keycloak 20 has changed. Here is an answer : Where is the custom protocol mapper in Keycloak 20.0.2?

    Make sure to use the "Group Membership" predefined mapper and "Full group path" OFF.

    Group Membership