UMA token for service-accounts lacks ClientID, ClientIPAddress and ClientHost claims #15150

dcore94 · 2022-10-25T17:43:46Z

dcore94
Oct 25, 2022

With KC 19.0.2 when my client (which has a service-account) requewsts an Access Token with client credentials the token contains the claims for clientId, clientHost and clientIPAddress.

When it then requests an UMA RPT for specific permissions on an audience those claims are not present any longer.

It was not like that up to version 10 which we were using beforehand migrating.

Is this change in behaviour bound to explicit reasons? It was rather important for some of our clients.

dcore94 · 2022-10-26T07:34:02Z

dcore94
Oct 26, 2022
Author

This is the point where we've seen that the claims are inserted into the userSession during the client credentials grant flow. With the following code:

 userSession.setNote(ServiceAccountConstants.CLIENT_ID, client.getClientId());
 userSession.setNote(ServiceAccountConstants.CLIENT_HOST, clientConnection.getRemoteHost());
 userSession.setNote(ServiceAccountConstants.CLIENT_ADDRESS, clientConnection.getRemoteAddr());

During the permission grant flow this information appears to be lost. We suppose that in UserSessionNoteMapper the value of the note is Null thus it's skipped. Maybe because it is looking it up in another Session?

0 replies

dcore94 · 2022-10-26T11:05:20Z

dcore94
Oct 26, 2022
Author

As we discovered today, since version 12 the client credentials flow has changed and no refresh tokens and sessions are created for clients that authenticate with this flow. Because of that the claims are not ported to the UMA RPT apparently.
When we explicitily ask for the creation of the refresh token for a given client then the claims are there in both OIDT access token and UMA token.
This is the same for when we directly request an UMA token and pass client credentials in Basic Auth form.
Now, the use of refresh tokens is discouraged for software clients.
We understand that during the permission grant flow it's not as clear as in the client_credentials flow whether the requester is a user or a client but isn't there a way to infer this information and add the grants to the UMA token anyway?

0 replies

Navigation Menu

Repository navigation

UMA token for service-accounts lacks ClientID, ClientIPAddress and ClientHost claims #15150

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

UMA token for service-accounts lacks ClientID, ClientIPAddress and ClientHost claims #15150

Uh oh!

dcore94 Oct 25, 2022

Replies: 2 comments

Uh oh!

dcore94 Oct 26, 2022 Author

Uh oh!

dcore94 Oct 26, 2022 Author

dcore94
Oct 25, 2022

dcore94
Oct 26, 2022
Author

dcore94
Oct 26, 2022
Author