Limit roles in token possible when using UMA/token exchange? #14519

nmwael · 2022-09-21T10:00:28Z

nmwael
Sep 21, 2022

Hi we are using keycloak like this

Vue -> Keycloak Frontend client

When user goes to a certain front end page vue requests our backend like this:
Vue -> backend (REST) -> backend does a token exchange ( from frontend to backend client ) and uses UMA to get available resources based on the roles that the logged in user has.

We are seeing that the client role part of our backend client are getting quite large, we are not utilizing the role part since we are asking through UMA and are inspecting permissions instead.

So is it somehow possible to avoid having the roles listed in our access token for the backend, we have tried removing them from our token but just get a permission denied? And still use UMA / RPT ala this

            String userToken = exchangeFrontendTokenToBackendToken.exchangeToken(principal);
            AuthorizationRequest request = new AuthorizationRequest();
            request.addPermission(null, "scope_read");

            AuthorizationResponse response = authzClient.authorization(userToken).authorize(request);
            String rpt = response.getToken();
            // introspect the token
            TokenIntrospectionResponse requestingPartyToken = authzClient.protection().introspectRequestingPartyToken(rpt);


            requestingPartyToken.getPermissions().forEach(permission -> {

                if (permission.getResourceName().matches(type + "/\\d*[^/]")) {
                    permissionsForType.add(Long.parseLong(permission.getResourceName().replace(type + "/", "")));
                }

            });

Navigation Menu

Repository navigation

Limit roles in token possible when using UMA/token exchange? #14519

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Limit roles in token possible when using UMA/token exchange? #14519

Uh oh!

nmwael Sep 21, 2022

Replies: 0 comments

nmwael
Sep 21, 2022